The built-in editor under Appearance and Plugins lets anyone with administrator access write PHP directly into your site. If an attacker steals an admin login, it is the fastest route to a backdoor. Almost nobody needs it.
How to disable it
Edit public_html/wp-config.php in cPanel File Manager and add this above the "stop editing" comment:
define('DISALLOW_FILE_EDIT', true);Save. The Theme File Editor and Plugin File Editor menu items disappear immediately.
Going further
To also block plugin and theme installation and updates from the dashboard — useful on a site you maintain for a client — use:
define('DISALLOW_FILE_MODS', true);Be aware this blocks all updates from the dashboard too, so you will need to update manually or remove the line temporarily.
Editing files safely instead
Use cPanel File Manager or SFTP. Both let you download a copy before editing, so a mistake never leaves you with a white screen and no way back.
