FlashPanel

Appearance

Website Lockdown ​

Overview ​

Website Lockdown protects a WordPress website by locking critical files and directories in read-only mode. While it is enabled, malicious code cannot be injected into or modify WordPress core, plugin, and theme files, even if an attacker has logged in to the WordPress admin panel.

The feature is only shown for WordPress websites (not for alias websites).

What does Website Lockdown protect? ​

When enabled, the following files and directories are locked and cannot be modified, deleted, or have new files added:

  • wp-config.php, .htaccess, and the PHP files in the website's root directory.
  • The WordPress core directories wp-admin and wp-includes.
  • The wp-content/plugins, wp-content/mu-plugins, and wp-content/themes directories. As a result, installing, updating, or deleting plugins and themes is blocked.

The wp-content/uploads directory is not locked, so you can still upload images and media and publish content as usual.

When to use it ​

  • Your website is live and stable, and you don't need to install new plugins or themes.
  • You have finished configuring the website and want to prevent unauthorized changes.
  • You suspect the website has been compromised and want to stop further damage (combine it with a malware scan and cleanup).

When to turn it off ​

  • Installing, updating, or deleting plugins and themes.
  • Updating WordPress core.
  • Developing or editing the website's files, including through the File Manager, SFTP, or Terminal.

Enable Website Lockdown ​

  1. Open the website's Overview page.
  2. In the Utilities group, click the Website Lockdown tile.
  3. Read the feature description in the dialog.
  4. Click Enable Website Lockdown.
  5. Wait for the process to finish.

Once enabled:

  • The Website Lockdown tile shows a green check mark, and the Lockdown line on the website information card changes to Enabled.
  • The Overview page, the WordPress page, and the plugin installation dialog show a Website Lockdown is enabled warning.

Disable Website Lockdown ​

  1. Open the website's Overview page.
  2. In the Utilities group, click the Website Lockdown tile.
  3. Click Disable Website Lockdown.
  4. Wait for the process to finish.

After disabling it, you can install plugins and themes and edit files as usual.

Notes ​

  • Always disable before updating: disable Website Lockdown before installing or updating plugins, themes, or WordPress core, and enable it again afterwards.
  • No impact on content: you can still create and edit posts and pages and upload media as usual.
  • Locked at the server level: locked files cannot be changed through the usual tools (WordPress admin, File Manager, SFTP, Terminal) until you disable Website Lockdown.
  • Toggle at any time: enabling or disabling it does not change the contents of your files.

Troubleshooting ​

Cannot install a plugin or theme ​

  1. Disable Website Lockdown (see Disable Website Lockdown).
  2. Install the plugin or theme.
  3. Enable Website Lockdown again if you want.

Updates fail ​

WordPress core, plugin, and theme updates fail while Website Lockdown is enabled. Disable the feature, run the updates, then enable it again.

Permission denied when writing files ​

If WordPress, a plugin, or the File Manager reports that it cannot write a file, check the Lockdown line on the Overview page. If it shows Enabled, disable it temporarily to edit the files, then enable it again when you are done.

Best practices ​

  1. Enable Website Lockdown once the website is fully configured and stable.
  2. Always disable it before maintenance, updates, or installations.
  3. Combine it with other security measures such as 8G Firewall and regular backups.