# How DooFiles protects your site > The layers that protect your site while you manage its files with DooFiles: who can use it, where it works, the password and second factor, safe saves, uploads, zip files and previews, the Trash and backups, the activity log, and what DooFiles cannot protect against. Source: https://doothemes.com/docs/doofiles/security/overview --- ## Overview A file manager can change any file of your site, including its code. That is what makes it useful, and also what makes it a target. DooFiles is built so that a stolen session, a mistake or a malicious file can do as little damage as possible. This page explains each layer of protection in plain terms. Each one links to its own page. ## Who can use DooFiles - **Only administrators.** DooFiles opens only for users with the Administrator role, or network administrators on a multisite network. Editors, authors and other roles cannot use it, even if another plugin gives them extra permissions by mistake. - **Only from its own screen.** DooFiles works only from **DooFiles › File manager**, in a signed-in browser. Application passwords, scripts and other tools that can reach your site cannot use it. - **Only through WordPress.** No file of the plugin does anything when someone opens it directly from the web. Every action goes through WordPress, which checks who is asking first. Every attempt by a user who is not allowed is recorded in the [Activity](https://doothemes.com/docs/doofiles/views/activity) log. ## Where DooFiles works DooFiles works only inside the folder where WordPress is installed. It never shows, opens or changes anything outside it, and it ignores shortcuts (symbolic links) that point to other places on your server. ## Before changing code - **Password confirmation.** Changing PHP files, server files such as `.htaccess` or `wp-config.php`, or folders asks for your WordPress password first. Someone who steals your session can browse files, but cannot change code without your password. After five wrong passwords in a row, the confirmation locks for 15 minutes. See [Password confirmation](https://doothemes.com/docs/doofiles/security/password-confirmation). - **Second factor.** You can also ask for a 6-digit code from an authenticator app, and require it for every administrator. See [Second factor](https://doothemes.com/docs/doofiles/security/second-factor). - **Read-only mode.** When nobody needs to change files, turn on read-only mode: DooFiles still lets you browse, view and download, but changes nothing. See [Read-only mode](https://doothemes.com/docs/doofiles/security/read-only-mode). ## Safe saves When you save a file in the [editor](https://doothemes.com/docs/doofiles/files/editor), DooFiles: - checks the syntax of PHP files first, so a typo does not break your site; - warns you if someone else changed the file after you opened it, instead of overwriting their changes; - keeps the previous version as a [backup](https://doothemes.com/docs/doofiles/files/backups), so you can go back. ## Safe uploads and zip files - **Uploads of PHP and server files** ask for your password before anything is sent. See [Uploads](https://doothemes.com/docs/doofiles/files/uploads). - **Zip files** are checked before they are extracted. DooFiles refuses archives that try to write outside their folder, never overwrites an existing file, and limits how many files an archive can have and how much space it can take once extracted. See [Manage files](https://doothemes.com/docs/doofiles/files/manage-files#extract-a-zip-file). ## Safe previews - **Images, videos and PDF files** are shown as what their extension says they are, never as a page that could run code. An image with hidden scripts cannot run them, even if someone opens its address directly. - **The preview of Markdown and HTML files** never runs scripts. See [Editor](https://doothemes.com/docs/doofiles/files/editor#preview). ## Private folders You can close a folder of your own to the web, so nobody can open its files by address, and choose which administrators can open it in DooFiles. DooFiles checks with a real request that your server keeps it closed, and checks it again every day. See [Private folders](https://doothemes.com/docs/doofiles/security/private-folders). ## The Trash and the backups are protected The [Trash](https://doothemes.com/docs/doofiles/views/trash) and the backups live in a private folder of DooFiles, with a random name, closed to the web. A deleted PHP file or server file cannot run while it is in the Trash, even on servers that ignore `.htaccess`. ## Everything is recorded The [Activity](https://doothemes.com/docs/doofiles/views/activity) log records every action done with DooFiles, with the user, the date and the IP address, including the attempts that DooFiles blocked. It cannot be emptied from DooFiles, so nobody can erase what they did. ## Your files stay on your server DooFiles never sends your files, your users or your content to Doothemes. To activate and check your license and look for updates, it sends only your license key, the address of your site and the version of the plugin. ## What DooFiles cannot protect against - **An administrator with their password.** An administrator who confirms their password can change any file inside the folder of WordPress. That is the purpose of a file manager. On sites where nobody should change code, use read-only mode. - **Your server permissions.** DooFiles can do exactly what PHP is allowed to do on your server, no more and no less. - **Other ways into your server.** DooFiles does not control FTP, SSH, the file manager of your hosting, or other plugins. - **Mistakes outside DooFiles.** It keeps backups of what it changes, not of your whole site. ## Recommendations - Use a strong, unique password for every administrator, and turn on the [second factor](https://doothemes.com/docs/doofiles/security/second-factor). - Give the Administrator role only to people who need it. - Keep WordPress, PHP, your plugins and your themes up to date. - Keep regular backups of your whole site, files and database, with your hosting or a backup plugin. - Turn on [read-only mode](https://doothemes.com/docs/doofiles/security/read-only-mode) on sites where files rarely change. - Look at the [Activity](https://doothemes.com/docs/doofiles/views/activity) log from time to time, especially for failed password confirmations. - Use HTTPS on your site. ## Report a security problem If you find a security vulnerability in DooFiles, please report it privately by [opening a support ticket](https://doothemes.com/account/tickets/new), and do not share it publicly until we have had time to fix it.