A file needs changing on a live site and you are not at your own desk. The realistic options are SFTP, the host panel, the editor built into WordPress, or another file manager plugin. Here is the honest breakdown against all four.
An SFTP client is the professional answer and it wins on bulk transfer, but it needs a server account, a key or password, and a machine you have set up. When the site broke and you are on a train, none of those are true. The host control panel file manager reaches everything, which is the problem: it has no idea what WordPress is, it will happily let you open wp-config.php, and every action arrives under one shared hosting login. The theme and plugin editor in WordPress is the closest thing to this in core, and it does check PHP before saving. It only reaches theme and plugin PHP files, so it cannot help with an upload, an .htaccess, a font file or a folder listing. Other file manager plugins exist and we have not audited them, so this page does not characterise them. The question worth asking any of them, including this one, is what happens to a path between the browser and the filesystem, and whether the answer is written down. WP File Commander (this site) puts every path through one function that normalises it, rejects .., resolves it with realpath() and tests the result against a root you chose, then blocks wp-config.php, holds wp-admin and wp-includes read-only, refuses to edit its own files, and records the lot.
| Feature | WP File Commander | SFTP client | Host file manager | Core theme editor |
|---|---|---|---|---|
| Works from your WordPress login | ✓ No server account | ✗ Needs credentials | ✗ Needs panel access | ✓ It is in core |
| Reaches non-PHP files | ✓ Any file below the root | ✓ Anything | ✓ Anything | ✗ Theme and plugin code only |
| Scope limited on purpose | ✓ Uploads, wp-content or install | ◐ Whatever the account can see | ✗ The whole account | ✓ Narrow by design |
| Traversal and symlink escapes refused | ✓ realpath() checked against the root | ✗ Not a concept | ✗ Not a concept | ✓ Narrow enough not to matter |
| wp-config.php blocked | ✓ Read and write, by default | ✗ Wide open | ✗ Wide open | ✓ Out of scope |
| Refuses to save PHP with a syntax error | ✓ Line number, disk untouched | ✗ Uploads it as given | ✗ Saves it as given | ✓ Core does check |
| Upload and download files | ✓ Both, with extension rules | ✓ Its whole job | ✓ Yes | ✗ Neither |
| Search inside file contents | ✓ File and line (Pro) | ✗ Download, then grep | ◐ Some panels, slowly | ✗ No search at all |
| Zip and safe extraction | ✓ Entry names validated first (Pro) | ✗ No extraction | ◐ Usually, behaviour varies by panel | ✗ No |
| Change permissions | ✓ Octal and rwx shown (Pro) | ✓ Yes | ✓ Yes | ✗ No |
| Who did what, recorded | ✓ User, path, time, IP, outcome (Pro) | ◐ Server logs, if enabled | ✗ One shared login | ✗ Nothing |
| Access gate | ✓ Capability and an allowed role | ◐ Whoever has the password | ◐ Whoever has the panel | ◐ Any administrator |
| Moving 4 GB of media | ✗ Use SFTP | ✓ The right tool | ◐ Slow but possible | ✗ No |
| Cost | From $49/yr · $599 lifetime | Free client, paid hosting | Included with hosting | Free, in every install |
You run one site, you sit at the same machine every day, and your SFTP client is already open with the key loaded. That setup is faster than any browser and we would rather say so than sell you something. Core's theme editor is also the right answer for a one-line change to a child theme when you are already logged in and the file is PHP. Credit where it is due: core checks PHP before saving, and that check is a good idea we copied.
You look after sites you did not build, on hosting you do not control, and the question is “can I fix this now, from here, without asking anyone for credentials, and can I show what I changed afterwards?” That is the gap this fills.
One honest line: any tool that can write files can be misused by someone who is already inside your admin, and a plugin that claims otherwise is selling comfort. What this one does is keep the blast radius small on purpose. The root is a setting, wp-config.php and core are off limits without one, the plugin will not rewrite itself, an archive cannot walk out of the folder it unpacks into, and every attempt is written down whether it worked or not.