Uncaught Error: Call to undefined function get_header()

Damned bots. I’m getting these errors several times a day.

Why does Automattic(?) recommend the following code for plugins, but not for themes?

Per https://codex.wordpress.org/Writing_a_Plugin

Security Note: Consider blocking direct access to your plugin PHP files by adding the following line at the top of each of them. Also, be sure to refrain from executing sensitive standalone PHP code before calling any WordPress functions.

This can be achieved in a few ways. You can either check to see if the ABSPATH constant is defined, or check if a function such as add_action exists. Either method can be used to ensure PHP execution is only allowed when it is included as part of the core system.

defined( 'ABSPATH' ) or die( 'No script kiddies please!' );

“You’re doing things wrong.”

@anevins, do you know why Taariqq is visiting this URL? Did you rule out that perhaps it’s to recreate the problem where Googlebot visits this URL and generates a PHP error as part of its typical crawling activity.

If Google is “wrong”, that may be, but this also seems to indicate a problem with how some WordPress themes fail to block crawling in locations where legitimate bots are likely to go.

@taariqq, there seem to be a flaw in WordPress guidelines for themes, where WordPress guidelines are missing a step that are already part of the plugin guidelines.

For now, it seems that your only option is to point out this problem to the theme developer, and ask them to block this behavior by adding code like the following to the index.php file, in order to block typical bot and script kiddy behavior. This code comes from WordPress’ official guidelines for plugin development — not sure why it’s missing from the theme guidelines.

defined( 'ABSPATH' ) or die( 'No script kiddies please!' );

Actually, in an ideal design, WordPress guidelines would state the the use of index.php files should be restricted to paths that are directly accessible by the public, including search engine crawlers and other bots.

Or else if a given index.php file is not meant to be publicly-accessible, then the theme developer should manually insert code to the start of their index.php file to indicate as much, and then exit or fail gracefully.

Preferably, this would not generate a PHP error message, because (1) the PHP code has not failed and (2) the visitor is exhibiting anticipated behavior even if the behavior is not desirable in many contexts.