Adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php turns off the theme and plugin code editor in the WordPress admin. It is a cheap hardening step, but the hardening guide is clear that it does not stop attackers from uploading malicious files.
What the constant does
The WordPress hardening guide says the constant is equivalent to removing the edit_themes, edit_plugins and edit_files capabilities from all users. The built-in editor under Appearance and Plugins stops working for everyone, including administrators.
define( 'DISALLOW_FILE_EDIT', true );
Why it matters
Suppose an attacker guesses or phishes an administrator password. Without this setting, the editor lets them paste PHP straight into a theme file and run it. With the setting on, that shortcut is gone, and they need another route.
What it does not do
The guide states plainly that it does not stop attackers from uploading malicious files. An admin can still install a plugin or upload a theme zip unless other controls block it. So treat this as one layer that raises the effort, not a lock.
Pair it with these
- Strong passwords and two-step authentication. The guide recommends both.
- Least privilege users. Few accounts should be administrators.
- Update discipline. The guide says to keep plugins updated and delete unused ones.
- Tight file permissions. See WordPress file permissions.
- Backups. Regular, including the database.
Obscurity measures
The guide mentions renaming the admin account and changing table_prefix from wp_, but labels them obscurity measures rather than primary defenses. They are fine as extras and bad as a plan.
Quick check
Will DISALLOW_FILE_EDIT break plugin updates?
No, it affects the code editor. Installing and updating plugins is controlled by other settings and file permissions.
Is it enough to stop a stolen admin login?
No. An admin can still upload files unless you add other controls such as two-step authentication and limited admin accounts.
Sources
Last reviewed: 19 October 2026.
