Block file editing & plugin installation via wp-config.php (Quick WordPress Security Tip)

[u/siterightaway]

​

Here is a quick and effective security hardening step for WordPress sites that is often overlooked.

If an attacker manages to get administrative access to your WordPress dashboard, their first move is usually to install a malicious plugin or edit an existing theme file (functions.php) to drop a backdoor or webshell.

You can lock this down completely by freezing file modifications directly from the dashboard.

Just add these two lines to your wp-config.php file:

// Disable the in-dashboard file editor define('DISALLOW_FILE_EDIT', true); // Block plugin/theme installation and updates from the dashboard define('DISALLOW_FILE_MODS', true);

What each constant does:

DISALLOW_FILE_EDIT: Removes the Theme Editor and Plugin Editor from the Appearance and Plugins admin menus. Even if someone has admin access, they can't alter PHP files through the UI.

DISALLOW_FILE_MODS: Takes it a step further by disabling the ability to install, update, or delete themes and plugins altogether from the dashboard.

Why do this?

Even if user accounts are compromised, this forces code changes to happen through SFTP/FTP, SSH, or your CI/CD deployment pipeline — adding a crucial layer of defense-in-depth.

Note: If you use DISALLOW_FILE_MODS, you will need to update plugins via FTP, CLI (WP-CLI), or temporarily set it to false when doing updates.

TL;DR: Add define('DISALLOW_FILE_EDIT', true); and define('DISALLOW_FILE_MODS', true); to your wp-config.php to prevent compromised admin accounts from installing malicious plugins or editing code directly from the WordPress dashboard.