I'm developing a WP plugin. In my plugin I have a file that processes form data. For example, user will enter shortcode:


And it will output a form with the action attribute set to the /wp-content/plugins/MyPlugin/process_form.php. I have added a rewrite rule so the new path looks like /poll-form.

In process_form.php I need to access my plugin settings using the Settings API.

I was under the impression that the scripts within my plugin directory have access to the Wordpress Core.

How do I get access to the Wordpress API's from within my script in the plugin?

  • I am pretty sure this question is the functional equivalent of this one: wordpress.stackexchange.com/q/80050/21376
    – s_ha_dum
    Commented Jun 2, 2015 at 23:01
  • You should never use a plugin file as an AJAX or form endpoint, it's a massive security risk
    – Tom J Nowell
    Commented Jun 4, 2015 at 1:51
  • @TomJNowell What's the alternative? And what security risks are you talking about that can't be solved with correct validation/sanitization? Commented Jun 4, 2015 at 19:05
  • That file will still run even if the plugin is disabled or deactivated. If you need to submit a form on a page, just use that page as the target, and detect at the very top. E.g. If you ask me a question, do I really need to find a 3rd person to give my answer to?
    – Tom J Nowell
    Commented Jun 5, 2015 at 14:23

1 Answer 1


I believe you're using ajax refering the process_form.php. However the right way to access any ajax is through the wp-admin/admin-ajax.php.

Pull all your code from process_form.php to a function (can be added on your main plugin file):

function my_process_form() {
    //...code from process_form.php
    if ( ! $error ) { //your error boolean
        return wp_json_success(); //recommend for return an success as JSON
    } else {
        return wp_json_error(); //recommend for return an error as JSON

Than, add a hook to the ajax action, like so:

//You can choose one of those or leave both:
add_action( 'wp_ajax_my_process_form', 'my_process_form' ); //Only logged users
add_action( 'wp_ajax_nopriv_my_process_form', 'my_process_form' ); //Not logged users

In Javascript, you must call the url wp-admin/admin-ajax.php with the parameter you hooked, in this case my_proccess_form:

PHP calling JS and send the admin-ajax.php URL:

wp_enqueue_script( 'my-custom-script', plugins_url( '/js/my_custom.js', __FILE__ ), array('jquery') );

    'my-custom-script', //JS referenced above
    'ajax_object', //Javascript Object
        'ajax_url' => admin_url( 'admin-ajax.php' ) //Same as wp-admin/admin.ajax.php

I'll send you an example using jQuery for the AJAX request:

     type : "post",
     dataType : "json", //Example only
     url : ajax_object.ajax_url, //From wp_localize_script
     data : { //can use jQuery.serialize() as well
         action: "my_process_form", //used on wp_ajax_(action) and wp_ajax_nopriv_(action)
         post_id : 1, //Dummy id, more parameters, use comma
         nonce: nonce //Read https://codex.wordpress.org/Function_Reference/wp_create_nonce
     success: function( response ) {
         if( response.success ) {
             //Success JS Process
         } else {
             console.log( response );


https://codex.wordpress.org/AJAX_in_Plugins https://codex.wordpress.org/Plugin_API/Action_Reference/wp_ajax_(action) https://codex.wordpress.org/Plugin_API/Action_Reference/wp_ajax_nopriv_(action) https://codex.wordpress.org/Function_Reference/wp_localize_script

---- UPDATE ----

If you prefer use $_POST without AJAX, you can use the hook admin_post_(action)

HTML example:

<form action="<?php echo admin_url('admin-post.php'); ?>" method="post">
  <input type="hidden" name="action" value="my_process_form">
  <input type="text" name="name">
  <input type="email" name="email">
  <input type="submit" value="Submit">

PHP Example:

add_action( 'admin_post_my_process_form', 'my_process_form' );

function my_process_form() {
    // The process_form.php code here
  • I'm not using Ajax, and it's not an option. 3.2% of my website visitors are using screen readers (mainly Jaws). Commented Jun 3, 2015 at 9:27
  • Hi @JamesJeffery, if you want to use only post, you can follow the same idea, but refering the admin_post(action). Let me know if you need an example. Commented Jun 4, 2015 at 0:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.