PluginScore

missing_direct_file_access_protection

Missing direct file access protection

A PHP file in the plugin can be loaded directly instead of through WordPress.

medium weight

Why It Shows Up

Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.

Why It Matters

Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.

How to Fix

  • Add a guard near the top of PHP files that are not intended to be requested directly.
  • Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
  • Keep template partials and bootstrap files protected too, not only the main plugin file.

Notes

  • Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.

References

WordPress Coding Standards

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#351DK PDF – WordPress PDF Generator237443353k+Exception output is not escaped
#352Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy2317082140k+Non-prefixed global variable
#353Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,72310,28340k+Non-prefixed namespace
#354EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder233551,5412k+Non-prefixed global variable
#355Ecwid by Lightspeed Ecommerce Shopping Cart2333930720k+Missing direct file access protection
#356ElementsReady Addons for Elementor232316663k+Non-prefixed global variable
#357Error Log Monitor236941,41420k+Non-prefixed global variable
#358Essential Real Estate235295,0608k+Non-prefixed global variable
#359EventON – Events Calendar232,5851,0216k+Text Domain Mismatch
#360Events Addon for Elementor237791,3397k+Non-prefixed global variable
#361Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI233951,34290k+Non-prefixed global variable
#362Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999400Non-prefixed global variable
#363Ezoic2343251610k+Output is not escaped
#364Fastcache by Host.it231,327203800Text Domain Mismatch
#365Featured Images in RSS for Mailchimp & More237801,29920k+Non-prefixed global variable
#366Feed Them Social – Social Media Feeds, Video, and Photo Galleries2356353520k+Output is not escaped
#367Filr – Secure document library237751,317700Non-prefixed global variable
#368Finpose – Accounting for WooCommerce231,6491,307400Non-prefixed global variable
#369Image Photo Gallery Final Tiles Grid235781,50220k+Non-prefixed global variable
#370Five-Star Ratings Shortcode236041,317600Non-prefixed global variable
#371Flexmls® IDX Plugin231,2689571k+Output is not escaped
#372Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder234,7461,27930k+Non Singular String Literal Domain
#373Freshdesk (official)23194386900Non-prefixed function
#374Front End PM239782,2645k+Non-prefixed global variable
#375Tracking and Consent Manager – WP Full Picture231,2803,2233k+Non-prefixed global variable
#376Futurio Extra2378720520k+Text Domain Mismatch
#377FV Flowplayer Video Player231,3111,45420k+Output is not escaped
#378GAinWP Google Analytics Integration for WordPress235251768k+Output is not escaped
#379GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress233,5892,76010k+Output is not escaped
#380The GDPR Framework By Data443231,28751710k+Short PHP open tag found
#381Anti-Malware Security and Brute-Force Firewall23543965100k+Output is not escaped
#382Gmedia Photo Gallery233501,1217k+Non-prefixed global variable
#383Groovy Menu Plugin (Free)231,7292834k+Text Domain Mismatch
#384Groundhogg — CRM, Newsletters, and Marketing Automation231369212k+Non-prefixed global variable
#385Gutenberg23605327300k+Missing direct file access protection
#386Interactive Content – H5P2356538040k+Non Singular String Literal Domain
#387Happy Addons for Elementor23573444400k+Output is not escaped
#388Houzez Property Feed231,4641,5851k+Text Domain Mismatch
#389Hunk Companion232,5476876k+Text Domain Mismatch
#390Ibtana – Ecommerce Product Addons231,5471,7186k+Non Singular String Literal Domain
#391Iks Menu – WordPress Category Accordion Menu & FAQs236151,29310k+Non-prefixed global variable
#392Image Carousel For Divi235691,3091k+Non-prefixed global variable
#393Import from YML2397308400Non-prefixed global variable
#394RealHomes Memberships235162641k+Non Singular String Literal Domain
#395Payment forms, Buy now buttons, and Invoicing System | GetPaid233891,2665k+Non-prefixed global variable
#396IP Geo Block233995898k+Output is not escaped
#397Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress2391694300k+Non-prefixed namespace
#398Joli FAQ SEO – WordPress FAQ Plugin231,0831,526700Non-prefixed global variable
#399Justified Gallery235891,4178k+Non-prefixed global variable
#400Kadence Blocks — Page Builder Toolkit for Gutenberg Editor23552,127600k+Non-prefixed global variable