DooFiles
Password confirmation
Why DooFiles asks for your WordPress password before changing code, folders and server files, which actions ask for it, how long the confirmation lasts, how to lock it again, and how to change or turn off this check.
Overview
Before you change code, folders or server files, DooFiles asks for your WordPress password. If someone steals your session, for example from a computer you left signed in, they can browse your files, but they cannot change the code of your site without your password.
After you confirm it, DooFiles does not ask again for a while, 10 minutes by default, in that browser.
Which actions ask for your password
| Action | When |
|---|---|
| Save, create, upload or restore a file | The file is PHP, or a server file such as .htaccess, .user.ini, php.ini, web.config, wp-config.php or .env |
| Rename, move or send to the Trash | What you selected includes a folder, a PHP file or a server file |
| Extract a zip file | The zip file contains PHP or server files |
| Delete permanently or empty the Trash | Always |
These actions always ask for your password, even when the check for code is turned off:
- Saving the site settings in DooFiles › Settings.
- Managing private folders: making one, changing who opens it, or making it public.
Uploading images, editing CSS or text files, creating folders, compressing and downloading never ask.
The confirmation dialog
DooFiles shows a dialog: Changes to PHP code, folders and server settings need your password. You will stay unlocked for 10 minutes. Type your WordPress password and click Confirm. The action continues on its own.
If you use a second factor, the dialog also asks for the code of your authenticator app, in a second step.
[SCREENSHOT_HERE: The Confirm your password dialog, with the Password field and the Confirm button]
A wrong password
DooFiles tells you what was wrong and how many attempts you have left: The password is not correct. 3 attempts left before a 15-minute wait.
After five wrong attempts in a row, the confirmation locks for 15 minutes, even with the right password: Too many wrong attempts. Wait 15 minutes and try again. Every wrong attempt is recorded in the Activity log.
How long the confirmation lasts
The confirmation lasts 10 minutes by default. During that time, code changes do not ask again.
It applies to the browser where you confirmed it. If you sign in from another browser or device, DooFiles asks there too. When you sign out, the confirmation ends.
The indicator and the Lock button
The bottom of the folder panel shows the state of the confirmation:
| It reads | What it means |
|---|---|
| Code changes ask for your password | The next code change asks for your password |
| Unlocked · 9:41 | You confirmed your password. The time left counts down |
| Code changes don't ask for a password | The check is turned off in the settings |
While it reads Unlocked, click Lock to end the confirmation right away, for example before you leave your computer. DooFiles shows Locked. Code changes will ask for your password again.
[SCREENSHOT_HERE: The bottom of the folder panel reading Unlocked with the time left and the Lock button]
Change the settings
Go to DooFiles › Settings, open the Security card, change it and click Save changes. Saving asks for your password.
| Setting | What it does | Default |
|---|---|---|
| Ask for the password before changing code | Turns the check on or off for the actions in the first table | On |
| Minutes the confirmation lasts | How long code changes stay unlocked after the password, from 1 to 60 minutes | 10 |
Shortening the time also shortens the confirmations that are open right now.
We recommend keeping the check on. Turn it off only on a site where you are the only administrator and your computer is safe. Saving the settings and managing private folders still ask for your password.
If a row shows Set by the … filter in the site's code., a developer fixed that value in the code of your site, and it cannot be changed here. See Filters and constants.
Troubleshooting
| Problem | What to do |
|---|---|
| Too many wrong attempts. Wait 15 minutes and try again. | Wait 15 minutes, then try again with the right password. If you forgot it, reset it from the WordPress login page |
| It asks for my password too often | Raise Minutes the confirmation lasts in the Security card |
| It asks again in another browser | The confirmation applies to each browser where you are signed in. Confirm there too |
| It asks for a code too | Your account has a second factor. See Second factor |
| Saving the settings asks for my password with the check turned off | Saving the settings always asks, on purpose |
Need more help? Open a support ticket.