Reject all malicious URL requests functions.php

All publicly visible sites on the internet get hit with ridiculous URL requests fairly often. These come from script kiddies (low-rent cybercriminals, the kind of children who think they’re l33t or something) trying to get your site to misbehave and give them access using (mostly) old tricks that exploit long-fixed bugs. Some of the tricks they try are decades old.

Trying to stay ahead of these ridiculous URLs on your own site isn’t worth your trouble: you’ll just be playing whack-a-mole. There’s already lots of stuff in WordPress, php, and web servers (like Apache and litespeed) to repel these attempted invasions. You’re much better off doing these things:

1. Regularly updating WordPress, your themes, and your plugins to the latest versions. These updates often fix security issues and plug new holes, and often (not always) before the kiddies figure out how to exploit them.

2. Making it really hard to guess your administrative username / password combinations. Use a hard to guess username rather than admin. And use a hard to guess password.

3. Installing a security plugin to slow down the kiddies.

4. Not keeping data on about visitors to your site unless you have good reasons. Sites with less data are less interesting to kiddies.

That being said, pretty much all WordPress add-on code, like yours, must be registered as a Hook : an Action or a Filter so WordPress knows when to run it and what to do with the result. Often a big challenge when writing code to add in to WordPress is figuring out which hook to use. Did the code snippet in your question mention which hook should invoke it?

The first hook on an ordinary WordPress page is do_parse_request. If you return false from this filter WordPress goes on to completely ignore the incoming web request.

So you might try

add_filter('do_parse_request', my_parse_request_filter, 10, 3 );
function my_parse_request_filter ($continue, $wp, $extra_query_vars) {
  if ( something is wrong with $_SERVER['REQUEST_URI'] ) {
    $wp->query_vars['error'] = 414;
    $return false;
  }
  return $continue;
}

but any administrator or other logged-in user isn’t yet known in that filter.