How to disable the WordPress theme and plugin file editor

Disabling the WordPress theme and plugin file editors removes the browser path for changing live PHP, CSS, and plugin files from the dashboard. The setting is useful on production sites where code changes should happen through SSH, SFTP, version control, or a deployment process instead of an administrator screen.

WordPress reads wp-config.php during each request, so defining DISALLOW_FILE_EDIT there removes the Theme File Editor and Plugin File Editor capabilities for all users. Normal file access outside the dashboard remains unchanged, which keeps server-side maintenance and deployment workflows available.

DISALLOW_FILE_EDIT is narrower than DISALLOW_FILE_MODS. The broader DISALLOW_FILE_MODS constant also blocks plugin and theme installs or updates, plus other admin file-modification workflows, so preserve it when a host or deployment policy already uses that stronger lock. The block-theme Site Editor under Appearance → Editor is a separate design tool and is not the theme file editor.

1. Open a shell in the WordPress document root.
2. Check for an existing editor or file-modification policy.

   $ grep -E "DISALLOW_FILE_EDIT|DISALLOW_FILE_MODS" wp-config.php

   No output means neither constant is defined in this file. If DISALLOW_FILE_MODS is already set to true, keep that broader policy unless the deployment model is being changed intentionally.

3. Back up wp-config.php before editing it.

   $ cp -a wp-config.php wp-config.php.before-file-editor-disable

   Use sudo for the copy and edit commands if the site files are owned by a different deployment user.

4. Open wp-config.php in a plain text editor and add the constant above the final stop editing line.

   define( 'DISALLOW_FILE_EDIT', true );

   Place the line before /* That's all, stop editing! Happy publishing. */ so WordPress loads it with the rest of the site configuration.

5. Confirm the saved constant.

   $ grep "DISALLOW_FILE_EDIT" wp-config.php
   define( 'DISALLOW_FILE_EDIT', true );

   No web server restart is needed. WordPress applies the setting on the next request.

6. Reload the WordPress dashboard and check the editor menu locations.

   On block-theme sites, both Theme File Editor and Plugin File Editor normally appear under Tools. On classic-theme sites, Theme File Editor normally appears under Appearance and Plugin File Editor under Plugins.

7. Open the direct editor URLs while logged in as an administrator.

   https://www.example.com/wp-admin/theme-editor.php
   https://www.example.com/wp-admin/plugin-editor.php

   A configured site should block the editor screens instead of opening a file-editing form. If either editor still loads, search for a later config include or duplicate constant that overrides wp-config.php.