Disable the Theme & Plugin File Editor

The Problem

WordPress ships with a built-in code editor under Appearance → Theme File Editor and Plugins → Plugin Editor that lets any administrator edit PHP files directly from wp-admin — no version control, no confirmation dialog, just a single "Update File" button. That's convenient for a solo developer, but it's also one of the first things an attacker checks after gaining admin access through a leaked password, a vulnerable plugin, or a hijacked session. Instead of needing a separate file-upload vulnerability, they can paste a backdoor straight into a theme's functions.php and save it instantly. Because the editor requires no extra authentication beyond an active admin session, it turns one compromised login into full code execution on your server.

The Code

if ( ! defined( 'DISALLOW_FILE_EDIT' ) ) {
    define( 'DISALLOW_FILE_EDIT', true );
}

How It Works

`DISALLOW_FILE_EDIT` is a constant WordPress checks in wp-admin/includes/menu.php, well after your theme and plugins have finished loading — so setting it here still works even though it's more commonly documented as a wp-config.php setting. When it evaluates to `true`, WordPress removes the "Theme File Editor" and "Plugin Editor" screens from the admin menu entirely and blocks direct access to those admin-ajax actions if requested manually, regardless of the user's role. The `if ( ! defined(...) )` guard exists purely so this doesn't throw a "constant already defined" notice if your host or another plugin has already set it — it's not needed for the security behavior itself, which only depends on the constant ending up `true` before that admin screen renders.

Where To Add This

A snippet manager plugin (e.g. WPCode, Code Snippets). This is a one-line, permanent policy decision, not something you'd want to toggle off during normal work — a snippet manager still gives you a clean single place to see it's active and remove it if you ever genuinely need the in-browser editor back for emergency access.