Why is DISALLOW_FILE_MODS in wp-config.php set to true?

rija / docker-nginx-fpm-caches-wordpress

Wordpress (no DB server included) running with Nginx in a Docker container with caching and encryption enabled

Other

23 stars 7 forks source link

Why is DISALLOW_FILE_MODS in wp-config.php set to true? #8

Closed amizzo87 closed 6 years ago

amizzo87 commented 7 years ago

Why are theme and plugin/file modifications disabled by default? Is the expected way to install themes/plugins through the wp cli or something?

How can I change DISALLOW_FILE_MODS to false in a way that will persist between docker container restarts?

Thanks - great work on this btw!

rija commented 6 years ago

Thanks. This is part of the hardening process. I'm only half-way through that. I want to keep actions performed in Wordpress dashboard completely isolated from the underlying filesystem.

wp-cli (which is installed in the container) is the preferred way for doing Wordpress updates and admin tasks.

If you want to change that, you can edit /etc/wp-config-sample.php as this is the source file that the bootstrap script starts from at every restart.