# Disable File Editing in Admin

## What This Does

This protection disables the built-in WordPress file editor within the admin dashboard.

It prevents users from editing theme and plugin files directly through the WordPress interface.

---

## Why It Matters

By default, WordPress allows administrators to edit PHP files directly from the dashboard.

If an attacker gains admin access, they can:

- inject malicious code  
- modify plugin or theme files  
- create persistent backdoors  

Disabling file editing removes an easy path for exploitation.

---

## When to Apply It

This protection is recommended for most WordPress sites.

Apply it when:

- your site is in production  
- you manage code through FTP, SSH, or version control  
- you want to reduce risk from compromised admin accounts  

---

## When Not to Apply It

You may choose not to apply this protection if:

- you rely on the built-in editor for quick changes  
- you do not have alternative access (FTP/SSH)  
- your workflow depends on in-dashboard editing  

If used, the editor should still be limited to trusted users only.

---

## How Steel Security Applies This

Steel Security disables file editing by updating WordPress configuration.

This typically involves setting:

- `DISALLOW_FILE_EDIT` to true  

This removes access to the theme and plugin editors in the admin interface.

---

## What to Expect After Applying

After applying this protection:

- the Theme Editor and Plugin Editor will no longer be accessible  
- users will not be able to edit files from the dashboard  
- existing functionality of your site will remain unchanged  

---

## How to Verify

To verify the protection:

1. Log in to your WordPress admin  
2. Navigate to Appearance → Theme File Editor  
3. Navigate to Plugins → Plugin File Editor  

These options should no longer be available.

---

## How to Revert (Rollback)

To revert this protection:

1. Navigate to the hardening section in Steel Security  
2. Disable the control  
3. Confirm the change  
4. Refresh the admin interface  

The file editors will become available again.

---

## Common Issues

### Editor Is Missing

This is expected.

The file editing feature has been disabled for security.

---

### Unable to Make Quick Changes

If you relied on the editor:

- use FTP or SSH instead  
- revert the setting if necessary  
- consider updating your workflow  

---

### Setting Does Not Take Effect

- check for conflicting definitions in `wp-config.php`  
- ensure the configuration is not overridden by hosting  

---

## Related

- [Disable Debug Mode](https://docs.steelwp.com/books/hardening-reference/page/disable-debug-mode)
- [Safe Rollback Practices](https://docs.steelsecurity.com/books/plugin-guide/page/safe-rollback-practices)