I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin.

define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );

Yet lately I've noticed strange plugins & themes being installed on my demo site. I can see in the apache logs that they've been trying to access plugin-install.php but failing with a 500 error.

The folder permissions are 755 on both plugins & themes, so the files can execute but only the user has write access.

Does anyone know how they might be doing it / where I'm going wrong?


  • If you would post a couple of the full log entries it would help. I suspect this is a bot trying to get access to the site-- just a guess.
    – s_ha_dum
    Jan 28, 2013 at 19:42
  • Seems my host only keeps the apache logs for a day :| Jan 29, 2013 at 11:51
  • Basically, requests were made to plugin-install.php and failing with 500 error... yet the plugins made it through. Could another plugin allow them to install a plugin on WordPress? Jan 29, 2013 at 11:53
  • 1
    Your description worries me, especially the part about the plugin making it through. It sounds like you have a security problem but I don't know that it can be solved in this venue.
    – s_ha_dum
    Jan 29, 2013 at 14:20
  • Perhaps your WordPress security are being overwritten from your cPanel or your panel (if not using cPanel). This sounds more like a problem with your hosting company. Why not contact them and explain the issue? Jul 28, 2015 at 8:30

1 Answer 1


I would convert the site to a subsite on a multi-site instance, you can then have an approved list of plugins and themes. This answer might help more.

You could also create a new user type that does not have access to the plugins/themes areas and only publish those details.

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .