PHP editing & security

SnipCraft separates snippet management from PHP editing with a dedicated capability, and provides a wp-config kill switch and additional safeguards for hosting environments and multisite networks.

Watch this part of the walkthroughCode Security Features at 3:58, opens on YouTube

A separate permission for PHP

Managing snippets (creating, enabling, and disabling them) uses the snipcraft_manage capability. Editing PHP snippets requires a stricter, separately granted snipcraft_edit_php capability.

This split lets you give a team member or editor the ability to manage CSS, JavaScript, and HTML snippets without granting the ability to write and execute arbitrary PHP on the server. The two capabilities are independent. Holding snipcraft_manage does not imply snipcraft_edit_php.

The wp-config kill switch

To disable PHP editing across the entire site (for instance, on a production environment where you want to prevent any code changes) define the following constant in your wp-config.php:

php

define( 'SNIPCRAFT_DISABLE_PHP', true );

When this constant is truthy, the PHP editing interface is hidden and no PHP snippet code can be modified, regardless of the user's capabilities. Existing enabled PHP snippets continue to run normally. Only editing is disabled.

Hosting and multisite rules

Two additional guards apply automatically depending on your environment:

When DISALLOW_FILE_MODS is defined and truthy in wp-config.php, PHP editing is also disabled. The same safeguard that prevents plugin and theme file edits from the admin applies to PHP snippets.
On a WordPress multisite network, PHP editing is restricted to super admins only. Network-level administrators control PHP; site administrators cannot edit PHP snippets even if they have the capability on their own site.

Security scanner

Every time you save a PHP snippet, SnipCraft scans its code for risky patterns and reports any findings inline. Scanning is on by default; you can disable it in Settings under Security if you do not need it.

High-severity findings flag patterns that can execute or inject arbitrary code: eval(), assert(), create_function(), shell execution functions (exec, shell_exec, system, passthru, proc_open, popen), the backtick shell operator, remote file includes, and encoded payloads combined with code-execution functions (obfuscation).

Medium-severity findings cover operations with legitimate uses that still carry risk: filesystem writes (file_put_contents, fwrite, unlink, and similar), remote HTTP fetches, direct database queries without $wpdb->prepare(), superglobal extraction, and runtime PHP configuration changes such as ini_set().

Pro

SnipCraft Pro adds a blocking mode. Enable Block enabling high-severity snippets (security.block_high_severity) in Settings and any PHP snippet with unreviewed high-severity findings cannot be switched on until you explicitly acknowledge it. Medium-severity findings warn but never block.