DooFiles
The file manager WordPress should have shipped with: native, fast and secure by design.
DooFiles brings a real file manager to WordPress. It lives inside wp-admin and looks like it always belonged there: a folder tree on the left, your files on the right, drag and drop, search, zip and unzip, and uploads of any size that resume if your connection drops.
Edit code with the editor of WordPress, with a syntax check before every PHP save and a backup of each version you can restore in one click. Open photos, videos, music and PDFs in a media viewer with zoom, image editing and our signature cinematic lighting. Deleted files go to a Trash of their own, and every action is recorded in the activity log.
Security comes first. Changing code asks for your password, a second factor can protect every administrator, and private folders stay closed to the web, open only to the people you choose. DooFiles warns you before you touch what WordPress needs, checks that your core files and plugins are the original ones, and can be locked to read-only from wp-config.php.
Take your files with you: connect your phone with a QR code and open your private folders anywhere with the DooFiles Connect app. Available in 12 languages, with a dark mode.
File manager
- A native file manager inside wp-admin: folder tree on the left, files on the right.
- List or grid view, with thumbnails of images, videos and album covers.
- Drag and drop to move files and folders, and select many at once.
- Right-click menu with every action at hand.
- Create files and folders, rename, move, download and delete.
- Compress to zip and extract zip files in place.
- Search by name inside any folder.
- Breadcrumbs to jump back; click the current folder to reload it.
- A discreet label on everything WordPress needs, and a warning before you move, rename or delete it.
- A shortcut in the WordPress toolbar with the total size of your site.
Uploads
- Upload files and whole folders by dragging them in.
- Large files go up in parts, larger than your server's upload limit (2 GB by default, adjustable).
- Parts adapt to your connection and retry on their own, even behind Cloudflare.
- An uploads panel to follow, pause, resume, cancel or retry each file.
- Finished uploads stay listed for 10 minutes, sortable by name, size, speed or type.
- A soft chime when everything is done.
Code editor
- The code editor of WordPress, with syntax highlighting for each type of file.
- PHP files are checked for syntax errors before saving, so a typo never breaks your site.
- A backup of every version you save, restorable in one click.
- Live preview for Markdown, HTML and JSON files.
- Editor themes for the dark mode: Santiago, Dracula Soft and Aura Soft.
Media viewer
- Photos with zoom, and the details of each one.
- Edit images: rotate, flip, crop, resize, change the format and remove the metadata, as a copy or in place.
- Images of the Media Library are protected: edits are saved as a copy.
- A video player with loop and autoplay that remembers your volume.
- Music (MP3, M4A, WAV, OGG, Opus and FLAC) over the album cover, with its title, artist and album.
- PDF files open right in the viewer.
- Cinematic lighting: a soft glow with the colors of the photo, the video or the album cover.
Trash, backups and activity
- A Trash of its own: restore anything you deleted, or empty it when you are sure.
- Choose how many days the Trash and the backups are kept.
- An activity log of every action, including the attempts that were blocked.
- Choose how long the activity is kept and how many entries at most.
Space and integrity
- See the size of your whole site, by type of file.
- Tabs with your largest folders and your largest files.
- The size and number of files of each folder, right in the file list.
- Scan now, or let DooFiles scan every day.
- File integrity: compares WordPress, the plugins of WordPress.org and the products of Doothemes with their official signatures.
- Lists what was modified, what is missing and what should not be there.
Security
- Changing code asks for your password, valid for the minutes you choose (up to 120).
- Five wrong passwords in a row lock it for 15 minutes.
- A second factor with any authenticator app, with recovery codes.
- Require the second factor from every administrator, and choose when it is asked.
- Read-only mode, from the settings, from wp-config.php or with DISALLOW_FILE_EDIT.
- Private folders: closed to the web, and open only to the administrators on their list, with their password.
- DooFiles checks every day that your server keeps the private folders closed.
- Every path stays inside your WordPress folder, and links never lead outside it.
- Only administrators can open DooFiles.
- Lock any setting from wp-config.php, for agencies and hosting plans.
Mobile access
- Open your private folders from your phone or tablet with the DooFiles Connect app.
- Connect a device with a QR code that works once, after your password and second factor.
- Each device gets its own key: disconnect one or all of them at any time.
- Choose how many devices each administrator can connect, and how many days they last unused.
- View photos, play videos and music, download and upload files from the device.
- Optionally, create folders, rename, move, send to the Trash and restore from the device.
- See the Space totals and the integrity check, and scan again from the device.
- A device only reaches the private folders of its administrator, and never uploads PHP or server files.
- Every connection and action is recorded in the activity log, with the name of the device.
Your way
- Light, dark or system theme.
- Preferences for each browser: panels, list order, folder tree spacing and sounds.
- Settings organized in tabs: Security, Files, Mobile access and License.
- Available in 12 languages: English, Spanish, Portuguese (Brazil and Portugal), French, German, Italian, Japanese, Korean, Simplified Chinese, Vietnamese, Indonesian and Russian.
- Send a problem or an idea to Doothemes right from the settings.
- Automatic updates with your license.
Requirements
- WordPress 6.4 or newer.
- PHP 8.0 or newer.
Requirements
Minimum
- WordPress 6.4 or newer (tested up to 7.1).
- PHP 8.0 or newer.
- An administrator account: DooFiles is only for administrators.
- An active Doothemes license to change files and settings. Without one, DooFiles only lets you browse the folders.
PHP extensions
- OpenSSL: required to activate your license, which DooFiles stores encrypted.
- Zip (ZipArchive): to compress and extract zip files.
- GD or Imagick: to make thumbnails and edit images.
- EXIF (optional): to show the camera details of each photo.
Most hosting plans already include all of them.
Server
- Any web server that runs WordPress: Apache, LiteSpeed, Nginx or IIS.
- Private folders are closed with .htaccess on Apache and LiteSpeed, and with web.config on IIS. On Nginx, DooFiles shows you the rule to add to your server, and checks every day that it works.
- Write access to the folders you want to change. Folders the server cannot write are shown read-only.
Browser
- A recent version of Chrome, Edge, Firefox or Safari.
Mobile access (optional)
- Your site served over HTTPS.
- A phone or tablet with a recent browser (Safari on iPhone and iPad, Chrome on Android).
- Mobile access turned on in DooFiles › Settings › Mobile access.
Changelog
1.0.16 — October 27, 2026
- Your devices and the window to connect a device show the mark of the DooFiles app as a soft watermark, in the light and dark themes.
1.0.15 — October 27, 2026
- Settings in tabs: Security, Files, Mobile access and License, each with its own entry in the DooFiles menu.
- The QR code to connect a device closes by itself as soon as the device connects.
1.0.14 — October 27, 2026
- Organize files from your phone or tablet: with the new Let devices organize files setting (off by default), a connected device can create folders, rename, move, send to the Trash and restore, always inside your private folders. Emptying the Trash is only done on the site.
- Scan now from the Space and Integrity screens of the app, once a minute.
- Your devices has its own card in Settings, with an icon for each device.
- The Feedback card says in how many minutes to try again when the Doothemes service asks to wait.
1.0.13 — October 26, 2026
- Mobile access: connect your phone or tablet with a QR code and open your private folders from the DooFiles app at connect.doofiles.com. View photos, play videos and music, download and upload files, and see the Space totals and the last integrity check.
- Off by default, for administrators only, in Settings › Mobile access: choose how many devices each one can connect and how many days a device stays connected without use, and disconnect any device at any time.
- A device only reaches the private folders of its administrator, and never uploads PHP or server files.
1.0.12 — October 26, 2026
- Audio in the media viewer: MP3, M4A, WAV, OGG, Opus and FLAC files play over the cover of the album, with the title, the artist and the album from their tags.
- MKV videos open in the media viewer when your browser can play them; when it cannot, the viewer offers to download them.
- Audio files with a cover show it as their thumbnail, and MKV videos get one too.
- The uploads panel is made of glass, with a soft glow along its edge in the dark theme while files are uploading.
- Fixes: the column titles of the tables stay on one line in every language, and the messages of your server follow the language of your profile.
For everyday work, no. DooFiles lets you browse, upload, edit, move, compress and delete the files of your site right from wp-admin, with a Trash and backups that FTP does not have. Keep your FTP or hosting access as a backup way in, as you would with any site.
That is exactly why DooFiles was built security-first. Only administrators can open it. Changing code asks for your password, and you can require a second factor from every administrator. PHP files are checked before saving, every path stays inside your WordPress folder, and every action, including blocked attempts, is recorded in the activity log. You can also lock DooFiles to read-only.
It goes to the DooFiles Trash, and you restore it with one click. Every file you save also keeps its earlier versions, so you can go back to any of them.
DooFiles checks every PHP file for syntax errors before saving it, so a missing semicolon never takes your site down. It also warns you before you move, rename or delete something WordPress needs, like wp-config.php or the active theme.
Folders nobody can open by URL. Inside DooFiles, only the administrators on each folder's list can open them, with their password. DooFiles checks every day that your server keeps them closed. They are perfect for documents, backups or media you do not want to be public.
Yes. On Apache, LiteSpeed and IIS, DooFiles closes private folders by itself. On Nginx, it shows you the exact rule to add to your server, and then checks every day that it works.
Up to 2 GB per file by default, and you can raise it. Large files go up in parts, so they can be bigger than your server's upload limit, and they resume on their own if the connection drops. It works behind Cloudflare too.
A free app to open your private folders from your phone or tablet: view photos, play videos and music, and download and upload files. It runs in the browser of your device, so there is nothing to download from an app store; you add it to your home screen and it opens like any other app. You connect it to your site by scanning a QR code.
It is off by default, and each administrator decides which devices to connect. Connecting asks for your password and your second factor, and the QR code works only once. Each device gets its own key, which you can disconnect at any time. A device only reaches the private folders of its administrator, and never uploads PHP or server files.
No. The DooFiles Connect app talks straight to your site: your files go from your site to your device, never through our servers.
Yes. With an active license you can change files and settings, and you get updates. Without one, DooFiles only lets you browse the folders.
Yes. Agencies and hosting providers can fix settings from wp-config.php, like read-only mode, a required second factor or the largest upload. Nobody can change them from the settings page.
No. DooFiles only loads in its own pages of wp-admin, never for your visitors. Measuring the size of your site runs in short batches, and once a day in the background.
English, Spanish, Portuguese (Brazil and Portugal), French, German, Italian, Japanese, Korean, Simplified Chinese, Vietnamese, Indonesian and Russian. Regional variants without their own translation, like Spanish from Mexico or Canadian French, use the closest one.
Yes. Choose Light, Dark or System, and pick the colors of the code editor.