{"id":18864477,"date":"2026-03-27T08:47:11","date_gmt":"2026-03-27T08:47:11","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/php-and-security\/"},"modified":"2026-03-27T08:47:11","modified_gmt":"2026-03-27T08:47:11","slug":"php-and-security","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/php-and-security\/","title":{"rendered":"PHP and Security"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">I am a WordPress administrator managing several WordPress installations in an educational environment. We are currently evaluating whether to keep the Code Snippets plugin active across our sites.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">My main concern is <strong>security<\/strong>: allowing users to add and execute arbitrary PHP code through the plugin interface represents a significant risk, especially in a multi-user environment where not all users have advanced technical knowledge.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I would like to know whether there is any built-in option \u2014 or a recommended approach \u2014 to <strong>restrict or completely disable PHP snippet execution<\/strong> while still allowing other snippet types (CSS, JavaScript, etc.). For example, a capability or role-based restriction that prevents non-admin users from creating PHP snippets, or a setting to disable PHP snippets entirely.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If this functionality is not currently available, would it be something feasible to consider for a future release?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Thank you in advance for your time.<\/p>\n","protected":false},"template":"","class_list":["post-18864477","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18864477","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18864477\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=18864477"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}