Prevent direct access to wp-settings.php to avoid uncaught error

[amitjoel85]

The wp-settings.php file should not be accessed directly. If a user attempts to load it directly, a 500 error will be returned. so i have restrict direct access call of this file to ensure all code works well.

https://core.trac.wordpress.org/ticket/63930

[nikunj8866]

Test Report

Patch tested: ​https://github.com/WordPress/wordpress-develop/pull/9747

Steps to Reproduce or Test

1. Open ​http://localhost:8889/wp-settings.php directly in a browser. (Or open ​https://YOURSITE.com/wp-settings.php on a live site.)
2. 🐞 Bug occurs. It returned 500 Internal Server Error.

Expected Results

When testing a patch to validate it works as expected:

• ✅ WordPress site should die( '-1' ) just like other core files.

When reproducing a bug:

• ❌ Error condition occurs. It returned 500 Internal Server Error.

Environment

• WordPress: 6.8.2
• PHP: 8.4.10
• Server: nginx/1.26.1
• Database: mysqli (Server: 8.0.35 / Client: mysqlnd 8.4.10)
• Browser: Chrome 140.0.0.0
• OS: Windows 10/11
• Theme: ModernPress 1.0.0
• MU Plugins: None activated
• Plugins:
  • Test Reports 1.2.0

Actual Results

When reproducing a bug/defect:

• ❌ Directly accessing wp-settings.php file, it returned 500 Internal Server Error.

When testing the bugfix patch:

• ✅ Issue resolved with patch. Direct access correctly triggers a die( '-1' ) message.

[ocean90]

Duplicate of #62722.