WordPress has a built-in editor for your theme and plugin code. You rarely need it, but anyone who gets your WordPress login can use it to hide harmful code on your site in seconds. One line in wp-config.php removes it, so a stolen login can do less damage. Your site, your posts, and installing or updating plugins all keep working as before.
Turn it off
- Log in to your control panel and open File Manager. See How to Log In to cPanel or DirectAdmin.
- Open your site’s folder, usually
public_html. Download a copy ofwp-config.phpas a backup. - Right-click
wp-config.phpand choose Edit. - Just above the line
/* That's all, stop editing! Happy publishing. */, add:
define( 'DISALLOW_FILE_EDIT', true );- Click Save Changes. In wp-admin, the Theme File Editor and Plugin File Editor are now gone.
⚠️ Use straight quotes ', not curly ones like ‘ ’. Phones and WhatsApp often change them, and that breaks the site. If you see a blank page or “critical error” after saving, delete the line and type it again, or put back your backup copy.
What it protects against, and what it doesn’t
This helps only once someone is logged in to your wp-admin. It stops them editing your code there, whether they:
- stole or guessed your password,
- took over your logged-in session through a weak plugin, or
- use an admin account you forgot to remove, such as an old developer’s.
It does not stop someone who gets in through an outdated plugin or theme, who has your control panel or FTP login, or who uses your admin login to install a bad plugin. Treat it as one extra layer, not full protection. What protects you most: keep plugins and themes updated, delete the ones you don’t use, remove old admin users, and use strong passwords with two-factor login. See Secure Your WordPress Website.
Good to know
- Have more than one WordPress site? Each has its own
wp-config.php, so do it for each. - You or your developer can still change code through File Manager or FTP.
