As developers, one of the most important things we can do is prevent direct access to your plugin. By this, I mean if someone gets clever and tries to access to one of the files located in any given plugin’s directory, they should not be able to execute any of the code in the script.

A simple plugin’s directory from which the below source is pulled.
And I know: This seems like something that’s easy (it is), but even in a recent project, I’m reminded how it’s not something that even some of the most useful plugins do.
I can only chalk this up to lack of awareness or perhaps lack of education. If you’re not setting your work up to prevent direct plugin access to your plugin, you’re leaving a significant security gap in place, and it’s something that can be easily corrected.




