Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

It's common for plugin developers to protect their plugins from direct access. I saw two ways to do that:

if ( ! defined( 'WPINC' ) ) die;

and

if ( ! defined( 'ABSPATH' ) ) exit;

What are the differences between WPINC and ABSPATH? Which one is the 'right' way to do it?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

They are defined as follows:

define( 'ABSPATH', dirname(dirname(__FILE__)) . '/' );
define( 'WPINC', 'wp-includes' );

dirname is a PHP function that returns the path of the parent directory, and wp-includes is pretty self explanatory.

I would say ABSPATH is better because it's one of the first things WP loads and it also looks better:) But there is no real "right way" because they both work.

share|improve this answer
2  
There is no real right way, and I always use if ( ! defined( 'ABSPATH' ) ) exit;... but, maybe, consider that the scope of this snippet is ensure that wordpress is loaded 'WPINC' is better because is more wordpressfull staring with 'WP'. –  gmazzap Jul 31 '13 at 4:53

if ( ! defined( 'WPINC' ) ) die; and if ( ! defined( 'ABSPATH' ) ) exit; add an extra layer of security by preventing any direct access to your plugin file. ABSPATH is a PHP constant defined by WordPress in its core.

If your plugin file is accessed from outside of WordPress, the constant ABSPATH or WPINC will not be defined, so it exits the plugin code, preventing any unauthorized access to your code.

ABSPATH and WPINC are defined in WordPress core as:

define( 'ABSPATH', dirname(dirname(__FILE__)) . '/' );
define( 'WPINC', 'wp-includes' );

Both are used for same purpose.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.