---
title: Disable plugin and theme editor
canonical: https://wpsecurityninja.com/docs/security-fixes/disable-plugin-theme-editor/
---
The plugin and theme editors in wp-admin let Administrators edit code in the browser. That raises risk if an account is compromised, and makes accidental breakage easier.

![Disable plugin & theme editor](https://wpsecurityninja.com/media/2022/04/disable-plugin-theme-editor-1024x197.webp)

## Manual fix (Free)

1. Open `wp-config.php` in the WordPress root (FTP or host file manager).
2. Above `/* That's all, stop editing! Happy blogging. */`, add:

```php
define( 'DISALLOW_FILE_EDIT', true );
```

3. Save the file.
4. Confirm **Appearance → Theme File Editor** and **Plugins → Plugin File Editor** are gone.

## One-click fix (Pro)

1. Go to **Security Ninja → Fixes**.
2. Enable the option to disable the plugin and theme editor.
3. Confirm the editors no longer appear in wp-admin.

Related: [Fixes overview](https://wpsecurityninja.com/docs/security-tests/fixes/), [How to use the firewall](https://wpsecurityninja.com/docs/firewall/how-to-use-the-firewall/) for login protection.