Disable File Editing

WordPress includes built-in editors for themes and plugins — right in the admin dashboard. Convenient? Maybe. Dangerous? Definitely. If an attacker gains admin access, these editors let them inject malicious code directly into your site files. If an inexperienced user makes a typo, they can break the entire site. This module removes the editors entirely.

Use Cases#

• Prevent attackers from injecting malicious code through the dashboard
• Stop accidental code breakage by inexperienced administrators
• Enforce proper development workflows (edit locally, deploy properly)
• Meet security compliance requirements that prohibit in-dashboard editing
• Protect production sites from “quick fixes” that cause problems

How It Works#

This is a toggle module — enable it and the file editors disappear. No configuration needed.

When enabled, the module defines the WordPress constant:

define('DISALLOW_FILE_EDIT', true);

This removes:

• Appearance → Theme File Editor — Gone
• Plugins → Plugin File Editor — Gone
• Direct URL access to editor pages — Blocked

What Gets Removed#

The Security Risk#

The built-in editors are a favorite target for attackers because:

1. No authentication beyond admin — If they’re in, they can edit
2. Immediate effect — Changes are live instantly
3. Persistent access — Injected code survives password changes
4. Hard to detect — Malicious code hides in legitimate files
5. Full server access — PHP code can do anything on your server

Common attack scenario:

1. Attacker gets admin credentials (phishing, weak password, etc.)
2. Logs into your WordPress admin
3. Goes to Appearance → Theme File Editor
4. Adds malicious code to functions.php
5. Now they have a backdoor even after you change passwords

This module prevents step 3.

Verification#

After enabling:

1. Go to Appearance menu — “Theme File Editor” should be missing
2. Go to Plugins menu — “Plugin File Editor” should be missing
3. Try visiting yoursite.com/wp-admin/theme-editor.php directly
4. Should see “Sorry, you are not allowed to edit themes for this site.”

Still Need to Edit Files?#

If you need to edit theme or plugin files, use proper methods:

These methods are:

• More secure (not accessible from WordPress admin)
• More traceable (FTP logs, Git history)
• Less prone to mistakes (proper editors with syntax highlighting)

The wp-config.php Alternative#

You can also disable file editing by adding this to wp-config.php:

define('DISALLOW_FILE_EDIT', true);

This module does the same thing but:

• Can be toggled without editing wp-config.php
• Is part of your centralized Switchboard configuration
• Can be disabled if needed without server access

FAQ#

Security Best Practices#

Disabling file editing is just one part of WordPress security hardening: