What this problem looks like
DISALLOW_FILE_EDIT removes the Theme Editor and Plugin Editor submenus. It does not stop uploads or plugin installs by itself.
Compromised admin accounts cannot use the dashboard to drop PHP backdoors into theme files when editing is disabled, though they may still upload malicious plugins without broader hardening.
Disable file editing constant
Place the line above /* That's all, stop editing! */ in wp-config.php.
define( 'DISALLOW_FILE_EDIT', true );What this does and does not block
- Removes Appearance → Theme File Editor.
- Removes Plugin → Plugin File Editor.
- Does not block plugin installation or updates.
- Does not replace SFTP access for attackers with stolen credentials.
Safer ways to edit code
Use a child theme and deploy changes via SFTP, Git, or CI. Test on staging before production.
Optional DISALLOW_FILE_MODS
This stronger constant blocks plugin and theme installation from wp-admin entirely. Use on locked-down enterprise sites where deploys are automated only.
define( 'DISALLOW_FILE_MODS', true );Verify after security plugins
Some security plugins re-enable editors or duplicate the setting. Check effective constants with wp config get DISALLOW_FILE_EDIT on CLI.
When to stop DIY and hire help
Hardening production without breaking agency workflows needs staging exceptions and role planning. BugShield secures WordPress sites on maintenance plans with monitored updates.