Skip to main content

Disable File Editing in Admin

What This Does

This protection disables the built-in WordPress file editor within the admin dashboard.

It prevents users from editing theme and plugin files directly through the WordPress interface.

Why It Matters

By default, WordPress allows administrators to edit PHP files directly from the dashboard.

If an attacker gains admin access, they can:

  • inject malicious code
  • modify plugin or theme files
  • create persistent backdoors

Disabling file editing removes an easy path for exploitation.

When to Apply It

This protection is recommended for most WordPress sites.

Apply it when:

  • your site is in production
  • you manage code through FTP, SSH, or version control
  • you want to reduce risk from compromised admin accounts

When Not to Apply It

You may choose not to apply this protection if:

  • you rely on the built-in editor for quick changes
  • you do not have alternative access (FTP/SSH)
  • your workflow depends on in-dashboard editing

If used, the editor should still be limited to trusted users only.

How Steel Security Applies This

Steel Security disables file editing by updating WordPress configuration.

This typically involves setting:

  • DISALLOW_FILE_EDIT to true

This removes access to the theme and plugin editors in the admin interface.

What to Expect After Applying

After applying this protection:

  • the Theme Editor and Plugin Editor will no longer be accessible
  • users will not be able to edit files from the dashboard
  • existing functionality of your site will remain unchanged

How to Verify

To verify the protection:

  1. Log in to your WordPress admin
  2. Navigate to Appearance → Theme File Editor
  3. Navigate to Plugins → Plugin File Editor

These options should no longer be available.

How to Revert (Rollback)

To revert this protection:

  1. Navigate to the hardening section in Steel Security
  2. Disable the control
  3. Confirm the change
  4. Refresh the admin interface

The file editors will become available again.

Common Issues

Editor Is Missing

This is expected.

The file editing feature has been disabled for security.

Unable to Make Quick Changes

If you relied on the editor:

  • use FTP or SSH instead
  • revert the setting if necessary
  • consider updating your workflow

Setting Does Not Take Effect

  • check for conflicting definitions in wp-config.php
  • ensure the configuration is not overridden by hosting
Back to top