When developing a WordPress plugin, what are the best practices for securing the plugin against attempts to directly access the file? I've seen WordPress plugins use a range of options, from .htaccess files within plugin directories to having empty index.php files in each directory to having each included file give an error if loaded directly (for instance, by failing if ABSPATH is not defined).

2 Answers 2


the .htaccess method will work only for apache and not even for all possible configurations of it, and empty index.php/index.html are to prevent directory listing, so the only proper solution is to check if ABSPATH is defined.


If your plugin have security issues because of files direct access, there's a problem with your plugin. Write good code and don't care about that.

  • 7 years later received a downvote for this. And 7 years later I still agree with what I wrote, but today I would have written this differently. I still believe that solving at code level infrastructure-level problems is still a bad idea.
    – gmazzap
    Aug 1, 2021 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.