Why it is bad to use this

include("../../../wp-load.php"); ??

What is the proper way of use this??


  • 1
    The proper way is not to use it. What are you trying to do? – kovshenin Mar 27 '15 at 10:27

The problem in this solution is, that the location of this file are different. WordPress allow the definition of the folder of plugins and themes, different to your static path check for the wp-load.php.

Example for custom paths

// Custom content directory
define( 'WP_CONTENT_DIR',  dirname( __FILE__ ) . '/wp-content' );
define( 'WP_CONTENT_URL',  'http://' . $_SERVER['HTTP_HOST'] . '/wp-content' );
// Custom plugin directory
define( 'WP_PLUGIN_DIR',   dirname( __FILE__ ) . '/wp-plugins' );
define( 'WP_PLUGIN_URL',   'http://' . $_SERVER['HTTP_HOST'] . '/wp-plugins' );
// Custom mu plugin directory
define( 'WPMU_PLUGIN_DIR', dirname( __FILE__ ) . '/wpmu-plugins' );
define( 'WPMU_PLUGIN_URL', 'http://' . $_SERVER['HTTP_HOST'] . '/wpmu-plugins' );

Why this is wrong

The follow 3 points are copied form Ottos post. You find also alternatives in this post.

  • You don’t have the first clue where wp-load.php actually is. Both the plugin directory and the wp-content directory can be moved around in the installation. ALL the WordPress files could be moved about in this manner, are you going to search around for them?
  • You’ve instantly doubled the load on that server. WordPress and the PHP processing of it all now have to get loaded twice for every page load. Once to produce the page, and then again to produce your generated javascript.
  • You’re generating javascript on the fly. That’s simply crap for caching and speed and such.
  • thanks for your reply. But I am still confused. I read the Ottos post before this post. Why people use this include("../../../wp-load.php"); ?? What should I use instead of this ?? Thanks – Foysal Mar 28 '15 at 4:38
  • People use this to include the loader of WordPress, to get all functionalities of WordPress. If the file is exist on this folder and the include works, then can you use all functionalities of WordPress, like outside the installation of WordPress. – bueltge Mar 28 '15 at 10:07
  • Only the first of the three points you copied from Otto are relevant to the question. The others make no sense outside the context of Otto's post. – Quinn Comendant Sep 11 '15 at 23:11

It is bad because on any security aware wordpress setting you will not be able to directly execute php on any folder except for the root one, which is the situation in which that line of code is usually used.

there is no proper way to do "that", it should never be done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.