Save 35% on your order with code Ends in Shop now
Documentation

DooFiles

Manage files

How to create, rename, move, download, compress, extract and delete files and folders with DooFiles, which names are allowed, and which actions ask for your password.

Last updated: Oct 31, 2026

Overview

DooFiles lets you work with the files and folders of your site as you would on your computer: create, rename, move by dragging, download, compress into a zip file, extract a zip file, and delete. Deleted items go to the DooFiles Trash, so a mistake can be undone.

You find these actions in the toolbar, in the right-click menu of each row, and in the bar that appears when you select rows. See First steps.

Most of them also work in a Cloudflare R2 bucket. That page explains what changes there.

Create a file or a folder

  1. Open the folder where you want it.
  2. Click New file in the toolbar, or New folder in the folder panel. You can also right-click an empty part of the list.
  3. Type the name and confirm. DooFiles shows where it will be created: It will be created in /wp-content/uploads.

A new text file opens right away, empty, in the editor. A new folder is highlighted in the list. See Editor.

Allowed names

A name:

  • cannot be empty, and can have up to 255 characters;
  • cannot contain any of these characters: / \ : * ? " < > |;
  • cannot start with a space, or end with a space or a dot;
  • on Windows servers, cannot be a name reserved by the system, such as CON, NUL or COM1.

If something with the same name already exists in the folder, DooFiles tells you: Something with that name already exists here.

Rename

Select a row and press F2, or right-click it and choose Rename. Type the new name and confirm.

Changing the extension of a file changes how it is treated. For example, renaming a file to .php asks for your password, because it becomes code.

Move

Drag the selected rows and drop them on:

  • a folder in the list;
  • a folder in the tree;
  • a part of the breadcrumbs, to move them up to that folder.

DooFiles does not move a folder inside itself, and does not replace something that already exists in the destination folder: it tells you "logo.png" already exists in the destination folder. Rename one of them first.

Between your site and a Cloudflare R2 bucket, dragging copies instead of moving: the original stays where it was. See Cloudflare R2.

[SCREENSHOT_HERE: Two files being dragged onto a folder in the tree, with the folder highlighted as the destination]

Download

Right-click a file and choose Download, or click Download in the editor or the media viewer.

To download a folder, compress it first, then download the zip file.

Compress into a zip file

  1. Select one or more rows.
  2. Right-click and choose Compress.
  3. Type the name of the zip file, or keep the one DooFiles suggests, and confirm.

The zip file is created in the same folder. Folders keep their contents and structure inside it.

A private folder cannot be compressed from outside, so its files do not end up in a public zip file. Open it and compress what is inside.

Extract a zip file

Right-click a zip file and choose Extract. DooFiles never overwrites anything:

  • If none of the files or folders of the zip exist in the folder, they are extracted right there. This is the usual case for the zip file of a plugin or a theme.
  • If any of them already exists, DooFiles creates a new folder with the name of the zip file and extracts everything inside it.

Before extracting, DooFiles checks every file of the zip, and does not extract archives that are not safe, such as one that tries to write outside the folder. An archive can have up to 20,000 files and take up to 1 GB once extracted.

Compress and Extract need the PHP zip extension. Without it, they do not appear. See Requirements.

Delete

Select one or more rows and press Delete, or right-click and choose Trash. The items go to the DooFiles Trash, and DooFiles shows “old-banner.jpg” moved to the trash. with an Undo button.

From the Trash, you can restore them later, or delete them for good.

[SCREENSHOT_HERE: The notice "old-banner.jpg" moved to the trash, with the Undo button]

Files WordPress needs

Some files and folders keep your site running. Before you move, rename or delete one of them, or add files inside the folders of WordPress, DooFiles asks you to confirm:

  • the files of WordPress: wp-admin, wp-includes and its files in the main folder, such as wp-login.php;
  • wp-config.php, and the .htaccess or web.config file of the main folder;
  • the folders WordPress needs: wp-content, plugins, themes, mu-plugins, uploads and languages;
  • the active plugins, the active theme and its parent theme;
  • must-use plugins and drop-ins, such as object-cache.php.

The warning lists each item and what happens if you change it, for example The active plugin “dbmovies”. WordPress deactivates it. Click Continue anyway to go ahead, or Cancel to change nothing. It works the same when you drag, use the menu, press a key or upload a file.

The warning plays a short sound when it opens. To turn it off only in your browser, click the preferences icon next to File manager and turn off Sound for warnings. See Preferences.

In the list, these items show a discreet label, WordPress or active, in the column after the name. Hold the pointer over it to read why.

DooFiles knows the files of WordPress from the official list of WordPress.org for your version. Anything else inside wp-admin or wp-includes is not part of WordPress, and changes without a warning. Inactive plugins and themes, your uploads and your own folders change without a warning too.

To turn the warning off, go to DooFiles › Security, open the Security card and turn off Warn before changing WordPress files.

The folder of DooFiles

The folder of DooFiles, in wp-content/plugins, shows the label protected in the list. DooFiles never moves, renames or deletes it, or a folder that holds it, such as plugins or wp-content, even with your password, and Rename and Trash do not appear in its menu (DooFiles 1.0.11 or newer). To remove DooFiles, deactivate and delete it in Plugins.

[SCREENSHOT_HERE: The warning "Your site could stop working" after pressing Delete on wp-config.php, with the item, its reason and the Continue anyway button]

Actions that ask for your password

Some actions ask for your WordPress password first, because they change code or the structure of your site. After you confirm it, they do not ask again for a while (10 minutes by default):

ActionAsks for your password when
CreateThe file is PHP, or a server file such as .htaccess or wp-config.php. New folders do not ask
Rename, Move and TrashWhat you selected includes a folder, a PHP file or a server file
ExtractThe zip file contains PHP or server files
Compress and DownloadNever

See Password confirmation.

Troubleshooting

ProblemWhat to do
Names cannot contain these characters: / \ : ? " < > |*Remove those characters from the name
Names cannot start with a space or end with a space or a dot.Remove the space or the dot
Something with that name already exists here.Choose another name, or rename the existing item first
A folder cannot be moved inside itself.Drop the folder on a folder that is not inside it
DooFiles warns before moving or deleting a fileWordPress needs that file or folder. Click Continue anyway if you are sure. See Files WordPress needs
DooFiles cannot move, rename or delete its own folder, or a folder that holds it.DooFiles protects its own folder. To remove DooFiles, deactivate and delete it in Plugins. See Files WordPress needs
The archive has more than 20,000 files.Extract it on your computer and upload the files, or ask your developer to raise the limit
The archive was not extracted because it contains an unsafe path.The zip file is not safe. Do not use it, or ask its author for a new one
This file is not a valid zip archive.The file is damaged or is not a zip file. Download it again
Compress and Extract do not appearYour server does not have the PHP zip extension. Ask your hosting provider to turn it on

Need more help? Open a support ticket.

The product DooFiles — Secure WordPress file manager plugin The file manager WordPress should have shipped with: native, fast and secure by design. Features and pricing