PluginScore

missing_direct_file_access_protection

Missing direct file access protection

A PHP file in the plugin can be loaded directly instead of through WordPress.

medium weight

Why It Shows Up

Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.

Why It Matters

Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.

How to Fix

  • Add a guard near the top of PHP files that are not intended to be requested directly.
  • Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
  • Keep template partials and bootstrap files protected too, not only the main plugin file.

Notes

  • Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.

References

WordPress Coding Standards

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output Not Escaped
#2Intercom060716k+Non Prefixed Function Found
#3Plugin Check (PCP)012813210k+Exception Not Escaped
#4Themify Builder95,1952,0965k+Text Domain Mismatch
#5JetBackup – Backup, Restore & Migrate101,559145100k+Exception Not Escaped
#6Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more1532163500k+Direct Query
#7Visual Composer Website Builder168232040k+Non Prefixed Variable Found
#8AnyComment174454495k+Output Not Escaped
#9JetFormBuilder — Dynamic Blocks Form Builder172,0941,58890k+Text Domain Mismatch
#10wpForo Forum174,0332,92220k+Unsafe Printing Function
#11WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#12Prime Slider Addons for Elementor183,500230100k+Text Domain Mismatch
#13Property Hive181,9576,0273k+Missing
#14Shopping Cart & eCommerce Store185,45917,2984k+Non Prefixed Variable Found
#15WP Import Export Lite1873897940k+Non Prefixed Variable Found
#16Element Pack – Widgets, Templates & Addons for Elementor199,448517100k+Text Domain Mismatch
#17Block Slider – Responsive Image Slider, Video Slider & Post Slider195551,2913k+Non Prefixed Variable Found
#18Download Monitor194251,36480k+Non Prefixed Hookname Found
#19Event Organiser191,10654420k+Text Domain Mismatch
#20Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception Not Escaped
#21Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,22810k+Output Not Escaped
#22Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,909878100k+Exception Not Escaped
#23Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization191,2952,6799k+Output Not Escaped
#24Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195413853m+Missing Translators Comment
#25Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#26Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5284k+Non Prefixed Variable Found
#27SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195261,11990k+Non Prefixed Variable Found
#28BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot205081,40630k+Non Prefixed Variable Found
#29Brizy – Page Builder2058972070k+Output Not Escaped
#30GiveWP – Donation Plugin and Fundraising Platform203,4353,580100k+Output Not Escaped
#31Link Library201,9411,39710k+Unsafe Printing Function
#32Brevo – Email, SMS, Web Push, Chat, and more.20460646100k+Missing Unslash
#33Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non Prefixed Variable Found
#34Nimble Page Builder201,5911,68430k+Missing Arg Domain
#35Pix por Piggly (para Woocommerce)205471954k+Exception Not Escaped
#36Quill Forms | Conversational Multi Step Forms, Surveys & quizzes204013683k+Text Domain Mismatch
#37Remove Add to Cart WooCommerce206161,3784k+Non Prefixed Variable Found
#38Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20557541100k+Output Not Escaped
#39Razorpay for WooCommerce20974855100k+Non Prefixed Function Found
#40WPJAM Basic203283564k+Output Not Escaped
#41Store Locator WordPress212,3721,57210k+Text Domain Mismatch
#42Backup Migration219811,09380k+Non Prefixed Variable Found
#43bbPress219293,672100k+Non Prefixed Function Found
#44rtMedia for WordPress, BuddyPress and bbPress213636338k+Non Prefixed Constant Found
#45CallTrackingMetrics219232863k+Unsafe Printing Function
#46Captcha Them All213003236k+Output Not Escaped
#47CartFlows – Funnel Builder & Checkout Plugin for WooCommerce21461614200k+Text Domain Mismatch
#48Smart Grid-Layout Design for Contact Form 7211,12673410k+Output Not Escaped
#49Comet Cache2185724520k+Output Not Escaped
#50Cost Calculator Builder2132276530k+Non Prefixed Variable Found