7

I was looking at the options table in a WordPress install and noticed an option name hack_file. At first I thought the site was compromised and then realized it is a default option http://codex.wordpress.org/Option_Reference . I couldn't find much information regarding it. What is it and its purpose?

2 Answers 2

7

As the codex says, it is legacy with probably no use in any modern version. I have been around wordpress since 2.0.4 and I don't remember it being used or referenced so my guess is that it is a really old legacy thing.

3

You can see references to hack_file in WordPress core. Here's an example in WordPress 6.3 in load.php in the wp_get_active_and_valid_plugins function.

Here's the entire function (smaller snippet to follow):

/**
 * Retrieve an array of active and valid plugin files.
 *
 * While upgrading or installing WordPress, no plugins are returned.
 *
 * The default directory is `wp-content/plugins`. To change the default
 * directory manually, define `WP_PLUGIN_DIR` and `WP_PLUGIN_URL`
 * in `wp-config.php`.
 *
 * @since 3.0.0
 * @access private
 *
 * @return string[] Array of paths to plugin files relative to the plugins directory.
 */
function wp_get_active_and_valid_plugins() {
    $plugins        = array();
    $active_plugins = (array) get_option( 'active_plugins', array() );

    // Check for hacks file if the option is enabled.
    if ( get_option( 'hack_file' ) && file_exists( ABSPATH . 'my-hacks.php' ) ) {
        _deprecated_file( 'my-hacks.php', '1.5.0' );
        array_unshift( $plugins, ABSPATH . 'my-hacks.php' );
    }

    if ( empty( $active_plugins ) || wp_installing() ) {
        return $plugins;
    }

    $network_plugins = is_multisite() ? wp_get_active_network_plugins() : false;

    foreach ( $active_plugins as $plugin ) {
        if ( ! validate_file( $plugin )                     // $plugin must validate as file.
            && '.php' === substr( $plugin, -4 )             // $plugin must end with '.php'.
            && file_exists( WP_PLUGIN_DIR . '/' . $plugin ) // $plugin must exist.
            // Not already included as a network plugin.
            && ( ! $network_plugins || ! in_array( WP_PLUGIN_DIR . '/' . $plugin, $network_plugins, true ) )
            ) {
            $plugins[] = WP_PLUGIN_DIR . '/' . $plugin;
        }
    }

    /*
     * Remove plugins from the list of active plugins when we're on an endpoint
     * that should be protected against WSODs and the plugin is paused.
     */
    if ( wp_is_recovery_mode() ) {
        $plugins = wp_skip_paused_plugins( $plugins );
    }

    return $plugins;
}

and here is the specific usage in that first if statement

// Check for hacks file if the option is enabled.
if ( get_option( 'hack_file' ) && file_exists( ABSPATH . 'my-hacks.php' ) ) {
    _deprecated_file( 'my-hacks.php', '1.5.0' );
    array_unshift( $plugins, ABSPATH . 'my-hacks.php' );
}

It looks like you can set hack_file to 1 to enable it and then define my-hacks.php in the root of your WordPress installation (wherever wp-config.php lives). It'll then add it to the list of plugins to load.

So it seems it's a way to add some quick code to a WordPress install without formally creating a plugin or making changes to WordPress core files.

2
  • It looks like it's been deprecated since WordPress 1.5.0, way back in aught-five. I'd recommend against actually using it, though it's an interesting peek into how WP used to work.
    – Pat J
    Commented Apr 19, 2023 at 19:40
  • 1
    I agree. I would not recommend actually using the option.
    – Andrew
    Commented Apr 20, 2023 at 20:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.