Why is it necessary to prevent direct access to included files? For example:

if ( ! defined( 'ABSPATH' ) ) {
    exit; // Exit if accessed directly.

I notice many plugins do this but I don't see it in WordPress core files (such as capabilities.php for example).


Because you could have code that alters the database, shows sensitive information or otherwise trigger events you only want it to execute under the conditions you design without error.

Many core files only hold functions which don't execute if the file is accessed directly.

When they do alter data/files they usually check for $_POST actions, Nonces and verify user permissions before actions are taken. Often times the permissions check is the first thing in the file.

if ( ! current_user_can( 'list_users' ) ) {

if ( ! current_user_can( 'create_users' ) && ! current_user_can('promote_users' ) ) { wp_die

if ( ! defined( 'IFRAME_REQUEST' ) && isset( $_GET['action'] ) && in_array( $_GET['action'], array( 'update-selected', 'activate-plugin', 'update-selected-themes' ) ) ) 

if ( !current_user_can('export') )

If those checks fail they typically terminate the request

wp_die(__('You do not have sufficient permissions to export the content of this site.'));
| improve this answer | |
  • In that case, may I ask why WordPress core doesn't do this? – henrywright Dec 31 '15 at 2:58
  • I think you would have to look at them on a case by case basis. Many just hold functions that won't execute. Others verify logged in users, check $_POST, and verify nonces before doing something. Including an ABSPATH check is only ONE way to say, "hopefully this files was included in another file" – jgraup Dec 31 '15 at 3:04
  • To the best of my knowledge, WordPress core never implements an ABSPATH or an ABSPATH-like check. I'm wondering why? – henrywright Dec 31 '15 at 3:07
  • Thanks for the edit. So are you saying if a file's code is designed with security in mind, the ABSPATH check is redundant (WordPress core files being an example of this)? – henrywright Dec 31 '15 at 3:26
  • Correct, the ABSPATH just is a suuuper simple check for 1 single method of access. It's like closing your front door at night. – jgraup Dec 31 '15 at 3:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.