Myth-Busting SOP: 'DISALLOW_FILE_EDIT Stops Code Injection'

Myth-Busting SOP: 'DISALLOW_FILE_EDIT Stops Code Injection'

Setting DISALLOW_FILE_EDIT only hides the dashboard theme editor. An attacker with admin can still install a plugin, upload a zip, or write via FTP. It closes one door in a hallway. Lock the rest:

— Step 1: Keep DISALLOW_FILE_EDIT true, but log it as one of several steps.
— Step 2: Add DISALLOW_FILE_MODS true to also block plugin/theme installs and updates from the UI.
— Step 3: Deny PHP execution in wp-content/uploads at the server level — the real injection target.
— Step 4: Make core files read-only to the web user so no process can rewrite them.
— Step 5: Verify by attempting to upload a .php file to uploads and execute it — it must 403.

The constant blocks the menu, not the method. Run this every time.