Template partials should not be publicly accessible

[jonoaldersonwp]

Requests to ​https://wordpress.org/ URLs ending in header.php or footer.php return template partials.

E.g., ​https://wordpress.org/plugins/classic-editor/header.php.

These types of requests should return normal behaviour for these URLs (usually a 404 response).

[dd32]

This functionality is actually intentional in many parts of WordPress.org, it's expected that header.php is accessible directly due to the mismatch of systems we run.

[jonoaldersonwp]

That's terrifying ;)

Can we prevent direct browser access to it, and force/return a 404?

[Otto42]

Unfortunately, no. Not without breaking the way that trac and the codex work.

I'm going to mark this as wontfix for now, but maybe in the future when we have a different type of integration with these systems then we will be able to not have these accessible from outside, as it were.