WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin.

define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );

Yet lately I've noticed strange plugins & themes being installed on my demo site. I can see in the apache logs that they've been trying to access plugin-install.php but failing with a 500 error.

The folder permissions are 755 on both plugins & themes, so the files can execute but only the user has write access.

Does anyone know how they might be doing it / where I'm going wrong?


share|improve this question
If you would post a couple of the full log entries it would help. I suspect this is a bot trying to get access to the site-- just a guess. – s_ha_dum Jan 28 '13 at 19:42
Seems my host only keeps the apache logs for a day :| – user1958047 Jan 29 '13 at 11:51
Basically, requests were made to plugin-install.php and failing with 500 error... yet the plugins made it through. Could another plugin allow them to install a plugin on WordPress? – user1958047 Jan 29 '13 at 11:53
Your description worries me, especially the part about the plugin making it through. It sounds like you have a security problem but I don't know that it can be solved in this venue. – s_ha_dum Jan 29 '13 at 14:20
Perhaps your WordPress security are being overwritten from your cPanel or your panel (if not using cPanel). This sounds more like a problem with your hosting company. Why not contact them and explain the issue? – denis.stoyanov Jul 28 '15 at 8:30

I would convert the site to a subsite on a multi-site instance, you can then have an approved list of plugins and themes. This answer might help more.

You could also create a new user type that does not have access to the plugins/themes areas and only publish those details.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.