Hardening
File editor and admin over HTTPS
Removes the built-in code editors for themes and plugins, so a stolen admin account cannot be used to write malicious code into your site, and shows whether the admin area uses HTTPS.
What it does
Disable theme and plugin editors: WordPress has screens where an administrator can edit theme and plugin code straight from the browser. With this on, those screens are gone from the menu and blocked if visited directly.
Admin over HTTPS is a read-only check showing whether your admin area and sign-in page are served securely.
Why it matters
If an attacker gets into an admin account, the code editor is the quickest way to plant a back door. Developers edit files with proper tools, so the browser editor is rarely needed.
Set it up
- Go to the Hardening tab, section Admin protection.
- Switch on Disable theme and plugin editors and click Save Changes.
- Check the Admin over HTTPS row. If it is not secure, ask your host to install a certificate and send all traffic to https.
Good to know
If your wp-config.php already turns the editors off, the switch shows "Set in wp-config.php" and cannot be changed here.
Installing and updating plugins and themes still works as normal.
Which plan includes it
This is in every plan.
How it works, for developers
- Defines
DISALLOW_FILE_EDITwhile WordPress runs (nothing is written towp-config.php), removes the editor menus (admin_menuat priority 999) and answerstheme-editor.phpandplugin-editor.phpwith HTTP 403 onadmin_init. - Admin over HTTPS reads
force_ssl_admin()and the scheme of the admin address. No setting. - Setting:
smg_disable_file_editor.
Quick answers about file editor and admin over https
What does File editor and admin over HTTPS do in Stack Guard?
Disable theme and plugin editors: WordPress has screens where an administrator can edit theme and plugin code straight from the browser. With this on, those screens are gone from the menu and blocked if visited directly. Admin over HTTPS is a read-only check showing whether your admin area and sign-in page are served securely.
Why use file editor and admin over https on a WordPress site?
If an attacker gets into an admin account, the code editor is the quickest way to plant a back door. Developers edit files with proper tools, so the browser editor is rarely needed.
How do I set up file editor and admin over https?
1. Go to the Hardening tab, section Admin protection. 2. Switch on Disable theme and plugin editors and click Save Changes. 3. Check the Admin over HTTPS row. If it is not secure, ask your host to install a certificate and send all traffic to https.
Which Stack Guard plan includes file editor and admin over https?
This is in every plan.
More in Hardening
- Remote access and commentsSwitches off the old and rarely used ways into WordPress, XML-RPC, pingbacks, trackbacks and application passwords, and can turn comments off across the whole site.
- Information disclosureStops your site from handing out usernames and its WordPress version to anyone who asks, two facts attackers collect before they strike.
- Security keysChanges the secret keys WordPress uses to sign people in. Every existing sign-in stops working at once, including any an attacker stole. Do it by hand, get reminders, or let Stack Guard do it on a schedule.
Not running Stack Guard yet? It is free.
Download Free