0

This question already has an answer here:

I'm currently having a problem with working with AJAX. Well not really a problem since I can pretty much do what I want to do. The only problem is my boss saying that the admin-ajax.php file is an admin file and he doesn't want any admin file in the public side of the website. So my question is is there any alternative ways without using this method to make ajax requests in Wordpress? Here's what I'm currently doing:

add_action('wp_ajax_nopriv_plug_token', array($this, 'plug_get_token'));

add_action('wp_ajax_plug_token', array($this, 'plug_get_token'));

public function plug_get_token(){
  return $token;
  die();
}

And under the wp_enqueue_scripts action hook I'm loading the file for processing ajax request:

wp_localize_script( 
    'plug_public_script', 
    'plug_public', 
    array( 
        'ajaxurl' => admin_url('admin-ajax.php')
    )
);

So I simply call it in my script like this:

jQuery.post(plug_public.ajaxurl, {'action' : 'plug_token'}, function(token){
   //do something with the token
});

My boss said something about moving the admin-ajax.php into a more public location and then call from there. Is there really a security concern when calling admin-ajax.php from its default location?

marked as duplicate by fuxia Dec 11 '13 at 0:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.