Per the link provided in my comment to your question, if you wish to prevent the editing of files by WordPress, just disable the file editor.
To do that add the following to your site’s wp-config.php file:
define('DISALLOW_FILE_EDIT',true);
Or to disable the file editor and the plugin and theme installation/update system:
define('DISALLOW_FILE_MODS',true);
Related Posts:
- How to redirect all HTTP requests to HTTPS
- what is a auth_user_file.txt?
- Best way to eliminate xmlrpc.php?
- What’s the easiest way to stop WP from ever logging me out
- If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
- Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
- What’s the difference between esc_* functions?
- How to set up fail2ban with WordFence?
- Which KSES should be used and when?
- How to remove “Connection Information” requirement on localhost install of WP on MACOSX
- Disable comment windows for all existing posts (pages/blogposts)
- WordPress “Site Health Status” trust it or myself for its security advice?
- Generate WordPress salt
- Stop wordpress automatically escaping $_POST data
- Is WP vulnerable when updating plugins or themes?
- how can i embed wordpress backend in iframe
- Garbage in beginning of wp-config.php – was this WP installation compromised?
- Can I force a password change?
- What is the relationship between cURL, WordPress and cacert.pem?
- Is it necessary to use esc_url with template tags such as get_permalink?
- What is pclzip.lib.php file that wordfence think it’s a malicious code
- How to prevent bot or someone to modify any file automatically?
- How to disable XML-RPC from Linux command-line in a total way?
- HTTP Security Headers in wp-config
- How to remove javascript malware in wordpress site [closed]
- Staging Site: Made Public – Security Questions
- Best Way to Enable Two Step Authentication
- Securing my WordPress Files and Directories
- How to allow internal links using wp_kses filtration
- Securing a multi-user permission structure
- How does Cross Site Scripting (XSS) work exactly? [closed]
- Is default functions like update_post_meta safe to use user inputs?
- No option “I would like my site to be private, visible only to users I choose” in Privacy Settings
- vs WordPress Security
- esc_html__ security : what for in this example?
- Securing wp-config leads to sensitive information leak on wp-settings
- Suspicious Files
- What’s the point of forbidding access to wp-config.php?
- wp-json and what data does it give away?
- Is is necessary to use security plugin for wordpress? [closed]
- neccessary?
- wp-config.php being written by attacker
- XML-RPC errors they know my username?
- Is [admin / admin] acceptable for all local websites?
- Simple Online Payment for Event Registration [closed]
- Client side HTTP parameter pollution (reflected)
- Local file inclusion critical security issue [closed]
- my wordpress website is suspended [closed]
- Malware script in database post table only? [closed]
- Best practices to assert current_user_can() with guests
- XMLRPC slow and weird websites/services
- iTheme Security always lockout my account [closed]
- Is it sensible to worry about sanitizing admin input in plugin custom CSS?
- WordPress Front end Form – Enable to Submit PHP Codes
- Is it safe to hand over the admin rights?
- Is it safe use wp_editor in public contact form
- Is WordPress MultiSite secure & how much can it scale? [closed]
- How to find exploited wordpress plugin [closed]
- How I can open back door for myself?
- How safe is current_user_can()?
- Is it safe to give wordpress directories ownership to www-data?
- How can I force a specific password?
- Do we need to escape data that we receive from theme options?
- Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
- Who updates the wp-admin/core file?
- How WordPress sanitizes post content on save? Or it doesn’t?
- Does this code indicate an exploit?
- Security issue with ‘paged’ and ‘posts_per_page’ parameters taken directly from a POST request?
- How to prevent to direct access of my custom plugin folder/files
- Checking for origin of a xmlrpc request
- RESTRICT EDIT of PHP files?
- wp-content – permissions for files/folders created by apache
- How can I restrict access to specific parts of a page, not just the page itself?
- Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?
- Monitor wordpress all external calls
- HSTS header not being added correctly
- how to protect wordpress content from crawler
- Securing WordPress running on Azure platform
- Can WordPress admin user + database credentials be used to gain Cpanel or FTP access?
- Should I worry about SQL injection when using REST API?
- Spam Registrations
- Links to root domain from search engines don’t work, but direct links and links from other referrers do
- How can I backup my site if it gets hacked?
- Standard Method for Securing a WordPress Site
- Avoid ‘uploads’ 777 permissions: Potential threat or clean solution?
- Secure Multiple WordPress Installations on shared hosting
- Any way to disable /wp-login.php redirecting to the site folder?
- Able to go to WordPress admin even after deleting auth cookies from request headers
- Is WordPress ready for GDPR compliance? [closed]
- Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users
- Secure a WordPress website in 2019: one plugin or a combinations of them?
- What are the different types of firewall protections available for a WordPress website?
- Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
- Is this a WordPress security bug?
- Competitor is somehow accessing MetaData on a hidden WordPress site
- WordPress Hacks/Defacing [closed]
- Bank account number and Sort Code in a form [closed]
- Possible to change email address in keypair?
- SSH keypair generation: RSA or DSA?
- Why is SSH password authentication a security risk?