I’m new to PHP, but I’ve noticed just about every PHP file has a security snippet, “Die if not accessed in the correct manner” script at the beginning; my question, does a child-theme functions.php need something like this as well to make it secure?

PHP:

if ( ! defined( 'ABSPATH' ) ) {
    die( 'Direct Access Not Permitted' );
}

4 s
4

Does it need it? Probably not (other than this edge case, props @bravokeyl). Should you add it? In my opinion, yes:

  1. From a coding/architecture POV, you’re declaring “this file needs WordPress”.
  2. Any direct hit to one of your theme’s files (curious users, bots, “script kiddies” etc.) has the potential to leak a little bit of info (most likely filesystem) and/or litter your error logs (e.g. Undefined function get_header in /bada/bing/bada/boom)
  3. Reiterating 1), it’s just good practice.

However, I absolutely hate this:

die( 'Direct Access Not Permitted' );

IMO it should simply be:

if ( ! defined( 'ABSPATH' ) )
    exit;

There is just no point in having that “message”. And I’m a big fan of exit. It communicates the fact that this is an expected possible scenario, and in that scenario, I simply wish to quit. I use die for “unexpected” scenarios, like filesystem write errors, database errors etc.

Leave a Reply

Your email address will not be published. Required fields are marked *