0

When developing a WordPress plugin, what are the best practices for securing the plugin against attempts to directly access the file? I've seen WordPress plugins use a range of options, from .htaccess files within plugin directories to having empty index.php files in each directory to having each included file give an error if loaded directly (for instance, by failing if ABSPATH is not defined).

2

the .htaccess method will work only for apache and not even for all possible configurations of it, and empty index.php/index.html are to prevent directory listing, so the only proper solution is to check if ABSPATH is defined.

0

If your plugin have security issues because of files direct access, there's a problem with your plugin. Write good code and don't care about that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.