Disable file editor
Removes the built-in theme and plugin file editors from wp-admin, so admin access alone is not enough to run code on your server.
What it does
Takes the code editor out of the dashboard
Disable file editor is a Vectro security feature that sets the DISALLOW_FILE_EDIT constant to remove the theme and plugin file editors from wp-admin, so a stolen admin account cannot be used to write PHP directly into your site.
WordPress ships with two editors that let an administrator rewrite live PHP files from the browser: Appearance > Theme File Editor and Plugins > Plugin File Editor. Both are enabled by default.
This feature sets the DISALLOW_FILE_EDIT constant, which removes both menu items and blocks the underlying editor screens. Nothing about your theme or plugins changes – only the ability to edit them from wp-admin.
You can still edit files the way most people already do: over SFTP, through your host control panel, or in version control. This closes a browser-based path, not every path.
Why it matters
It turns one stolen password into a much smaller problem
If an attacker obtains an administrator account, the file editor is the shortest route from that account to running arbitrary PHP on your server. They open the theme editor, append code to a template, and now they have a backdoor that survives a password reset.
With the editor disabled, a compromised admin account is still serious – but the attacker needs a separate file-write route to install persistent code. On a well-configured host, that is a meaningfully harder step. This is one of the cheapest hardening measures available, and it costs almost nothing in day-to-day use.
How to use it
One toggle, no configuration
Technical detail
What the constant does
Vectro defines DISALLOW_FILE_EDIT as true early in the WordPress load. WordPress checks this constant when building the admin menu and when handling requests to theme-editor.php and plugin-editor.php, so both the menu entries and direct access to those screens are blocked.
Because this is applied at runtime rather than by rewriting wp-config.php, deactivating Vectro removes the restriction cleanly and leaves no edits in your configuration file.
DISALLOW_FILE_EDIT set to truetheme-editor.php and plugin-editor.phpCompatibility
Vectro detects these and steps aside
You can override any automatic deferral from the Compatibility panel in Vectro’s dashboard if you would rather Vectro handle it.
Questions
Frequently asked
What does disabling the WordPress file editor do?
Disabling the file editor removes Appearance > Theme File Editor and Plugins > Plugin File Editor from wp-admin by setting the DISALLOW_FILE_EDIT constant. An attacker who obtains an admin account can no longer write PHP straight into a live theme file.
Does the Vectro file editor block work with other security plugins?
If All In One Security is active, Vectro detects it and leaves the file editor setting to All In One Security. If your wp-config.php already defines DISALLOW_FILE_EDIT, Vectro leaves that value exactly as it is.
How do I disable the theme and plugin editor in Vectro?
Go to Vectro > Security in wp-admin and toggle Disable File Editor on. Check the Appearance and Plugins menus afterwards to confirm the File Editor entries have gone.
Is disabling the file editor in Vectro free or Pro?
Yes, Disabling the file editor is free. It is included in the free Vectro plugin on WordPress.org with no account required.
Can I still edit theme files with the WordPress file editor disabled?
Yes – you can still edit files over SFTP, through your host file manager, with WP-CLI or through version control. Only the browser-based editing route inside wp-admin is closed.
Related features
Reduce what an attacker can learn or reach
Vectro Pro adds file change monitoring that alerts you when any site file is modified. See Pro plans
Download Vectro free on WordPress.org
27 features across Security, Performance and Maintenance. No account required, no expiry, unlimited sites.