How to Disallow File Modifications in WordPress

What Is the Disallow File Modifications feature?

By default, WordPress admin users can edit theme and plugin files via the dashboard:

• Theme Editor: Appearance > Theme File Editor
• Plugin Editor: Plugins > Plugin File Editor

This is a convenience feature for developers but creates a security risk. A compromised admin account can use the file editor to inject malicious code.

The Disallow File Modifications feature disables these editors. The site can still be updated via WP-CLI, FTP, SSH, or Git.

Why You Need It

The file editors are a high-value attack surface:

• No version control: Direct file edits are not tracked
• No code review: Changes can be made without oversight
• No backup integration: Edits bypass most backup systems
• Common malware vector: Compromised admin accounts use the file editor to inject backdoors

For production sites, the file editors should always be disabled.

How to Disallow File Modifications in WordPress

Step 1: Navigate to Settings

Click into the Classic Monks plugin settings in your WordPress dashboard.

Step 2: Go to the Security Tab

Click on the Security menu, then click the WP Protection subtab.

Step 3: Enable Disallow All File Modifications

Scroll to Disable all changes to all files via admin area and toggle on. This is the master toggle that disables all file modifications via the admin (including the plugin/theme editor AND plugin/theme updates from the admin).

Step 4: (Optional) Enable Disallow Plugin/Theme Editor

If you want to allow plugin/theme updates but still disable the editor, toggle on Disable file changes via plugin and theme editors (separate toggle). The admin can update plugins/themes from the Plugins page, but the editor is disabled.

Step 5: Save Changes

Click Save Changes.

Step 6: Test

Log in as an admin. Go to Appearance > Theme File Editor. The menu item should be missing (or show a “you don’t have permission” message). The same for Plugins > Plugin File Editor.

Configuration Options

The first toggle is the most restrictive. The second toggle is less restrictive (allows updates but not direct file editing).

What Gets Affected

• The Theme Editor: disabled
• The Plugin Editor: disabled
• The plugin/theme update flow: disabled (only with the first toggle)
• The admin’s ability to edit code via the dashboard: removed

What Does NOT Get Affected

• FTP/SSH access: not affected (admins can still edit files directly)
• The wp-cli: not affected (can be used to update plugins/themes)
• The plugin/theme update via the WP-CLI: not affected
• The custom code via Code Manager: not affected (this is a separate feature)