Locking down the WordPress file editor and a few wp-config settings worth changing

The short answer: WordPress has, in the dashboard, a file editor that lets you change the code of the theme and plugins. One typo there takes the site down, and whoever gets into the dashboard without permission can plant malicious code. One line in wp-config.php switches it off. There are two or three more settings in the same file that harden the site.

The settings

Line What it does
define( 'DISALLOW_FILE_EDIT', true ); Hides the theme and plugin editors in the dashboard. Touches nothing else. The most useful.
define( 'FORCE_SSL_ADMIN', true ); Forces the dashboard and login onto https. Only if the site already has a certificate.
define( 'WP_POST_REVISIONS', 10 ); Keeps only the latest versions of each post, instead of all: it helps keep the database lean.
define( 'DISALLOW_FILE_MODS', true ); Careful: it also blocks installing and updating plugins, themes and WordPress itself. Only for sites managed another way.
Security keys (salts) Changing them logs everybody out of the dashboard. Useful after a suspected break-in.

Step by step

1 Take a copy of wp-config.php. A typing mistake in this file takes the site down.
2 Open wp-config.php (cPanel File Manager) and put the chosen line before the phrase “That’s all, stop editing”.
3 Save and open the dashboard: under Appearance and Plugins the file editors should be gone.
4 Check the permissions of wp-config.php: it holds the database password and should not be readable by everyone: File permissions.
5 Make code changes another way (in a child theme, or over SFTP), not from the dashboard: Child theme.
This reinforces; it does not protect on its own. A switched-off editor does not stop someone who already has an administrator password from installing a malicious plugin. The real defence is a well-protected login and up-to-date plugins: Protecting the WordPress login.
If the file was damaged, see Rebuilding the wp-config.php connection. Another door to consider: XML-RPC.

Want help reviewing your WordPress security? Open a ticket with the address.

Open a support ticket

SEE ALSO

Protecting the WordPress login: three steps in order of effect

File permissions explained: what 755, 644 and 777 mean

A child theme or editing the theme directly: why updates wipe your changes

An abandoned plugin or an old PHP version: how to spot the risks on your site

Rebuilding the wp-config.php connection

RECOMMENDED PRODUCT

WordPress hosting

One-click install, updates handled, and speed that holds up. from 5.940,00 Kz/mo (3-year plan, with coupon)

See plans
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

How to install WordPress in a few clicks You don't have to download WordPress, create a database and upload files by hand. The installer in cPanel does all of it...
Common WordPress errors: white screen, critical error and how to find the cause The site stopped opening and shows a blank white screen, or the line «There has been a critical error on this website»....
Cannot get into the WordPress dashboard: the six usual causes The site opens, but the admin dashboard does not. Either it asks for the password in an endless loop, or it says the det...
How to remove WordPress from a domain, without leaving anything behind You want WordPress off a domain, because the installation broke, because you are starting over, or because the site is b...
Protecting the WordPress login: three steps in order of effect WordPress’s login address is the same on every site in the world: /wp-admin and /wp-login.php. That means any automated...
Changing the language of WordPress: the site, the dashboard and each user The short answer: WordPress has two languages chosen separately: the site’s (under Settings > General) and each user’s d...