WordPress restrict plugin file direct access

Question 1. so where it is defined before
Answer:

It is defined in WordPress core.

Here a quick online reference or for a local reference take a look at the following file in the root of WordPress: wp-settings.php. In that file (around line 18) following code is shown:

define( 'WPINC', 'wp-includes' );

Question 2. and it is not abort the execution on the file
Answer:

The use (the goal so to say) of it is to protect plugins from direct access
(from the outside, preventing any unauthorized access to your code)
Two ways to achieve this protection, some developers use WPINC and others use ABSPATH as in:

if (!defined('ABSPATH')) exit; (or replace exit with die("No cheating!") or other txt)
if ( ! defined( 'WPINC' ) ) die; (or use exitin same way as above)

Both defined as follow:

define( 'ABSPATH', dirname(dirname(__FILE__)) . "https://wordpress.stackexchange.com/" );
define( 'WPINC', 'wp-includes' );

dirname (generic PHP) simply returns the directory from a full path.
wp-includes is pretty self explanatory.

You are free to decide which to use. I personally think there is no real right way , both have the same purpose. I use only ABSPATH but it is all up to your personal preference.
Just remember to add it directly below the header section or at least near the top of your plugin.

Related Posts: