WordPress has two editors for code: Plugins → Plugin File Editor and Appearance → Theme File Editor. A change in these editors can break your site. Pastmark logs every saved change.
What Pastmark logs #
- The event is File Edit, with the severity Warning.
- It is in the Plugins group and in the Themes group in
User Activity → Events. - It is on in all presets, also in Essential.
- It works with the normal editor and with the WordPress editor form for browsers without JavaScript.
The message looks like this: File "functions.php" edited for theme "Twenty Twenty-Five" using the theme editor.
See what changed #
Open the event. Read See what changed in an event. You see:
- The Checksum before and after.
- The File Size (Bytes) before and after.
- Content Changes: the changed lines. Lines that start with
+are new. Lines that start with-were removed.
Pastmark saves only the changed lines, never the whole file. If the change is big compared to the file, or the file is very large, Pastmark keeps only the checksum and the size.
When nothing is logged #
- You save the file without a change.
- WordPress refuses the change. For example, WordPress tests PHP changes on the active theme or plugin. If your site would break, WordPress puts the old file back.
- Your site has
DISALLOW_FILE_EDIT. WordPress then removes the editors.
Turn off the saved changed lines #
The changed lines can contain whatever someone pasted into the file, for example an API key. Pastmark does not hide secrets in these lines. Anyone who can read the log can read them.
A developer can save only the checksum and the size. Add this code to a small plugin:
add_filter( 'pastmark_file_edit_store_diff', '__return_false' );