When developing a WordPress plugin, what are the best practices for securing the plugin against attempts to directly access the file? I've seen WordPress plugins use a range of options, from .htaccess files within plugin directories to having empty index.php files in each directory to having each included file give an error if loaded directly (for instance, by failing if ABSPATH is not defined).
.htaccess method will work only for apache and not even for all possible configurations of it, and empty
index.html are to prevent directory listing, so the only proper solution is to check if
ABSPATH is defined.
If your plugin have security issues because of files direct access, there's a problem with your plugin. Write good code and don't care about that.