Why disabling the built-in plugin and theme editor is a sensible production hardening step.
Why this check matters
An administrator account with a compromised password can use the editor to write PHP directly. Removing that editing path limits the damage and encourages a controlled deployment process.
How to review it
- Confirm whether anyone genuinely relies on the editor.
- Disable it with DISALLOW_FILE_EDIT in configuration.
- Use version control, deployment tools or hosting access for code changes.
- Test that authorized maintenance still has a documented path.
Keep the change safe
This setting does not replace strong accounts, updates or file permissions. It removes one high-impact editing route.
How WPVitals uses this signal
WPVitals checks this setting locally and reports the result in the WordPress dashboard. The check is a maintenance signal, so review the site context before changing a setting and test the visitor experience afterwards.