How To Turn Off the Dashboard File Editor With BetterShield?

6 min read

Remove the plugin and theme code editors from the dashboard without editing wp-config.php, see how it fits with DISALLOW_FILE_EDIT, and bring them back.

With BetterShield, remove the plugin and theme code editors from the dashboard without editing wp-config.php, see how it fits with DISALLOW_FILE_EDIT, and bring them back.

What it does

In BetterShield, File editor lock removes the built-in plugin and theme code editors from the WordPress dashboard, so plugin and theme files can no longer be edited from inside it. It is under Code and settings changes on BetterShield › Protection › Hardening, and Quick Setup offers it as File editor lock. For the reasons to do it and the wp-config.php alternative, read Disable file editing in WordPress; this page is the reference for the switch.

Takes the editors away from every role, administrators included. It refuses the three WordPress permissions behind the plugin and theme file editors, so their menu entries leave the dashboard and their pages refuse to open.
Leaves everything else about plugins and themes alone. Installing, updating, activating and deleting carry on as before.
Writes no file. It never touches wp-config.php, and it works the same on every web server.
Files stay editable elsewhere: over SFTP, through your host’s file manager, or by your deployment process.

It runs inside WordPress, so safe mode pauses it while safe mode lasts, and it stops if BetterShield is deactivated.

If wp-config.php already sets DISALLOW_FILE_EDIT

The editors are already off, the finding never appears, and the row says: “wp-config.php already disables the file editor, so applying this changes nothing today. It stays useful if that line is ever removed.” You can apply it anyway as a second layer.

Step 1: Open BetterShield › Protection › Hardening

Open BetterShield › Protection › Hardening and find File editor lock under Code and settings changes.

Turn off the dashboard file editor: saved state and available controls in BetterShield. — Review the state and choices shown on your own site before applying a change.

Step 2: Turn off the dashboard file editor

Press Preview the change to read what applying would do. Nothing changes.
Turn the switch on. The editors leave the dashboard at once, and the row shows On since and Undo never expires.

The fix has no options. Monitor first cannot watch this fix in advance; its panel points you to the preview, staging checks and the existing undo instead.

Other ways to apply it:

File editor lock in Quick Setup, one of the five fixes it offers.
Apply Fix on The dashboard file editor is enabled, on BetterShield › Findings or under Worth doing first on the Overview.
wp bettershield harden file_editor --user=<login> from the terminal; --dry-run previews it. See WP-CLI commands.
A connected AI assistant that is allowed to make changes can apply it directly. See Connect an AI assistant.

Recommended settings

We recommend turning it on for every site. Anyone who changes theme or plugin code can do it over SFTP or through the host, where a change is a deliberate step rather than a save button in the browser.

Site	What we recommend
Agency or many sites	Keep it ticked in each site’s Quick Setup, or apply it with `wp bettershield harden file_editor --user=<login>` from a script. If you already manage wp-config.php across your sites, `DISALLOW_FILE_EDIT` does the same job; the switch on top costs nothing.

What it can break, and how to undo

In the plugin’s words: “Could break: nothing. Files stay editable over SFTP and through your host.”
The editors are gone for everyone. Administrators lose them too. Tell anyone who used them where code changes happen now.

To undo, turn the switch off. The editors come back at once. Turning it off needs a signed-in browser session (an application password is refused), and your password if Ask for my password before removing a protection is on under Settings › General. From the terminal, wp bettershield harden file_editor --undo --user=<login> does the same. An AI assistant can only take it off through a plan you agree to.

What undo cannot reach: a DISALLOW_FILE_EDIT line in wp-config.php. BetterShield never writes that file, so if the line is there, the editors stay off until you remove it or set it to false.

The editors also come back for as long as safe mode lasts, and while BetterShield is deactivated. They go again when safe mode ends or the plugin is active again.

Final Outcome

The dashboard. The theme and plugin file editor entries are gone from the menus, for every account.

Findings. The dashboard file editor is enabled (Medium) moves to Fixed. If an audit runs during safe mode, it shows as open again with “This is set to applied and nothing is enforcing it right now. Safe mode pauses every protection while it is on.”
The row. On since and Undo never expires, with “This one has no effect a page view can check, so it is reported from your settings.”
The activity log. “Hardening applied” and “Hardening undone”.
If the editor is on. A save in it is recorded as File edited in the file editor, rated High. See See saves in the theme and plugin file editor.

Good to know

If Patchstack is already turning the editor off, a note beside the switch says so and suggests leaving the job to one of them.
Theme files changed any other way, over SFTP for example, still show up in the file check, which watches your active theme.

On multisite

Each site has its own switch. On a network the code editors already belong to the network’s administrators, so the row says: “On a network the dashboard code editors already belong to the network’s own administrators, so applying this changes nothing for a site administrator here. It stays in force if the network ever hands those capabilities down.” On the main site the row says instead: “On this network, applying this here also removes the theme and plugin file editors from Network Admin, for every network administrator. On any other site it changes nothing a site administrator can see.” See Multisite networks.

This is how you can turn off the dashboard file editor with BetterShield.

Getting Stuck? Feel free to contact our Dedicated Support Team.