When developing a WordPress plugin, what are the best practices for securing the plugin against attempts to directly access the file? I've seen WordPress plugins use a range of options, from .htaccess files within plugin directories to having empty index.php files in each directory to having each included file give an error if loaded directly (for instance, by failing if ABSPATH is not defined).
Add a comment
|
2 Answers
the .htaccess method will work only for apache and not even for all possible configurations of it, and empty index.php/index.html are to prevent directory listing, so the only proper solution is to check if ABSPATH is defined.
answered Oct 9, 2014 at 16:35
If your plugin have security issues because of files direct access, there's a problem with your plugin. Write good code and don't care about that.
-
7 years later received a downvote for this. And 7 years later I still agree with what I wrote, but today I would have written this differently. I still believe that solving at code level infrastructure-level problems is still a bad idea.– gmazzapAug 1, 2021 at 11:23