Turn off the theme and plugin file editors

Removes the code editors under Appearance and Plugins, so a stolen admin login can’t be used to write PHP into your theme or plugin files.

Type PHP
Runs Everywhere (runs as WordPress loads)
Tested with WordPress 7.1

PHP

<?php

// The same as adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.
if ( ! defined( 'DISALLOW_FILE_EDIT' ) ) {
	define( 'DISALLOW_FILE_EDIT', true );
}

In these packs

Harden WordPress: Close the doors attackers try first: XML-RPC, user name discovery, the file editors, revealing login errors.

Install it in one click

It's already in the Snipfire plugin's library. Enter your site's address and it opens there, ready to install. It arrives switched off, and Snipfire checks the code and test-loads your site before you switch it on.

Needs Snipfire on that site and you logged in as an administrator. Your address stays in this browser; we don't see it. Get Snipfire free

Or add it by hand

Click + New and choose PHP.
Paste the code and give it a name.
Where: Everywhere (runs as WordPress loads).
Save and switch it on.

Works in any snippet plugin, or a child theme's functions.php. Without the safety net, though.

In these packs

More from this pack

Move your snippets over this afternoon.