PluginScore

missing_direct_file_access_protection

Missing direct file access protection

A PHP file in the plugin can be loaded directly instead of through WordPress.

medium weight

Why It Shows Up

Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.

Why It Matters

Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.

How to Fix

  • Add a guard near the top of PHP files that are not intended to be requested directly.
  • Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
  • Keep template partials and bootstrap files protected too, not only the main plugin file.

Notes

  • Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.

References

WordPress Coding Standards

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#201Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms221,03772220k+Unsafe printing function
#202HeadSpace2 SEO229403603k+Text Domain Mismatch
#203Hesabfa Accounting22467718400Text Domain Mismatch
#204Heureka22557254400Exception output is not escaped
#205History Log by click5226751,290400Direct Query
#206IMPress for IDX Broker221,0856366k+Text Domain Mismatch
#207Insert or Embed Articulate Content into WordPress226591,4372k+Non-prefixed global variable
#208The Innovative Form Builder – IvyForms22713250600Exception output is not escaped
#209InfiniteWP Client222,2861,812200k+Exception output is not escaped
#210Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#211JCC Payment Gateway for Woocommerce222,2731,136600Text Domain Mismatch
#212JCH Optimize221,1451364k+Output is not escaped
#213Jetpack – WP Security, Backup, Speed, & Growth222,9751,3483m+Text Domain Mismatch
#214Jim Soft Swiss QR Invoice22262392400Non-prefixed global variable
#215LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3693,34970k+Non-prefixed global variable
#216Custom Login Page Customizer – Login Designer225881,45530k+Non-prefixed global variable
#217Mail Baby SMTP22385699600SQL query is not prepared
#218MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6252,45810k+Output is not escaped
#219MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution221,1311,844800Non-prefixed global variable
#220Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider22207323500k+Non-prefixed global variable
#221Modula Image Gallery – Photo Grid & Video Gallery22474436100k+Text Domain Mismatch
#222Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress229191,23010k+Output is not escaped
#223Motors – Car Dealership & Classified Listings Plugin225,3405,9599k+Text Domain Mismatch
#224myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#225Newsletters222,9682,2482k+Text Domain Mismatch
#226NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2722,063100k+Non-prefixed global variable
#227WP OAuth Server (OAuth Authentication)221893473k+Non-prefixed function
#228oik224891802k+Non Singular String Literal Domain
#229Packeta228013338k+Exception output is not escaped
#230PagBank / PagSeguro Connect para WooCommerce225057574k+Non-prefixed global variable
#231PAYCOMET for WooCommerce221,2064232k+Text Domain Mismatch
#232PDF Builder for WPForms22321266900SQL query is not prepared
#233Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#234Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#235Premium Addons for Elementor – Powerful Elementor Templates & Widgets222331,036700k+Non-prefixed hook name
#236Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#237Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#238Pronamic Pay222581,0772k+Non-prefixed global variable
#239PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#240Quick Contact Form222606231k+Non-prefixed function
#241RabbitLoader Cache: Optimize your Website for Speed222411632k+Output is not escaped
#242RealPress – Real Estate Plugin226041,167500Non-prefixed global variable
#243Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#244Salon Booking System – Free Version226556202k+Missing direct file access protection
#245Social Sharing Plugin – Sassy Social Share221,689233100k+wp function not compatible with requires wp
#246Sellsy22586490400Non Singular String Literal Domain
#247Seraphinite Accelerator2259425550k+Output is not escaped
#248ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF221,044800300k+Non-prefixed global variable
#249Simple Job Board226341,35510k+Non-prefixed global variable
#250Slick Popup: Contact Form 7 Popup Plugin222,3223162k+Text Domain Mismatch