Does My Child-Theme Functions.php Need if{die} Security In It? [duplicate]
IT Nursery
April 29, 2022
0
I’m new to PHP, but I’ve noticed just about every PHP file has a security snippet, “Die if not accessed in the correct manner” script at the beginning; my question, does a child-theme functions.php need something like this as well to make it secure?
PHP:
if ( ! defined( 'ABSPATH' ) ) {
die( 'Direct Access Not Permitted' );
}
4 s 4
Does it need it? Probably not (other than this edge case, props @bravokeyl). Should you add it? In my opinion, yes:
From a coding/architecture POV, you’re declaring “this file needs WordPress”.
Any direct hit to one of your theme’s files (curious users, bots, “script kiddies” etc.) has the potential to leak a little bit of info (most likely filesystem) and/or litter your error logs (e.g. Undefined function get_header in /bada/bing/bada/boom)
Reiterating 1), it’s just good practice.
However, I absolutely hate this:
die( 'Direct Access Not Permitted' );
IMO it should simply be:
if ( ! defined( 'ABSPATH' ) )
exit;
There is just no point in having that “message”. And I’m a big fan of exit. It communicates the fact that this is an expected possible scenario, and in that scenario, I simply wish to quit. I use die for “unexpected” scenarios, like filesystem write errors, database errors etc.