Disable File Editing

Disable File Editing removes the dashboard screens that let anyone edit theme or plugin code from the browser - one less disaster if an account is compromised.

What it does

• Optionally blocks the theme editor (Appearance -> Theme File Editor / Site Editor AJAX paths).
• Optionally blocks the plugin editor (Plugins -> Plugin File Editor).
• Uses capability mapping and direct editor URL blocking when those options are on.
• Does not block plugin/theme install, activation, deletion, or updates (that is DISALLOW_FILE_MODS in wp-config, a separate stricter control).
• Other PowerSuite tools (such as Code Snippets) may still allow admin code changes.

When to use it

Enable it if:

• Multiple administrators can access the dashboard.
• You deploy code via Git/SFTP and never need the built-in editors.
• You want a quick hardening step after a security review.

When not to use it

Caution

Leave this module off if:

• You regularly edit theme/plugin files from wp-admin and have no other deploy path.
• You only need to block installs/updates - use DISALLOW_FILE_MODS instead (or in addition).
• wp-config already defines DISALLOW_FILE_EDIT and you prefer that single source of truth.

Settings

• Disable theme editor - blocks Appearance -> Theme File Editor, Site Editor file editing paths, and related AJAX.
• Disable plugin editor - blocks Plugins -> Plugin File Editor and related AJAX.

How to enable it

1. Go to WP PowerSuite -> Modules.
2. Open Security or search for “Disable File Editing”.
3. Toggle Disable File Editing on.
4. Open settings, enable theme and/or plugin editor blocking, then save.

How to test it

• Enable both checkboxes and save.
• Visit Appearance -> Theme File Editor and Plugins -> Plugin File Editor.
• ✅ Pass: editors are blocked or show a disabled message.
• ❌ Fail: confirm settings saved, module is on, and you are not bypassing via a host-level file manager (expected for SFTP).

Troubleshooting

• Editor still opens. Re-save settings; confirm both relevant checkboxes; check for another plugin restoring caps.
• Need to edit code urgently. Toggle the module off or uncheck the relevant editor option, edit, then re-enable.
• Installs still work. Expected - this module does not set DISALLOW_FILE_MODS.

FAQ

What does Disable File Editing do?

It blocks the WordPress theme and/or plugin file editors in the dashboard based on your settings.

Is Disable File Editing free?

Yes. Enable it under WP PowerSuite -> Modules.

Does it stop plugin installs?

No. It only blocks the file editors. DISALLOW_FILE_MODS in wp-config is a separate, stricter control.

Can I block only the plugin editor?

Yes. Use the Disable plugin editor checkbox and leave the theme editor option off.

How do I turn Disable File Editing off?

Go to WP PowerSuite -> Modules, find Disable File Editing, and toggle it off.

Developer notes (hooks & filters)

Source: modules/disable-file-editing/module.php. Boot: critical · context: admin.

Hooks: admin_init (direct editor access block), map_meta_cap (late priority).

Related modules

• Activity Log
• Password Protection
• Force SSL Admin
• Security Headers