Founding offer 50% off all plans for the first 100 customers, and your renewal price is locked for life. 74 spots left Claim your spot
Turquoise abstract wavy W logo on a black background
Turquoise abstract wavy W logo on a black background
White WP PowerSuite logo on a black background
White WP PowerSuite logo on a black background

Summarize with AI:

On This Page
Last updated: 24/07/2026

Disable File Editing

Remove the dashboard screens that let anyone edit theme or plugin code from the browser—one less disaster if an account is compromised.

Overview

Removes the Theme Editor and/or Plugin Editor from wp-admin so compromised accounts cannot rewrite code from the browser. Both editors default to blocked. When both are blocked, sets DISALLOW_FILE_EDIT and blocks direct editor access (including admin-ajax paths). Does not stop FTP/SSH/host file managers. Soft overlap with code-snippet / config editors (different surfaces).

Solid black square
Solid black square
Who is this for?
  • Production hardening baselines
  • Client sites where Theme Editor is a liability
  • Shared-admin environments

Features

Theme and/or plugin editor off
Toggle each surface independently (both on by default).
DISALLOW_FILE_EDIT
Sets the WordPress constant when both editors are blocked.
Capability / direct-access block
Stops editor screens and related ajax routes.
Reversible
Turn the module off when a trusted deploy needs the editors again.

Use Cases

  • Client production sites
    Remove Theme/Plugin Editor before handoff.
  • Multi-admin teams
    Stop “quick CSS edits” that become untracked production changes.
  • Incident surface reduction
    Pair with 2FA and Activity Log for privileged-access hygiene.

Frequently Asked Questions

Related Modules

Force SSL Admin

Always open your dashboard and login screen over a secure https:// link. Anyone using the old http:// address is sent to the...
Security
Disabled

Cloudflare Turnstile

Bot protection with Cloudflare Turnstile on logins, forms, comments, and WooCommerce—low hassle for real people.
Security
Disabled

Disable Password Reset

Turn off public "forgot password" self-service for everyone. Use only when you reset passwords another way (manual admin password, WP-CLI, or admin-sent...
Security
Disabled

Google reCAPTCHA

Google reCAPTCHA on logins, forms, comments, and WooCommerce to block bots and spam signups.
Security
Disabled

Limit Login Attempts

Slow down password-guessing bots by locking out repeated failed logins for increasing cool-off periods—simple protection for your sign-in form.
Security
Disabled

Block Usernames

Blocks risky default usernames during registration so bots have fewer easy targets.
Security
Disabled

Security Headers

Tell modern browsers to enforce sensible safety rules—like blocking sneaky scripts and iframe tricks—with strong defaults you can tighten further for HSTS...
Security
Disabled

Activity Log

Keep a clear record of important dashboard activity—who logged in, what changed, and when—so you can investigate issues or stay audit-ready without...
Security
Disabled

Hide WP Version

Removes WordPress version from public HTML generator tags, feed generator output, and the admin footer. Does not change ver= on script and...
Security
Disabled

Disable XML-RPC

Closes the old XML-RPC channel many password-guessing tools still target. Fine for most sites; skip if you rely on legacy apps or...
Security
Disabled
Founding Member Offer 74 of 100 spots left

Before you go, here's what you'd be leaving.

WP PowerSuite launched this month. The first 100 customers get 50% off and keep that renewal price permanently. When the offer closes on 31 August 2026, prices return to $79 / $239 / $399 and stay there.

  • 154 modules, all included on every plan
  • Renewal price locked for life
  • 14-day refund, one email, no questions
See founding pricing
26 founding members so far 21 days left