# See who saved a file in the WordPress theme and plugin editor BetterShield records each file editor save in WordPress as High, naming who saved which file and never its contents. Here is how to read the row. By M Asif Rahman, Nov 8, 2026. If someone saves a file in the WordPress theme or plugin editor, **BetterShield** records it as **File edited in the file editor**, rated **High**, with the person who saved and the file they saved, and it never keeps the contents. You do not switch anything on. The row is written from the moment the plugin is active. The safest answer is still to take the editor away, which our guide to [disabling file editing in WordPress](/blog/disable-file-editing-wordpress/) covers step by step. This post is for the other case: the editor is on, or you want to know whether anyone used it, and you want to read the record. ## Quick summary - A save in the dashboard theme or plugin file editor is recorded as **File edited in the file editor**. - The row is filed under **Updates & extensions** and rated **High**. - It names who saved and which file, for example "functions.php in Twenty Twenty-Five". It never records what was in the file. - A save WordPress refused, or rolled back because the edit broke the site, is not recorded, because the file did not change. - There is nothing to set up, and the row cannot undo the edit: restore the file from your own copy. ## Why a file editor save deserves a row The theme and plugin editors let a signed-in administrator write PHP from the browser, and PHP in a theme or plugin runs on every request. That is convenient for a quick fix. It is also one of the first things someone does with an administrator session that is not theirs, because it needs no upload and no FTP access. Most days nobody opens those editors at all, which is what makes a save worth noticing. BetterShield rates it High for that reason, so it reaches the instant alert email while [instant alerts](/docs/instant-security-alerts/) are on. A row you did not expect is a prompt to check who was signed in, not proof that something is wrong. ## What the row records When someone saves a file in the theme editor or the plugin editor and the file really changes, BetterShield writes one row. - **Who saved.** The account that pressed save. - **Which file.** The file inside its plugin or theme, then that plugin’s or theme’s name, so the row reads like “functions.php in Twenty Twenty-Five”. - **How it was saved.** The editor’s normal save and the form that works without JavaScript are both recorded. - **Not the contents.** BetterShield reads the one file being saved, before and after the save, to know that it changed. It does not keep what the file said. A save that WordPress refused, or one it rolled back because the edit broke the site, leaves no row. The file did not change, so there is nothing to record. ## How this row fits with BetterShield’s other records Three records answer three different questions, and it helps to keep them apart. - **File edited in the file editor** answers “who pressed save in the dashboard editor?” It names the person and the file, at the moment of the save, and nothing else. - **[File changes](/docs/file-changes/)** answers “did a file on my site change?” It watches your active theme and does not care how the file was changed: over SFTP, through your host, by a deployment or by the editor. - **The [Activity log](/docs/activity-log/)** is the screen that holds the first record. It sits beside sign-ins, account changes and the other extension events, so you can read a save in the context of what else happened around it. Used together they let you tell an ordinary edit from a surprise. If a High row and a file change line up, and the person is someone you know, you probably have your answer. If a file changed and there is no editor row, the change did not come from the dashboard editor, so look at SFTP and host access instead. ## What an expected row looks like Sites that never use the editor should never show this row. Sites where a developer sometimes makes a quick edit will show it now and then, usually during office hours, usually from a name you recognize, usually for a theme file such as functions.php. That pattern is normal, and a few of them over a month are not a concern. The pattern worth a second look is different: a save at an odd hour, from an account that does not normally touch code, in a plugin file rather than a theme file, or several saves in a row. None of these proves anything on its own, which is why the row is a prompt and not a verdict. Pair it with the account’s recent sign-ins in the same log before you decide. ## Find the row 1. Open **BetterShield › Activity › Site activity**. 2. Look under **Updates & extensions**, where these rows are filed. You can also search for the file’s name. 3. Read the row: the file, the plugin or theme, the person and the time. If the log has many rows, the [filter and search guide](/docs/filter-activity-log/) shows how to narrow it by category, person and date. Our [WordPress activity log](/blog/wordpress-activity-log/) post explains what else the Site activity screen records and how its daily seals work. ## What it can break, and how to undo Recording changes nothing on your site, so there is nothing to break and nothing to switch off. The row stays for as long as the log keeps rows, which is 30 days in the free plugin. The row cannot undo the edit, because it never held the old file. If a saved change did damage, restore the file from your own copy. For a plugin from WordPress.org, [Restore official files](/docs/restore-official-files/) puts the original back. ## Check it is working Use a test site, not a live one. 1. In the dashboard, open **Appearance › Theme File Editor**. 2. Add a harmless comment line to a theme file and save. 3. Open **BetterShield › Activity › Site activity**. A new High row should appear within moments, naming you and the file. Then remove your comment line and save again. That second save is recorded too, which is expected. ## When a row you did not expect appears Treat it as a question with a short list of answers. - **A colleague or developer saved a quick fix.** Ask them, and consider turning the editor off so the next fix goes through your normal process. - **You do not recognize the account, or the time.** Check that account first, and then look at [File changes](/docs/file-changes/), which watches your active theme for files that changed any other way. - **The file is one nobody should be editing.** Restore it from your own copy and review who has administrator access. The row tells you what happened and who did it. It does not tell you why, and it should not be read as an accusation. ## Recommended settings We recommend turning the file editor off, so there are no saves to record. BetterShield’s [File editor lock](/docs/disable-file-editor/) removes both editors from the dashboard without touching wp-config.php, and the WordPress developer handbook describes the [DISALLOW_FILE_EDIT constant](https://developer.wordpress.org/advanced-administration/wordpress/wp-config/#disable-the-plugin-and-theme-file-editor) that does the same job from the config file. Files stay editable over SFTP, through your host or through your deployment process. If you keep the editor on, keep instant alerts on too, and treat any High row nobody expected as a reason to check the account that saved it. ## On multisite Rows are written in the log of the site where the editor was used. ## Frequently asked questions ### Does BetterShield record what I changed in the file? No. It records who saved and which file, and never the contents. The row cannot show you a before and after. ### Do I have to turn this on? No. There is nothing to switch on. The row is recorded from activation, and the option is always on. ### Why is a file editor save rated High? Writing PHP from the dashboard is one of the first things a stolen administrator session does. Rating it High also sends it in the instant alert email while instant alerts are on. ### Is a failed save recorded? No. A save WordPress refused, or one it rolled back because the edit broke the site, is not recorded, because the file did not change. ### Can I undo the edit from the row? No. Restore the file from your own copy, or use Restore official files for a WordPress.org plugin. ### Is this part of the free plugin? Yes. Recording file editor saves is part of the free BetterShield plugin on WordPress.org, and the log keeps rows for 30 days. ## Conclusion A save in the theme and plugin editor is rare enough to be worth a row, and BetterShield writes it without anyone setting it up: who saved, which file, rated High, and never the contents. The best long-term fix is to turn the editor off, and the row is there for the days it is on. BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). The reference page is [See saves in the theme and plugin file editor](/docs/file-editor-saves/).