I was wondering if there was a simple way to prevent direct access to asset files within a WordPress plugin. Primarily javascript files.

I'm developing a plugin that's meant to be used only in the admin dashboard, and I would like the javascript files this plugin uses to not be exposed to the public. It should only be able to be run by a logged-in admin on the dashboard.

Currently, anyone can access a plugin asset file directly through the URL via https://DOMAIN.com/wp-content/plugins/YOURPLUGIN/assets/YOURJSFILE.js

So if somewhere were to somehow get that domain they can few the JS file.

Hope that question makes sense.


2 Answers 2


so you need to make sure you are using the hook "admin_enqueue_scripts". this only loads the script on the admin side. admin_enqueue_scripts is the proper hook to use when enqueuing scripts and styles that are meant to be used in the administration panel. Despite the name, it is used for enqueuing both scripts and styles.

you can find more about the function here https://developer.wordpress.org/reference/hooks/admin_enqueue_scripts/

Hope this was helpful.


WordPress provides no mechanism for granular control of filesystem/server access - rather this is something which would be managed through server configuration. WordPress server environments are generally configured to entirely skip loading WordPress and directly serve any URL which resolves to an actual filepath.

@Abraham.Olaobaju's answer is generally sufficient - the vast majority of servers are not configured to present a filesystem index when accessing a directory, so if the assets are only enqueued within the dashboard (ideally only on the relevant pages) then it is unlikely that general public users/visitors could become aware of the assets in order to request them directly, despite the files technically remaining available for direct access to all.

If it is absolutely imperative that you protect access to file assets in situations where you do not have control over the server configuration, the only way I can think of to enforce access control would be to store the assets' contents in some medium other than a servable file. The easiest route to doing so is probably to define the contents as a PHP string and conditionally perform the delivery via a wp_add_inline_script() call within your admin_enqueue_scripts hook (I've opted for HEREDOC string syntax in order to most easily facilitate whatever quotes which the script might contain):

function wpse407311_admin_script() {
  return <<SCRIPT
    console.log( 'Hello World!' );

function wpse407311_enqueue_admin_assets() {
  wp_enqueue_script( 'wpse407311-admin-script-dummy', '', [ 'jquery' ] );
  wp_add_inline_script( 'wpse407311-admin-script-dummy', wpse407311_admin_script() );

add_action( 'admin_enqueue_scripts', 'wpse407311_enqueue_admin_assets' );

It is somewhat detrimental to developer experience to remove asset code from appropriately typed files - if you're using this mechanism with larger assets or in a more complex project, it would probably be prudent to use a build step to generate PHP files containing the asset strings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.