Disable theme and plugin editor

WordPress ships with a built-in code editor that lets admins modify theme and plugin PHP files directly from the browser. If an attacker gains admin access (through a compromised password, plugin vulnerability, or session hijack), this editor gives them the ability to inject backdoors into your site’s source code.

disable-file-editor.php

<?php
/**
 * Disable Theme and Plugin Editor
 *
 * WordPress includes a built-in code editor under Appearance > Theme Editor
 * and Plugins > Plugin Editor. If an attacker gains admin access, this editor
 * gives them the ability to inject malicious code directly into PHP files.
 * Disabling it forces all code changes to go through the filesystem, where
 * proper access controls and version control apply.
 *
 * Usage: Add to wp-config.php, above the "That's all, stop editing!" line.
 *
 * @category security
 * @language php

 *
 * @author Adame Dahmani https://adame.io
 * @support Support my family project: https://adame.io/fundraiser
 */
define( 'DISALLOW_FILE_EDIT', true );

All code changes should go through the filesystem where version control, file permissions, and code review can protect against unauthorized modifications.