Why Disable File Editing Immediately After a Hack?
If an attacker reached your WordPress dashboard, the built-in theme and plugin editors can become a fast path to reinfection.
Disabling them removes one of the simplest ways for a compromised admin account or malicious code injection to alter site files from the browser.
This step does not clean an infected site by itself, but it closes a high-risk entry point while you investigate the breach.
It is especially important on sites running WooCommerce, membership plugins, or any setup with multiple administrators.
What the WordPress File Editor Does
WordPress includes a theme file editor and a plugin file editor in the admin area.
These tools let users with sufficient permissions edit PHP, CSS, and other files directly from /wp-admin/ without using FTP, SFTP, or a hosting file manager.
From a security perspective, that convenience is dangerous after a hack.
If an attacker regains access through stolen credentials, an infected browser session, or a hidden admin account, the file editor can be used to add malware, backdoors, spam links, or redirect scripts.
How to Disable WordPress File Editing After a Hack
The standard and recommended method is to define a constant in your wp-config.php file.
This tells WordPress to hide both built-in editors in the dashboard.
Add the DISALLOW_FILE_EDIT constant
Open wp-config.php, which is located in the root of your WordPress installation, and add the following line above the comment that says /* That's all, stop editing!
Happy publishing. */:
define('DISALLOW_FILE_EDIT', true);Once saved, the Appearance > Theme File Editor and Plugins > Plugin File Editor menus should disappear from wp-admin.
Use DISALLOW_FILE_MODS for stronger lockdown
In some incident-response scenarios, you may want to prevent all file changes from the dashboard, including updates and installations.
For that, you can use:
define('DISALLOW_FILE_MODS', true);This is more aggressive than disabling only the editors.
It blocks plugin and theme installation, updates, and core updates from the admin interface.
Use it carefully if you rely on dashboard-based maintenance.
Where to Place the Code Safely
The correct place is the main wp-config.php file in your WordPress root directory, not a theme functions.php file and not a plugin file.
Putting it elsewhere can make it unreliable or ineffective.
- Use SFTP, SSH, or your host’s file manager to edit
wp-config.php. - Create a backup copy before making any changes.
- Check file permissions so unauthorized users cannot rewrite the config file.
- Confirm the line is placed before the “stop editing” comment.
What to Check After Disabling the Editor
Disabling the editor is only one part of post-hack cleanup.
If the site was compromised, the attacker may already have modified files, added rogue admin users, or planted malicious scheduled tasks.
Review administrator accounts
Check Users > All Users for unfamiliar accounts, especially accounts with Administrator roles.
Remove unauthorized users and reset passwords for legitimate accounts.
Scan core, themes, and plugins
Compare WordPress core files against a fresh official release.
Reinstall trusted themes and plugins from known sources, and inspect files for suspicious patterns such as obfuscated PHP, unexpected base64 strings, or recent timestamp changes.
Inspect .htaccess and wp-config.php
Attackers often inject redirects or remote-load instructions into .htaccess and wp-config.php.
Review both files carefully, along with any unfamiliar PHP files in wp-content.
Check scheduled tasks and must-use plugins
Look for malicious cron jobs in WordPress and any files inside wp-content/mu-plugins.
These locations are commonly used to preserve persistence after cleanup.
Should You Also Disable Plugin and Theme Installation?
In many post-incident cases, yes.
If you are not actively updating or troubleshooting the site, limiting dashboard file changes reduces the chance of reinfection.
This is particularly useful when you are still validating how the attacker got in.
For production sites, a common security workflow is to keep file editing disabled permanently while allowing updates through controlled deployment methods such as SFTP, Git, or managed hosting tools.
Additional Hardening Steps That Help After a Hack
Disabling file editing is effective, but it works best alongside broader hardening measures.
These controls reduce the likelihood that an attacker can regain access even if one layer fails.
- Reset all passwords, including WordPress admin, hosting, database, and FTP/SFTP credentials.
- Enable two-factor authentication for administrator accounts.
- Replace all WordPress salts and security keys in
wp-config.php. - Update WordPress core, themes, and plugins from trusted sources.
- Remove unused plugins and themes to reduce attack surface.
- Install a reputable security plugin or endpoint scanner.
- Review server-side logs for suspicious login attempts and file changes.
How to Verify the File Editor Is Disabled
After editing wp-config.php, log back into the dashboard and inspect the Appearance and Plugins menus.
The file editor links should be gone.
If they still appear, verify that the constant was added in the correct file, that there are no syntax errors, and that object caching or a security plugin is not masking the result.
Also confirm you edited the active installation if you manage multiple WordPress environments.
Common Mistakes to Avoid
People often assume that disabling the editor means the site is clean.
It does not.
If malware is already present, you still need to identify and remove it.
- Do not place the constant inside a plugin or theme file.
- Do not edit the wrong
wp-config.phpon a staging site. - Do not skip password resets after a breach.
- Do not leave backdoored plugins or nulled themes installed.
- Do not rely on the dashboard alone for file changes during recovery.
When to Involve Your Host or a Security Specialist
If the hack included defacements, repeated reinfections, unexpected redirect behavior, or evidence of server-level compromise, contact your hosting provider or a WordPress security professional.
They can help check account isolation, malware persistence, log retention, and file integrity at the server level.
For ecommerce or high-traffic sites, faster containment matters because a breach can affect customer trust, search visibility, and payment security.
In those cases, disabling the WordPress editor is a fast protective step while deeper remediation is underway.
Why This Step Belongs in Every Post-Hack Checklist
Knowing how to disable WordPress file editing after a hack is useful because it removes a major convenience feature that attackers can abuse.
In a compromised environment, convenience becomes risk, and reducing that risk buys time for thorough cleanup and restoration.
Used with password resets, file integrity checks, account review, and malware scanning, this small change helps harden WordPress against repeat compromise.