By default, WordPress allows editing of theme and plugin files directly from the admin panel. While this can be useful in some cases, it also poses a security risk. If an attacker gains access to the admin panel with sufficient privileges, they could modify critical files and completely compromise the site.
Fortunately, it’s possible to disable this functionality easily by editing the wp-config.php file. In this article, we’ll show you how to do it and why it’s recommended as a security measure.
⚠️ Why Disable File Editing in WordPress?
From the Appearance > Theme File Editor and Plugins > Plugin File Editor menus, administrators can directly modify site files. However, this presents several risks:
Increased vulnerability to attacks: If an attacker gains access to the admin panel, they can modify PHP files and run malicious code.
Accidental errors: An incorrect change in a PHP file can break the site and make it inaccessible.
Unnecessary in most cases: Developers usually edit files from an external editor and upload them via FTP or SSH.
🛠️ How to Disable File Editing via wp-config.php
A very simple way to disable it is by adding this line of code to your WordPress configuration file, usually wp-config.php (if it hasn’t been modified):
define('DISALLOW_FILE_EDIT', true);
Once the changes are saved, the file editors for themes and plugins will no longer be accessible from the WordPress admin panel.
🏁 Conclusion
Disabling file editing from the admin panel is a simple but effective way to improve WordPress security. With just one line of code in wp-config.php, you can prevent unauthorized users from modifying critical files and reduce the risk of attacks.