How to Disable WordPress Theme and Plugin Editors from the Admin Panel

WordPress comes with built-in editors for themes and plugins that allow users to edit the folders that make up the theme and plugins directly from the admin panel. While this may seem incredibly useful, these built-in features can also lead to numerous security issues that can turn your website into a fertile ground for malware.

In this article, we will show you how to disable WordPress theme and plugin editors from the admin panel. To make it easier to navigate, we’ve broken it down into different ways you can try:

Why You Should Disable WordPress Theme and Plugin Editors?

You will find the theme editor by going to: Appearance > Theme editor in admin panel:

By default, your editor will display files from the currently active theme. The first file you will see in the editor is style.css. Other available files are in the Theme Files list in the right sidebar.

You can access the plugin editor by going to: Plugins > Plugin editor in the admin panel. It will show one of the installed plugins, first in alphabetical order.

If this is your first time accessing the theme and plugin editor, you will receive this notification from WordPress and it will warn you. these editors can be harmful to your website.

In the latest versions of WordPress, Slightly upgraded theme and plugin editors to avoid edits that could cause bugs and crashes. For example, if you enter an incorrect line of code, the editor will report the error before allowing you to save the changes.

As you can see, you have option to save changes to file regardless of warning.

The problem with these built-in editors is, access any code on your website. This turns them into possible tools for cyber attacks.

If a hacker gains access to your WordPress admin panel, these editors allow them to modify vulnerable files and inject malicious code into them.

they do by participating in brute force attacks on a WordPress site. As soon as they crack the password of the admin account, they access the theme and plugin editor to modify the files. But the breach doesn’t always come from outside. If you have a client or employee with full access to the admin panel, accidentally insert malicious code or cause a website to crash.

So it is highly recommended disable WordPress editors for themes and plugins.

How to Disable Theme and Plugin Editors

The easiest way to close both editors is to add one line of code to the wp-config.php file. Now we’ll show you how to do this with an FTP client, cPanel, and more.

Using the FTP Client

For this method, you will need an FTP client like the one below. Filezilla. Filezilla is incredibly practical and easy to use, even for less experienced users.

In this article, you will find a detailed guide on how to access wp-config.php using FTP. Before you start editing the wp-config file, keep this in mind: even a small mistake can cause errors on your website. To avoid these problems, make a backup of your website and also a copy of the wp-config.php file.

Now, open the file on your server in a text editor and add the following line of code before the line: ‘That’s all, stop editing! happy publishing‘:

define( 'DISALLOW_FILE_EDIT', true );

When you do this, save this edit to file and change wp-config.php with edited file

When you return to the WordPress admin panel, you will find that access to these editors is no longer possible.

using cPanel

For some users it is easier to edit the wp-config.php file using cPanel. The process is similar to the FTP method. Firstly, You need to login to your cPanelusually accessed via address http://mydomain.com/cpanel. After logging in, Click on File Manager.

In the tab below, structure of directories on your server. If you have more than one domain name, mark the folder with your domain name. This folder contains the files from your WordPress installation, including the wp-config.php file. Right-click the file and select Edit.

Add the following line of code in the file editor and click the Save button:

define( 'DISALLOW_FILE_EDIT', true );

You have now disabled the theme and plugin editors in the WordPress admin panel. You can always import the file copy from your backup in case of an error in the process.

Using the Functions.Php File

If you don’t want to edit your wp-config.php file, it’s also possible to add the same line of code to your functions.php file. Accessing the function.php file using FTP is similar to finding the wp-config.php file. Just go to theme folder, right click on function.php file and select View/Edit:

When you open the file in a text editor, add the following line of code at the end of the function.php file.

define( 'DISALLOW_FILE_EDIT', true );

Using Third-Party Add-ons

If you want to avoid modifying files and coding, you have the option to disable the theme and plugin editors using third-party plugins. One type of plugin allows you to automatically add the required lines of code, while the other type simply disables the editors..

If you want to use a plugin to add code, we will show you how to do it using a plugin. Code Snippet plugin this will add the following line of code.

define( 'DISALLOW_FILE_EDIT', true );

To disable editors automatically, we recommend installing the following: Disable the File Editor plugin. All you have to do is install and activate the tool. It has no customizable settings, so when you enable it automatically disable theme and plugin editors.

Since most WordPress users use theme and plugin editors to search for code in files, add child-theme-specific CSS, and edit code, here is an alternative way to do it after disabling the editors. Simply go to: Appearance > Customize > Additional CSS domain:

You can use FTP software to edit theme and plugin files.

*Bonus Tip for Extra Security

Since our main goal here is to prevent security issues with your website, here is another way to prevent hackers from exploiting your site’s vulnerabilities. You can do disable the option to add a new theme or install/delete plugins. If you add this line of code to your wp-config.php file, you will notice that this option is no longer available.

define('DISALLOW_FILE_MODS',true);

You can enable or disable plugins that are already installed.

However, Be careful adding this line of code because some plugins require file changes to work properly. For example, Loco Translate plugin It creates and modifies files with .mo and .po extensions. The same goes for plugins that allow you to configure a child theme.

If you see the following notification after activating the plugin, you know that this code is causing problems with your plugins.

In this case, you need to allow the file modification and use one of the previous steps we described.

final thoughts

While the WordPress admin panel is the simplest way to access the theme and plugin editors, due to the ever-increasing focus on site security, our recommendation is to consider some of these options and disable the editors. This way you will fully control the theme and plugin editing process and improve the protection of your site.