Why is it necessary to prevent direct access to included files? For example:

if ( ! defined( 'ABSPATH' ) ) {
    exit; // Exit if accessed directly.

I notice many plugins do this but I don't see it in WordPress core files (such as capabilities.php for example).

1 Answer 1


Because you could have code that alters the database, shows sensitive information or otherwise trigger events you only want it to execute under the conditions you design without error.

Many core files only hold functions which don't execute if the file is accessed directly.

When they do alter data/files they usually check for $_POST actions, Nonces and verify user permissions before actions are taken. Often times the permissions check is the first thing in the file.

if ( ! current_user_can( 'list_users' ) ) {

if ( ! current_user_can( 'create_users' ) && ! current_user_can('promote_users' ) ) { wp_die

if ( ! defined( 'IFRAME_REQUEST' ) && isset( $_GET['action'] ) && in_array( $_GET['action'], array( 'update-selected', 'activate-plugin', 'update-selected-themes' ) ) ) 

if ( !current_user_can('export') )

If those checks fail they typically terminate the request

wp_die(__('You do not have sufficient permissions to export the content of this site.'));
  • In that case, may I ask why WordPress core doesn't do this? Commented Dec 31, 2015 at 2:58
  • I think you would have to look at them on a case by case basis. Many just hold functions that won't execute. Others verify logged in users, check $_POST, and verify nonces before doing something. Including an ABSPATH check is only ONE way to say, "hopefully this files was included in another file"
    – jgraup
    Commented Dec 31, 2015 at 3:04
  • To the best of my knowledge, WordPress core never implements an ABSPATH or an ABSPATH-like check. I'm wondering why? Commented Dec 31, 2015 at 3:07
  • Thanks for the edit. So are you saying if a file's code is designed with security in mind, the ABSPATH check is redundant (WordPress core files being an example of this)? Commented Dec 31, 2015 at 3:26
  • Correct, the ABSPATH just is a suuuper simple check for 1 single method of access. It's like closing your front door at night.
    – jgraup
    Commented Dec 31, 2015 at 3:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.