I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin.

define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );

Yet lately I've noticed strange plugins & themes being installed on my demo site. I can see in the apache logs that they've been trying to access plugin-install.php but failing with a 500 error.

The folder permissions are 755 on both plugins & themes, so the files can execute but only the user has write access.

Does anyone know how they might be doing it / where I'm going wrong?


  • If you would post a couple of the full log entries it would help. I suspect this is a bot trying to get access to the site-- just a guess. – s_ha_dum Jan 28 '13 at 19:42
  • Seems my host only keeps the apache logs for a day :| – user1958047 Jan 29 '13 at 11:51
  • Basically, requests were made to plugin-install.php and failing with 500 error... yet the plugins made it through. Could another plugin allow them to install a plugin on WordPress? – user1958047 Jan 29 '13 at 11:53
  • 1
    Your description worries me, especially the part about the plugin making it through. It sounds like you have a security problem but I don't know that it can be solved in this venue. – s_ha_dum Jan 29 '13 at 14:20
  • Perhaps your WordPress security are being overwritten from your cPanel or your panel (if not using cPanel). This sounds more like a problem with your hosting company. Why not contact them and explain the issue? – denis.stoyanov Jul 28 '15 at 8:30

I would convert the site to a subsite on a multi-site instance, you can then have an approved list of plugins and themes. This answer might help more.

You could also create a new user type that does not have access to the plugins/themes areas and only publish those details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.