Turn off the theme/plugin file editor

You turn off the theme and plugin file editor by adding one line to wp-config.php. Define DISALLOW_FILE_EDIT as true, and those editors disappear from wp-admin. A stolen admin session then cannot paste PHP through the browser. You still change files with SFTP, cPanel File Manager, staging deploys, or WP Toolkit.

What DISALLOW_FILE_EDIT does

Open wp-config.php and place this constant above the line that says you should stop editing:

define(‘DISALLOW_FILE_EDIT’, true);

After you save the file, Theme File Editor and Plugin File Editor leave the Appearance and Plugins menus. Dashboard and WP Toolkit updates still work as usual. You only remove the in-browser PHP editor, which is the point of the change.

A stricter option is DISALLOW_FILE_MODS. That constant also blocks installs and updates from wp-admin. On most LogicWeb WordPress accounts that use WP Toolkit, start with DISALLOW_FILE_EDIT alone so one-click updates keep working.

How you still change theme and plugin code

cPanel File Manager and SFTP write the same files on disk. WP Toolkit can update themes and plugins when you need that path. Teams that already use Git can keep deploying the same way. The constant does not freeze your theme. It only removes the browser UI that turns a stolen cookie into a webshell.

Pair the setting with unique admin users and two-factor authentication. You have closed one risky door, and solid login habits still matter for the rest.

Why the editor is a poor fit on production

The built-in editor writes PHP as whoever is logged in as an admin. That makes a compromised account a direct path to malicious code without SFTP. Quick edits also break live sites when there is no spare copy of the file.

Small CSS tweaks belong in Additional CSS in the Customizer or in a child theme you deploy cleanly. You do not need the file editor for that work. If a freelancer is used to editing in wp-admin, give them SFTP and a staging site instead, and leave DISALLOW_FILE_EDIT enabled on production.