Fix missing_direct_file_access_protection

[masteradhoc]

Fixes #759

What?

Adds direct file access protection to plugin PHP files to prevent them from being executed outside of the WordPress runtime.

Why?

WordPress.org coding standards require plugin PHP files to block direct access when WordPress is not loaded. Learn more here

How?

The PR adds a standard abspath guard at the top of affected PHP files. This ensures the files exit early when accessed directly, while leaving normal WordPress execution completely unchanged. No functional or behavioral logic was modified.

Testing Instructions

1. Install Plugin Check Plugin
2. Choose Two Factor, Categories = "Plugin Repo" and Types = "Error" & "Warning"
3. see results
4. apply fix
5. see results

Screenshots or screencast

Changelog Entry

Security - Added direct file access protection to plugin files to align with WordPress.org security guidelines.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>
Co-authored-by: georgestephanis <georgestephanis@git.wordpress.org>
Co-authored-by: kasparsd <kasparsd@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[georgestephanis]

I mean, I guess.

I've just always personally disliked this sort of blanket check -- Core certainly doesn't do it in wp-includes php files -- but it also seems harmless to include, just extra noise.

Merge it in or leave it out, I don't have strong opinions here apart from a subtle distaste for it.

[kasparsd]

As mentioned above, WP core also don't have them in classes and even in wp-config.php (which loads WP core) so I would suggest we don't add them. I'm OK with having it in the main plugin bootstrap file, though.