Missing direct file access protection

Why It Shows Up

Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.

Why It Matters

Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.

How to Fix

• Add a guard near the top of PHP files that are not intended to be requested directly.
• Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
• Keep template partials and bootstrap files protected too, not only the main plugin file.

Notes

• Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.

References