Skip to content

Fix missing_direct_file_access_protection - #760

Merged
kasparsd merged 18 commits into
WordPress:masterfrom
masteradhoc:patch-3
Feb 13, 2026
Merged

Fix missing_direct_file_access_protection#760
kasparsd merged 18 commits into
WordPress:masterfrom
masteradhoc:patch-3

Conversation

@masteradhoc

@masteradhoc masteradhoc commented Jan 30, 2026

Copy link
Copy Markdown
Collaborator

Fixes #759

What?

Adds direct file access protection to plugin PHP files to prevent them from being executed outside of the WordPress runtime.

Why?

WordPress.org coding standards require plugin PHP files to block direct access when WordPress is not loaded. Learn more here

How?

The PR adds a standard abspath guard at the top of affected PHP files. This ensures the files exit early when accessed directly, while leaving normal WordPress execution completely unchanged. No functional or behavioral logic was modified.

Testing Instructions

  1. Install Plugin Check Plugin
  2. Choose Two Factor, Categories = "Plugin Repo" and Types = "Error" & "Warning"
  3. see results
  4. apply fix
  5. see results

Screenshots or screencast

Changelog Entry

Security - Added direct file access protection to plugin files to align with WordPress.org security guidelines.