Everything below reflects the current release (v1.1.0). Install to first opened file is about five minutes, most of it deciding how far you want the plugin to see.
You need WordPress 6.0+ on PHP 7.4+ and an administrator login, plus the plugin zip and licence key from your purchase email. Two honest notes. First, this plugin writes files on a live site, so keep the root as tight as the job allows and zip a folder before you change it. Second, anything that can write files can be misused by whoever already holds an admin login, which is why access needs a capability and a listed role, and why every action is recorded.
Go to Plugins → Add New → Upload Plugin, choose the zip from your purchase email, install and activate. It adds a File Commander item to the admin menu. Activation touches no files: it creates the audit log table and waits.
Open File Commander → Licence and paste the key from your purchase email. It is a long code starting VPC1., so paste the whole thing rather than typing it. Keys are domain-based, with no account and no phoning home.
Open File Commander → Settings and pick what the plugin can see: uploads only, wp-content, or the whole WordPress install (Pro). Start at uploads. Move up to wp-content when you need themes and plugins. Nothing above the root you pick is reachable, by clicking or by typing a path.
Access needs the manage_options capability and a role on the allow list, both together. Add the roles that should reach the filesystem and leave the rest off. An editor handed a stray capability by another plugin stays out, and so does an administrator you left off the list.
Executable extensions such as .php, .phar and .sh are refused by default. Pro can allow them, and you should leave that off unless you have a specific reason and know who else holds an admin login on the site.
Go to File Commander → Files, browse to your active theme, and open a file. Doing this on a calm afternoon means the first time you use it in anger you already know where things are.
The behaviours and safeguards you will actually live with.
The path bar shows where you are relative to the root, and there is nothing above it to click. Folders show their permission bits as rwxr-xr-x with the octal beside them, so you can read a mode at a glance and still type 755 when you change it.
Filename search covers everything below the folder you are standing in and is in every edition. Content search is Pro and names the file and the line holding your string, which is how you find an injected snippet across 900 theme and plugin files. Both stop at the root.
Opening a text file gives you a dark editor with line numbers. Saving PHP runs a syntax check first. If the file will not parse you get the error and the line number, and the file on disk stays as it was. It cannot protect you from valid PHP that does the wrong thing at runtime, so read what you paste.
Upload into the folder you are looking at. Download any single file, or tick several and download them as an archive. The extension check runs against the real filename rather than the type the browser reported.
Tick rows and a selection bar appears with the actions that apply: copy, move, delete, download, zip. Deletion asks once and means it. If you are about to change a folder, zip it first and leave the archive beside it.
Change a mode by typing the octal. The rwx reading updates as you type, so you can see what 777 actually grants before you apply it. As a rule: 644 for files, 755 for folders, and a good reason before anything else.
Zip any selection into the current folder. Extraction reads every entry name in the archive and validates it before writing a byte, so an archive carrying ../../wp-config.php is refused outright rather than half-unpacked.
Every action is recorded with the user, the path, the time, the IP and whether it succeeded. Failures are logged as well as successes, so an attempt at a blocked path leaves a trace. This is what you show a client asking who edited the theme on Tuesday.
wp-config.php cannot be read or written. wp-admin and wp-includes are browsable and read-only. The plugin refuses to modify its own files. These hold regardless of the root you chose and regardless of who is logged in.
Every path from the browser is normalised, rejected if it contains a .. segment, resolved with realpath(), then compared against the configured root. A traversal string, an absolute path and a symlink pointing outside the root all fail the same way, because the comparison happens after the filesystem resolved where the path lands.
One box, one Save button. Paste the full VPC1.… key from your purchase email. The key covers the number of sites on your plan; move a site by deactivating on one and activating on another. Unlicensed, the free features keep working and the Pro ones pause with a notice rather than a breakage.