File editing restriction is a WordPress hardening setting that disables the built-in dashboard editors for theme and plugin files. When this control is enabled, administrators cannot directly change PHP or template code from the admin interface.
This matters because dashboard file editing is a fast path from stolen admin access to code execution. An attacker who hijacks a WordPress session may use the editor to inject a web shell, backdoor, or malicious redirect without needing SSH or FTP access. Blocking that path reduces the impact of compromised credentials and makes persistence harder. Defenders still need to inspect writable directories and installed files, but file editing restriction removes one of the easiest ways to turn admin power into server-side compromise.