# How To Turn Off the Dashboard File Editor With BetterShield?

Remove the plugin and theme code editors from the dashboard without editing wp-config.php, see how it fits with DISALLOW_FILE_EDIT, and bring them back.

With **[BetterShield](/)**, remove the plugin and theme code editors from the dashboard without editing wp-config.php, see how it fits with DISALLOW_FILE_EDIT, and bring them back.

## What it does

In **[BetterShield](/)**, **File editor lock** removes the built-in plugin and theme code editors from the WordPress dashboard, so plugin and theme files can no longer be edited from inside it. It is under **Code and settings changes** on **BetterShield › Protection › Hardening**, and Quick Setup offers it as **File editor lock**. For the reasons to do it and the wp-config.php alternative, read [Disable file editing in WordPress](/blog/disable-file-editing-wordpress/); this page is the reference for the switch.

- **Takes the editors away from every role, administrators included.** It refuses the three WordPress permissions behind the plugin and theme file editors, so their menu entries leave the dashboard and their pages refuse to open.
- **Leaves everything else about plugins and themes alone.** Installing, updating, activating and deleting carry on as before.
- **Writes no file.** It never touches wp-config.php, and it works the same on every web server.
- **Files stay editable elsewhere**: over SFTP, through your host's file manager, or by your deployment process.

It runs inside WordPress, so safe mode pauses it while safe mode lasts, and it stops if BetterShield is deactivated.

### If wp-config.php already sets DISALLOW_FILE_EDIT

The editors are already off, the finding never appears, and the row says: "wp-config.php already disables the file editor, so applying this changes nothing today. It stays useful if that line is ever removed." You can apply it anyway as a second layer.

<span id="set-it-up" aria-hidden="true"></span>

## Step 1: Open BetterShield › Protection › Hardening

Open **BetterShield › Protection › Hardening** and find **File editor lock** under **Code and settings changes**.

<figure class="doc-shot">
  <img src="/docs/screenshots/disable-file-editor.png" alt="Turn off the dashboard file editor: saved state and available controls in BetterShield." width="980" height="115" loading="lazy" decoding="async">
  <figcaption>Review the state and choices shown on your own site before applying a change.</figcaption>
</figure>

## Step 2: Turn off the dashboard file editor

- Press **Preview the change** to read what applying would do. Nothing changes.
- Turn the switch on. The editors leave the dashboard at once, and the row shows **On since** and **Undo never expires**.

The fix has no options. **Monitor first** cannot watch this fix in advance; its panel points you to the preview, staging checks and the existing undo instead.

Other ways to apply it:

- **File editor lock** in Quick Setup, one of the five fixes it offers.
- **Apply Fix** on **The dashboard file editor is enabled**, on **BetterShield › Findings** or under **Worth doing first** on the Overview.
- `wp bettershield harden file_editor --user=<login>` from the terminal; `--dry-run` previews it. See [WP-CLI commands](/docs/wp-cli-commands/).
- A connected AI assistant that is allowed to make changes can apply it directly. See [Connect an AI assistant](/docs/connect-an-ai-assistant/).

## Recommended settings

We recommend turning it on for every site. Anyone who changes theme or plugin code can do it over SFTP or through the host, where a change is a deliberate step rather than a save button in the browser.

| Site | What we recommend |
|---|---|
| Agency or many sites | Keep it ticked in each site's Quick Setup, or apply it with `wp bettershield harden file_editor --user=<login>` from a script. If you already manage wp-config.php across your sites, `DISALLOW_FILE_EDIT` does the same job; the switch on top costs nothing. |

## What it can break, and how to undo

- **In the plugin's words:** "Could break: nothing. Files stay editable over SFTP and through your host."
- **The editors are gone for everyone.** Administrators lose them too. Tell anyone who used them where code changes happen now.

To undo, turn the switch off. The editors come back at once. Turning it off needs a signed-in browser session (an application password is refused), and your password if **Ask for my password before removing a protection** is on under **Settings › General**. From the terminal, `wp bettershield harden file_editor --undo --user=<login>` does the same. An AI assistant can only take it off through a plan you agree to.

What undo cannot reach: a `DISALLOW_FILE_EDIT` line in wp-config.php. BetterShield never writes that file, so if the line is there, the editors stay off until you remove it or set it to `false`.

The editors also come back for as long as safe mode lasts, and while BetterShield is deactivated. They go again when safe mode ends or the plugin is active again.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

**The dashboard.** The theme and plugin file editor entries are gone from the menus, for every account.

- **Findings.** **The dashboard file editor is enabled** (Medium) moves to **Fixed**. If an audit runs during safe mode, it shows as open again with "This is set to applied and nothing is enforcing it right now. Safe mode pauses every protection while it is on."
- **The row.** **On since** and **Undo never expires**, with "This one has no effect a page view can check, so it is reported from your settings."
- **The activity log.** "Hardening applied" and "Hardening undone".
- **If the editor is on.** A save in it is recorded as **File edited in the file editor**, rated High. See [See saves in the theme and plugin file editor](/docs/file-editor-saves/).

<figure class="doc-shot">
  <img src="/docs/screenshots/disable-file-editor.png" alt="Turn off the dashboard file editor: saved state and available controls in BetterShield." width="980" height="115" loading="lazy" decoding="async">
  <figcaption>Example Disable the file editor view. Check the saved values and status on your own site.</figcaption>
</figure>

## Good to know

- If Patchstack is already turning the editor off, a note beside the switch says so and suggests leaving the job to one of them.
- Theme files changed any other way, over SFTP for example, still show up in the [file check](/docs/file-changes/), which watches your active theme.

## On multisite

Each site has its own switch. On a network the code editors already belong to the network's administrators, so the row says: "On a network the dashboard code editors already belong to the network's own administrators, so applying this changes nothing for a site administrator here. It stays in force if the network ever hands those capabilities down." On the main site the row says instead: "On this network, applying this here also removes the theme and plugin file editors from Network Admin, for every network administrator. On any other site it changes nothing a site administrator can see." See [Multisite networks](/docs/multisite-network/).

## Related

- [Hardening](/docs/hardening/)
- [Turn off remote publishing (XML-RPC)](/docs/disable-xml-rpc/)
- [Stop PHP in uploads](/docs/php-in-uploads/)
- [File changes](/docs/file-changes/)
- [Disable file editing in WordPress](/blog/disable-file-editing-wordpress/)

This is how you can turn off the dashboard file editor with BetterShield.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).