# Disable File Editing With DISALLOW_FILE_EDIT 1. [Home](https://mysites.guru/) 2. [Tools](https://mysites.guru/tools/) 3. [WordPress configuration](https://mysites.guru/tools/wordpress-configuration/) 4. Disable File Editing With DISALLOW\_FILE\_EDIT # Disable File Editing With DISALLOW\_FILE\_EDIT ![Disable File Editing With DISALLOW\_FILE\_EDIT](https://mysites.guru/_astro/disallow-file-edit.DIN_jghp_AbJVk.webp) Add define( 'DISALLOW\_FILE\_EDIT', true ); to wp-config.php to remove the plugin and theme file editor from wp-admin. What it blocks and what it doesn't. ## Quick answer Add this line to wp-config.php, above the "That's all, stop editing" comment. It removes the Theme File Editor and Plugin Editor from wp-admin for every user, so stolen admin credentials can't be used to edit PHP in the browser. ```php define( 'DISALLOW_FILE_EDIT', true ); ``` Article Contents - [What the DISALLOW\_FILE\_EDIT check reads](#what-the-disallow_file_edit-check-reads) - [The fastest route from stolen credentials to running code](#the-fastest-route-from-stolen-credentials-to-running-code) - [Set to true, permanently](#set-to-true-permanently) - [How to set DISALLOW\_FILE\_EDIT in wp-config.php](#how-to-set-disallow_file_edit-in-wp-configphp) - [Setting it on every site at once](#setting-it-on-every-site-at-once) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) How common is this? - 61.4% of the WordPress sites we have this data for fail this check. Platform: WordPress. Measured across the sites we audit, on each site's most recent snapshot. ## What the DISALLOW\_FILE\_EDIT check reads This check reads your site’s `wp-config.php` for the `DISALLOW_FILE_EDIT` constant and confirms it’s both defined and set to `true`. If the constant is missing entirely, or present but set to `false`, the check fails. ## The fastest route from stolen credentials to running code WordPress ships with a built-in code editor, tucked under Appearance → Theme File Editor and Plugins → Plugin Editor, that lets anyone with an administrator account open any theme or plugin PHP file, edit it in a browser textarea, and save it straight back to disk. The change takes effect on the very next page load, with no deployment step, no file permissions to fight with, and no trace beyond whatever your host’s own file-change logging happens to catch. That convenience is exactly the problem. If an attacker gets hold of valid administrator credentials, through a leaked password, a phished login, or a vulnerable plugin that lets them escalate privileges, the theme editor is usually the fastest route to running their own PHP on your server. There’s no upload step to trip a file-type restriction and no plugin install to leave an obvious new entry in your plugins list. They open `functions.php`, paste in whatever they want, and it’s live immediately. `DISALLOW_FILE_EDIT` removes that specific screen from the admin area entirely, for every user, administrators included, so that route simply isn’t there to use. It’s worth being precise about what this constant does and doesn’t do. It’s one layer in a defence-in-depth approach, not a complete fix for a compromised admin account. An attacker with real admin access can still install a plugin from the repository, or one they’ve uploaded, and get the same outcome a different way. `DISALLOW_FILE_EDIT` closes the single fastest, quietest path, not every path. It’s also worth noticing why this particular route gets used so often in practice. Installing a new plugin leaves an obvious trace: a new entry in the plugins list, a new set of files with a recent modification date, something a site owner glancing at their dashboard might notice. Editing an existing, already-trusted file through the theme editor leaves almost nothing comparable. The file was already there, already active, and already excluded from most people’s mental model of “things that might have changed.” That’s the quality that makes it worth removing as an option entirely, rather than relying on anyone noticing after the fact. ## Set to true, permanently `DISALLOW_FILE_EDIT` should be defined and set to `true` in `wp-config.php` on every live site: ```php define( 'DISALLOW_FILE_EDIT', true ); ``` There’s rarely a good reason to leave this off permanently on a production site. If you genuinely need the in-admin editor for a specific piece of work, the better pattern is to enable it temporarily, make the change, and set it back to `true` immediately afterwards, rather than leaving the door open by default. If you find yourself reaching for the theme editor regularly enough that toggling this constant back and forth feels like friction, that’s usually a sign the underlying workflow needs fixing rather than a reason to leave the constant off. A version-controlled deployment process, or even routine SFTP access for the person making changes, achieves the same outcome without leaving a standing route into the codebase for anyone who gets into the admin account, intentionally or not. ## How to set DISALLOW\_FILE\_EDIT in wp-config.php 1. Connect to your site via SFTP, SSH, or your hosting control panel’s file manager, and open `wp-config.php` in the site root. 2. Find the line that reads `/* That's all, stop editing! Happy publishing. */` and add the constant on its own line, before it: ```php define( 'DISALLOW_FILE_EDIT', true ); ``` 3. Save the file and confirm the change took effect: log into `https://yoursite.com/wp-admin`, and check that Appearance → Theme File Editor and Plugins → Plugin Editor are no longer listed in the menu. 4. If you manage a multisite network, be aware that setting this in the network’s shared `wp-config.php` applies it across every site in the network at once, which is usually what you want, rather than needing to repeat the change per site. 5. If you need to make a manual code change later, edit the file directly over SFTP or SSH instead of re-enabling the constant. If you must re-enable it temporarily, set it back to `true` as soon as the change is made. This pairs with DISALLOW\_FILE\_MODS DISALLOW\_FILE\_EDIT only removes the code editor. If you also want to block plugin and theme installs and updates through wp-admin entirely, see [DISALLOW\_FILE\_MODS](https://mysites.guru/tools/wordpress-configuration/disallow-file-mods/), which is stricter and implies this constant as well. ## Setting it on every site at once mySites.guru checks every connected WordPress site for this constant on each snapshot, twice a day, and can set `DISALLOW_FILE_EDIT` to `true` in `wp-config.php` with one click, across every connected site at once, rather than editing each one by hand. ## [Disable File Editing With DISALLOW\_FILE\_EDIT](https://mysites.guru/free-audit/?check=wordpress/wordpressconfiguration/disablefileediting) mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run twice a day on every connected site. It can also fix this across every connected site with one click. [Check your site for free](https://mysites.guru/free-audit/?check=wordpress/wordpressconfiguration/disablefileediting) ## Further Reading - [WordPress.org: Hardening WordPress - disable file editing](https://wordpress.org/support/article/hardening-wordpress/#disable-file-editing) ## Frequently Asked Questions Show all What does DISALLOW\_FILE\_EDIT actually remove? It disables the built-in Theme Editor and Plugin Editor screens under Appearance and Plugins in wp-admin, which otherwise let anyone with an administrator account edit PHP files directly in the browser and have the changes take effect immediately. Does DISALLOW\_FILE\_EDIT stop file uploads or malware infections? No. It only removes one specific route, the in-admin code editor. It does nothing to stop a malicious plugin being installed, a vulnerable plugin being exploited, or a file being uploaded through some other mechanism entirely. It's one layer, not a complete defence. Can I still edit theme files if I turn this on? Yes, just not through wp-admin. SFTP, SSH, or your hosting file manager all still work exactly as before. All DISALLOW\_FILE\_EDIT removes is the ability to do it from inside the WordPress dashboard itself. [![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/) ### Article Contents - [What the DISALLOW\_FILE\_EDIT check reads](#what-the-disallow_file_edit-check-reads) - [The fastest route from stolen credentials to running code](#the-fastest-route-from-stolen-credentials-to-running-code) - [Set to true, permanently](#set-to-true-permanently) - [How to set DISALLOW\_FILE\_EDIT in wp-config.php](#how-to-set-disallow_file_edit-in-wp-configphp) - [Setting it on every site at once](#setting-it-on-every-site-at-once) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) - **Published** - 28 August 2026 - **Applies to** - WordPress - **One-click fix** - Yes, in mySites.guru Share [](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Fwordpress-configuration%2Fdisallow-file-edit%2F&text=Disable%20File%20Editing%20With%20DISALLOW_FILE_EDIT)[](https://bsky.app/intent/compose?text=Disable%20File%20Editing%20With%20DISALLOW_FILE_EDIT%20https%3A%2F%2Fmysites.guru%2Ftools%2Fwordpress-configuration%2Fdisallow-file-edit%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Fwordpress-configuration%2Fdisallow-file-edit%2F) Topics [WordPress configuration](https://mysites.guru/tools/wordpress-configuration/)WordPress [ ★★★★★ > "If Phil is available via chat, there will be an immediate response and if there is an issue, it will be resolved immediately . Very fast support." ![BerD.nl](https://mysites.guru/images/reviews/berd-nl.webp) BerD.nlIT-manager ](https://mysites.guru/reviews/) ## More checks in [WordPress configuration](https://mysites.guru/tools/wordpress-configuration/) - [ ### Disable XML-RPC In WordPress Block xmlrpc.php in WordPress with one .htaccess or nginx rule. Why XML-RPC is a brute-force and pingback target, and when Jetpack or the apps still need it. ](https://mysites.guru/tools/wordpress-configuration/disable-xmlrpc/) - [ ### Block Plugin Installs With DISALLOW\_FILE\_MODS define( 'DISALLOW\_FILE\_MODS', true ); blocks plugin and theme installs, updates and deletes in wp-admin, including WordPress's automatic security updates. ](https://mysites.guru/tools/wordpress-configuration/disallow-file-mods/) - [ ### Let Search Engines Index The Site "Discourage search engines from indexing this site" in Settings > Reading keeps crawlers away. How to switch it off, and why to check robots.txt too. ](https://mysites.guru/tools/wordpress-configuration/search-engine-visibility/) ## More from the blog [ ![WordPress Debug Constants Explained](https://mysites.guru/_astro/mySites.guru-REFRESH-BLACK-4.CmCw9zU0_ZEz6yt.webp) ### WordPress Debug Constants Explained WP\_DEBUG\_LOG writes errors to a publicly accessible file that Google has indexed on thousands of sites. Here's the fix, plus what every debug constant does. ](https://mysites.guru/blog/understanding-wordpress-debug-constants/)[ ![Deep Security Audit for WordPress & Joomla](https://mysites.guru/_astro/audit.CP2a34sl_Z1QXldP.webp) ### Deep Security Audit for WordPress & Joomla Surface-level scanners miss hidden malware. File-level audits check every line of code against 1,500+ patterns to find backdoors other tools miss. ](https://mysites.guru/blog/security-audit-tools/) ## See where your own sites stand One free audit of one site · no card · about 2 minutes to connect [Get Your Free Site Audit](https://manage.mysites.guru/en/register) [What the DISALLOW\_FILE\_EDIT check reads](#what-the-disallow_file_edit-check-reads) [The fastest route from stolen credentials to running code](#the-fastest-route-from-stolen-credentials-to-running-code) [Set to true, permanently](#set-to-true-permanently) [How to set DISALLOW\_FILE\_EDIT in wp-config.php](#how-to-set-disallow_file_edit-in-wp-configphp) [Setting it on every site at once](#setting-it-on-every-site-at-once) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)