# Block Plugin Installs With DISALLOW_FILE_MODS 1. [Home](https://mysites.guru/) 2. [Tools](https://mysites.guru/tools/) 3. [WordPress configuration](https://mysites.guru/tools/wordpress-configuration/) 4. Block Plugin Installs With DISALLOW\_FILE\_MODS # Block Plugin Installs With DISALLOW\_FILE\_MODS ![Block Plugin Installs With DISALLOW\_FILE\_MODS](https://mysites.guru/_astro/disallow-file-mods.Ix1O0gMz_Z1AmIQ7.webp) define( 'DISALLOW\_FILE\_MODS', true ); blocks plugin and theme installs, updates and deletes in wp-admin, including WordPress's automatic security updates. ## Quick answer Add this line to wp-config.php to stop plugins and themes being installed, updated or deleted from wp-admin. It also switches off WordPress's automatic updates and implies DISALLOW\_FILE\_EDIT, so only use it when updates reach the site some other way. ```php define( 'DISALLOW_FILE_MODS', true ); ``` Article Contents - [What the DISALLOW\_FILE\_MODS check reads](#what-the-disallow_file_mods-check-reads) - [Why a compromised admin reaches for the plugin installer first](#why-a-compromised-admin-reaches-for-the-plugin-installer-first) - [What you give up in exchange](#what-you-give-up-in-exchange) - [Adding DISALLOW\_FILE\_MODS to wp-config.php](#adding-disallow_file_mods-to-wp-configphp) - [Locking down installs across all your sites](#locking-down-installs-across-all-your-sites) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) How common is this? - 93% of the WordPress sites we have this data for fail this check. Platform: WordPress. Measured across the sites we audit, on each site's most recent snapshot. ## What the DISALLOW\_FILE\_MODS check reads This check reads your site’s `wp-config.php` for the `DISALLOW_FILE_MODS` constant and confirms it’s both defined and set to `true`. If it’s missing, or present but `false`, the check fails. Because the constant also switches off automatic updates, a passing result on this check is worth cross-referencing against how current your plugins and core version actually are, rather than assuming a strict setting alone means a well-maintained site. ## Why a compromised admin reaches for the plugin installer first If an attacker gets administrator access to a WordPress site, whether through a leaked password, a phished login, or a privilege-escalation bug in another plugin, installing a malicious plugin is usually the very first thing they do. It’s the most reliable way to get persistent code execution: upload a plugin, activate it, and it runs on every page load from then on, survives a core update, and often disguises itself well enough to sit unnoticed for months. `DISALLOW_FILE_MODS` removes that option entirely by disabling plugin and theme installs, updates and deletions through wp-admin, for every account, compromised or not. It’s a stricter setting than [`DISALLOW_FILE_EDIT`](https://mysites.guru/tools/wordpress-configuration/disallow-file-edit/), and it implies it: anywhere `DISALLOW_FILE_MODS` is set to `true`, the plugin and theme editor is already gone too, whether or not you’ve separately set the narrower constant. That’s the whole trade-off in one sentence: this is the strongest single setting against a compromised admin account installing anything through the dashboard, and it’s stricter because it also removes some things you might still want. The two constants exist as separate options for a reason, and it’s worth choosing rather than assuming stricter is always better. `DISALLOW_FILE_EDIT` alone is a sensible middle ground for a site where an agency or a client still needs to install plugins occasionally through wp-admin, but nobody should ever need the raw code editor. `DISALLOW_FILE_MODS` is the right call for a site that’s finished changing, where any install or update is a intended, occasional event handled by whoever manages the site, not routine admin-panel work. ## What you give up in exchange The trade-off worth being explicit about is automatic updates. WordPress’s own background update mechanism, the one that applies core security patches without you doing anything, writes files to disk using the same code path that `DISALLOW_FILE_MODS` blocks. Setting the constant to `true` doesn’t just stop you installing plugins through wp-admin, it stops WordPress patching itself too. That’s a reasonable trade to make on a site you actively manage and keep an eye on, but it isn’t free, and a site left running with this constant set and nobody checking for security releases is worse off than one running ordinary auto-updates. This also switches off WordPress’s own security updates Setting DISALLOW\_FILE\_MODS means core, plugin and theme auto-updates stop applying in the background as well as manual installs. If you set this, you need another way to know when a security release is out, whether that’s mySites.guru’s version checks, a WordPress mailing list, or a habit of checking regularly. ## Adding DISALLOW\_FILE\_MODS to wp-config.php 1. Connect to your site via SFTP, SSH, or your hosting file manager, and open `wp-config.php` in the site root. This is the same file `DISALLOW_FILE_EDIT` lives in, so if you’ve already set that constant, you’re adding this one alongside it, not replacing it. 2. Add the constant above the `/* That's all, stop editing! Happy publishing. */` line: ```php define( 'DISALLOW_FILE_MODS', true ); ``` 3. Confirm it took effect: log into `https://yoursite.com/wp-admin`, and check that Plugins → Add New and the plugin/theme editor screens are no longer available anywhere in the dashboard. 4. Decide how you’ll track security releases now that background updates are blocked. That might be watching the [WordPress security release announcements](https://wordpress.org/news/category/security/), or relying on mySites.guru’s own version checks against your connected sites. 5. When you need to install or update something, remove or comment out the constant, make the change through wp-admin as normal, then set it back to `true` afterwards. Installing over SFTP or WP-CLI works at any time regardless of this setting, since neither goes through the code path the constant restricts. 6. On a multisite network, this constant lives in the single, shared `wp-config.php`, so setting it applies to every site in the network in one go rather than needing repeating per site. ## Locking down installs across all your sites mySites.guru checks every connected WordPress site for this constant on each snapshot, twice a day, and can set `DISALLOW_FILE_MODS` to `true` in `wp-config.php` with one click, across every connected site at once, rather than editing each one by hand. Because the trade-off here includes losing automatic security updates, mySites.guru’s own version tracking on every connected site becomes the backstop that keeps you from missing one. ## [Block Plugin Installs With DISALLOW\_FILE\_MODS](https://mysites.guru/free-audit/?check=wordpress/wordpressconfiguration/disableplugininstaller) mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run twice a day on every connected site. It can also fix this across every connected site with one click. [Check your site for free](https://mysites.guru/free-audit/?check=wordpress/wordpressconfiguration/disableplugininstaller) ## Further Reading - [WordPress.org: Editing wp-config.php](https://wordpress.org/support/article/editing-wp-config-php/) ## Frequently Asked Questions Show all What's the difference between DISALLOW\_FILE\_MODS and DISALLOW\_FILE\_EDIT? DISALLOW\_FILE\_EDIT only removes the in-admin code editor. DISALLOW\_FILE\_MODS goes further: it blocks plugin and theme installs, updates and deletions entirely, and it implies DISALLOW\_FILE\_EDIT as well, so setting it makes the narrower constant redundant. Does DISALLOW\_FILE\_MODS stop WordPress's automatic updates too? Yes, and this is the trade-off most guides skip over. WordPress's own background updates, including core security releases, go through the same file-modification code path that DISALLOW\_FILE\_MODS blocks. Setting it means you're taking on responsibility for applying security updates yourself, on whatever schedule you choose to keep. How do I install a plugin once DISALLOW\_FILE\_MODS is set? Comment out or remove the constant temporarily, install or update what you need through wp-admin as normal, then set it back to true. Alternatively, install the plugin over SFTP or WP-CLI, neither of which the constant restricts. [![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/) ### Article Contents - [What the DISALLOW\_FILE\_MODS check reads](#what-the-disallow_file_mods-check-reads) - [Why a compromised admin reaches for the plugin installer first](#why-a-compromised-admin-reaches-for-the-plugin-installer-first) - [What you give up in exchange](#what-you-give-up-in-exchange) - [Adding DISALLOW\_FILE\_MODS to wp-config.php](#adding-disallow_file_mods-to-wp-configphp) - [Locking down installs across all your sites](#locking-down-installs-across-all-your-sites) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) - **Published** - 28 August 2026 - **Applies to** - WordPress - **One-click fix** - Yes, in mySites.guru Share [](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Fwordpress-configuration%2Fdisallow-file-mods%2F&text=Block%20Plugin%20Installs%20With%20DISALLOW_FILE_MODS)[](https://bsky.app/intent/compose?text=Block%20Plugin%20Installs%20With%20DISALLOW_FILE_MODS%20https%3A%2F%2Fmysites.guru%2Ftools%2Fwordpress-configuration%2Fdisallow-file-mods%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Fwordpress-configuration%2Fdisallow-file-mods%2F) Topics [WordPress configuration](https://mysites.guru/tools/wordpress-configuration/)WordPress [ ★★★★★ > "Over the years you have provided an amazing service . Questions have been answered promptly and the price for the service is unheard of" ![Chris Park](https://mysites.guru/images/reviews/chris-park.webp) Chris Park36 years of programming ](https://mysites.guru/reviews/) ## More checks in [WordPress configuration](https://mysites.guru/tools/wordpress-configuration/) - [ ### Disable XML-RPC In WordPress Block xmlrpc.php in WordPress with one .htaccess or nginx rule. Why XML-RPC is a brute-force and pingback target, and when Jetpack or the apps still need it. ](https://mysites.guru/tools/wordpress-configuration/disable-xmlrpc/) - [ ### Disable File Editing With DISALLOW\_FILE\_EDIT Add define( 'DISALLOW\_FILE\_EDIT', true ); to wp-config.php to remove the plugin and theme file editor from wp-admin. What it blocks and what it doesn't. ](https://mysites.guru/tools/wordpress-configuration/disallow-file-edit/) - [ ### Let Search Engines Index The Site "Discourage search engines from indexing this site" in Settings > Reading keeps crawlers away. How to switch it off, and why to check robots.txt too. ](https://mysites.guru/tools/wordpress-configuration/search-engine-visibility/) ## More from the blog [ ![How to Stop Any Plugin Installs in WordPress Admin](https://mysites.guru/_astro/stop-plugin-installs-wordpress-admin.DcFkK7lt_19sfhy.webp) ### How to Stop Any Plugin Installs in WordPress Admin Add DISALLOW\_FILE\_MODS to wp-config.php to block plugin and theme installs in WordPress admin. Code snippet, wp-cli usage, and how to enforce it. ](https://mysites.guru/blog/stop-plugin-installs-wordpress-admin/)[ ![WordPress Debug Constants Explained](https://mysites.guru/_astro/mySites.guru-REFRESH-BLACK-4.CmCw9zU0_ZEz6yt.webp) ### WordPress Debug Constants Explained WP\_DEBUG\_LOG writes errors to a publicly accessible file that Google has indexed on thousands of sites. Here's the fix, plus what every debug constant does. ](https://mysites.guru/blog/understanding-wordpress-debug-constants/) ## See where your own sites stand One free audit of one site · no card · about 2 minutes to connect [Get Your Free Site Audit](https://manage.mysites.guru/en/register) [What the DISALLOW\_FILE\_MODS check reads](#what-the-disallow_file_mods-check-reads) [Why a compromised admin reaches for the plugin installer first](#why-a-compromised-admin-reaches-for-the-plugin-installer-first) [What you give up in exchange](#what-you-give-up-in-exchange) [Adding DISALLOW\_FILE\_MODS to wp-config.php](#adding-disallow_file_mods-to-wp-configphp) [Locking down installs across all your sites](#locking-down-installs-across-all-your-sites) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)