# Elementor security: add-ons, code editors and file changes

Elementor security for page-builder sites: compare directory add-ons with official copies, watch premium add-ons and the theme, and switch the code editors off.

By M Asif Rahman, Nov 4, 2026. Updated Nov 8, 2026.

Elementor security on a page-builder site comes down to code you did not write: the builder, a few add-on packs, a forms plugin and a theme, each from a different author and each updating on its own schedule. **BetterShield** compares the add-ons you installed from WordPress.org with their official copies, watches premium add-ons and your theme for changes, records every install and update, and can switch off the code editors in the dashboard. This guide covers what each of those does, what to set, and how to check it worked.

The same file check and editor lock are described in two earlier guides. [WordPress file integrity check: what it compares and what it cannot](/blog/wordpress-file-integrity-check/) explains the comparison in depth, and [Disable file editing in WordPress](/blog/disable-file-editing-wordpress/) explains the editor switch. This post puts them together for a site built with a page builder. It makes no claim about how any builder or add-on behaves.

## Quick summary

- A builder site runs code from many authors, and nobody keeps a list of what changed or when. BetterShield’s activity log records it for you.
- Add-ons from the WordPress.org directory are compared with the copies WordPress.org publishes. **Show the difference** reads the changed lines, and **Put the official file back** keeps your copy in quarantine.
- Premium add-ons and themes have no published copy. They are recorded at the first check and watched for later changes, and the report says which is which.
- **File editor lock** removes the plugin and theme code editors from the dashboard, for every role. It has an undo that never expires.
- BetterShield has no firewall or malware scanner, and it passes no judgement on any builder or add-on.

## Why a builder site has more code to keep track of

A site made of one theme and a handful of plugins is easy to hold in your head. A builder site is not. The builder, its add-on packs, a forms plugin and the theme each arrive from a different author, and each one updates when its author says so. Sometimes all of them update on the same afternoon.

Two things make that harder to watch. WordPress.org publishes checksums for the plugins in its directory, but not for add-ons bought elsewhere or for themes, so a changed file there looks like every other file unless something recorded what it was before. And WordPress gives administrators plugin and theme code editors in the dashboard, where a quick change goes straight into the code the site runs, whether or not anyone else knows. WordPress’s own documentation describes the [file-editing setting in wp-config.php](https://developer.wordpress.org/advanced-administration/wordpress/wp-config/) that turns those editors off.

The answer is not to distrust every add-on. It is to know which of your add-ons can be checked against an official copy, which can only be watched, and what changed since the last time you looked.

## Check directory add-ons against the official copies

WordPress core and plugins from the WordPress.org directory are compared with the copies WordPress.org publishes, every hour and whenever a plugin is installed or updated. You can also run it yourself.

1. Open **BetterShield › Activity › File Changes**.
2. Press **Check now** and let the check finish. It works in passes, so a large site may take a few minutes.
3. Read each difference. It names the file, the kind of change and the actions available.
4. For a file in a directory plugin that no longer matches its official copy, press **Show the difference** to read the changed lines.
5. If you did not make the change and do not recognize it, press **Put the official file back**. Your current copy goes into quarantine, so the decision can be reversed.

The detail is in [Check files against their published copies](/docs/file-integrity-checks/) and [File changes](/docs/file-changes/). Restore one file at a time and open the affected screen straight afterwards. Replacing a file you changed on purpose removes that change, so save a copy first.

## Watch premium add-ons and the theme

Add-ons you bought outside the directory, and your theme, are a different case. There is no published copy to compare them with, so BetterShield records their code files at the first check and reports later changes, except an update WordPress itself installed. The report names premium plugins in its note, and a changed file is listed apart from the directory ones, so you can see at once that there was nothing official to compare it with.

That has one consequence worth planning for. BetterShield cannot put an official file back for a premium add-on or a theme, because it has no official file to give you. Keep your own backups and your deployment copies, and restore from those.

When you changed a theme file on purpose, there is a way to say so. Check the path and when the change was noticed, then press **Expected**. The file stops being reported as it is now, and a further change is reported again. It records your decision and does not prove the code is safe, so match the change to a deployment or a person first. [Mark file changes as expected](/docs/expected-file-changes/) has the steps, including a way to accept one paid-plugin version at a time.

| What you installed | How BetterShield treats it | If a file changes |
|---|---|---|
| Add-on from the WordPress.org directory | Compared with the published copy for its version | **Show the difference**, then **Put the official file back** if it is not yours |
| Premium add-on | Recorded at the first check, then watched | Review the path, restore from your own backup or press **Expected** |
| Theme and its parent | Recorded at the first check, then watched | The same as a premium add-on |

## Keep a record of every install and update

After an update round, the question is usually "what actually changed?". The activity log answers it. On **BetterShield › Activity › Site activity**, choose **Updates & extensions** to see each plugin and theme install, update, activation, deactivation and deletion, with who did it and when. When a plugin from outside the directory updates, the entry also notes which code files the update added or changed.

Then open **File Changes** and press **Check again**, which closes the changes that match the installed version’s published copy. The log keeps 30 days of history, and you can filter it, search it and export it to CSV. [WordPress activity log: what it records and what to look for](/blog/wordpress-activity-log/) covers what else it records.

This is also the answer to "who can publish or change code on this site". The log shows which account installed or updated what. If several people manage the site, it is the record they can all read.

## Decide about an add-on nobody updates

An add-on installed for one page years ago is often still active, and nobody remembers why. For plugins listed in the WordPress.org directory, Findings names two cases: **An installed plugin is no longer in the WordPress.org directory** and **An installed plugin has had no WordPress.org update for years**. BetterShield reads nothing into either. It gives you the last-updated date the directory shows and leaves the decision to you.

Press **Explain** on the finding for why it matters and what to know first, then check the plugin’s page and its author’s own site. Keeping, replacing or removing it is yours to decide. If you have a reason to wait, **Snooze** hides the finding for 7 or 30 days. It asks WordPress.org about a few plugins each day, so on a site with many it takes some days to cover them all. [Score and findings](/docs/score-and-findings/) explains how findings and their severities work.

## Switch the dashboard code editors off

WordPress puts a plugin editor and a theme editor in the dashboard. On a site where several people hold administrator accounts, a change made there leaves no copy and no review. **File editor lock** removes both editors for every role, administrators included. It writes no file and never touches wp-config.php. Files stay editable over SFTP and through your host, so the way you deploy changes today is the way you deploy them tomorrow.

1. Open **BetterShield › Protection › Hardening**.
2. Find **File editor lock** under **Code and settings changes**.
3. Press **Preview the change** to read what applying would do. Nothing changes yet.
4. Turn the switch on. The editors leave the dashboard at once, and the row shows **On since** and **Undo never expires**.

You can also tick **File editor lock** in Quick Setup, or press **Apply Fix** on the finding **The dashboard file editor is enabled**. If your wp-config.php already switches the editors off, the row says so, and applying it changes nothing today. The reference is [Turn off the dashboard file editor](/docs/disable-file-editor/), and [Hardening](/docs/hardening/) covers the other fixes on that screen.

## See what your pages load, before blocking anything

A page built from many add-ons can load fonts, scripts, maps and videos from addresses nobody has listed. If you are thinking about a content policy, or you only want the list, turn on **Script-blocking policy** under **What browsers are told** on **Protection › Hardening**. It sends the policy in report-only mode on front-end pages, so nothing a visitor loads changes. After a week of normal traffic, read **What it would have blocked**, which names each rule and the origin it would have stopped. The guide to [security headers in WordPress](/blog/wordpress-security-headers/) explains the policy in full.

## Hand a site over with the editors off

An agency often delivers a builder site to a client who gets an administrator account, and the theme and add-ons should stay as delivered. Before handing over, turn on **File editor lock** as above. Then open **Settings › Email alerts** and, under **Where alerts go**, add your own address beside the client’s, so an alert about an altered file reaches you as well. The [email alerts doc](/docs/email-alerts/) lists what is sent.

## What it can break, and how to undo

- **A file you changed on purpose.** **Put the official file back** replaces it. The current copy is in quarantine, and the quarantine action puts it back.
- **A premium file reported as changed.** Nothing was replaced. Decide whether the change was yours, then restore from your own backup or press **Expected**.
- **The editors are gone for everyone.** Administrators lose them too. Tell anyone who used them where code changes happen now.
- **A restore that cannot reach WordPress.org.** It needs an outbound connection from the site. Retry once connectivity returns.

To undo the editor lock, turn the switch off and the editors return at once. It needs a signed-in browser session, and your password if **Ask for my password before removing a protection** is on under **Settings › General**. One thing undo cannot reach is a `DISALLOW_FILE_EDIT` line in wp-config.php, which BetterShield never writes. If it is there, the editors stay off until you remove it.

## Check it is working

- **The dashboard.** The plugin and theme editor entries are gone from the menus for every account.
- **File Changes.** The **Last check** time updated, and each difference names its file and the actions available.
- **Findings.** **The dashboard file editor is enabled** moves to Fixed.
- **The log.** Under **Updates & extensions**, your last update round is listed with who ran it.
- **The activity log.** Turning the lock on and off is recorded as “Hardening applied” and “Hardening undone”.

## Recommended settings

We recommend turning on **File editor lock** on every builder site, running a file check after each round of updates, and treating a changed premium file as a question to answer rather than a conclusion.

| Site | What we recommend |
|---|---|
| Your own builder site | **File editor lock** on. A file check after each update round. **Expected** only after you can name the change. |
| Client site you hand over | **File editor lock** on, your address added under **Where alerts go**, your own backup of the theme and premium add-ons. |
| A site with many add-ons | Read the two plugin findings, decide about each, and **Snooze** only with a reason. |

## Frequently asked questions

### Can BetterShield check premium plugins and add-ons?

It watches them, but it cannot compare them with an official copy, because WordPress.org publishes no checksums for premium or custom plugins or for themes. Their code files are recorded at the first check and later changes are reported. A changed file is listed apart from the directory ones, so restore it from your own backup.

### Will a normal plugin update show up as a file change?

Not normally. A directory plugin is compared with the checksums for the version installed, and an update WordPress itself installed is not reported for watched code. If changes remain from the version you had before, **Check again** closes the ones that match.

### Does BetterShield flag add-ons nobody maintains anymore?

For plugins listed in the WordPress.org directory, yes. Findings names any the directory has closed and any with no update there for two years, with the last-updated date, and reads nothing into either.

### Does BetterShield scan add-ons for malware or known vulnerabilities?

The free plugin does not include a firewall or malware scanner. Vulnerability checks are optional: with consent in Settings, BetterShield asks BetterShield Hub for published advisories and matches versions on your site. A failed refresh is shown as unavailable or stale, never as a clean result.

### What does turning off the dashboard file editor change?

It removes the built-in plugin and theme code editors from the dashboard. Files stay editable over SFTP and through your host. **Preview the change** shows what applying would do, and turning the switch off undoes it.

## Conclusion

A page-builder site is a lot of code from a lot of authors, and the useful questions are simple: which files can be compared with an official copy, which can only be watched, and what changed since the last update round. Run the file check, keep your own backups of what has no official copy, and switch the dashboard code editors off.

BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). The docs cover each part: [Check files against their published copies](/docs/file-integrity-checks/), [Turn off the dashboard file editor](/docs/disable-file-editor/) and [Hardening](/docs/hardening/). The [page-builder sites use case](/use-cases/page-builder-sites/) shows the whole picture.