/wp-includes/theme-compat/embed.php causes unnecessary errors in request log

[arjenlentz]

FastCGI sent in stderr: "PHP message: PHP Fatal error: Call to undefined function get_header() in [...]/wp-includes/theme-compat/embed.php on line 13"

It's being called directly: "GET /wp-includes/theme-compat/embed.php HTTP/1.1"
Of course people shouldn't, but they do, for a purpose: to derive certain information or find vulnerabilities.
It also clutters error logs, which may cause real errors to get missed.

Other WP include and plugin files that contain direct code (rather than only function/class definitions), have a catch for this:

 if ( ! defined( 'ABSPATH' ) ) {
         exit; // Exit if accessed directly.
 }

I suggest this gets added to the top of the /wp-includes/theme-compat/embed.php file.
Easy fix.
thanks

[swissspidy]

Other WP include and plugin files that contain direct code (rather than only function/class definitions), have a catch for this

Only some files include such checks, not all.

IMHO this is something that should be prevented on the web server level using .htaccess or similar.

[vizkr]

@swissspidy

.htaccess is a hug performance drain and it's usage is strongly discouraged upon by Apache 2.4 plus nginx doesn't even support the construct. So if this file is a common foot printing vector why not fix this in the file?

[swissspidy]

This is not unique to embed.php though. One could just as well try to access wp-includes/default-filters.php and get a similar warning. The only real way to prevent this is in the server settings. Turning off error display and direct access to PHP files can be done in both Apache and nginx.