Flex Explorer

Flex Explorer adds a single-page file manager to wp-admin. Every operation runs
through a sandboxed REST surface that resolves paths against a configurable
root, refuses symlink escapes, and never lets a request reach outside the site.

What it does

• Browse in icon, list or macOS-style column views, with a folder tree, drag-and-drop move, multi-select, sorting, dotfile toggle and recursive filename search.
• Upload with drag-and-drop, enforcing the site’s size cap and WordPress filename sanitisation.
• Create, rename, copy, move and delete files and folders.
• Trash catches deletions: items move to a recoverable store with restore, purge, and automatic cleanup after a retention period you set. Turn it off and deletions are permanent again.
• Zip and download a single file or a whole folder. Large selections run as background jobs with live progress, cancel, HTTP Range (resumable) downloads, and a single-use signed token per archive.
• Extract a zip in place or into a named folder.
• Risky-operation gate asks for confirmation before touching load-bearing files. A file is flagged only when it matches a “Risky file patterns” glob and sits inside a “Risky folders” entry, so a stray *.php under uploads/ stays quiet.
• Preview images inline; anything else downloads.
• Per-user interface language and a light / dark / cream theme, independent of the rest of wp-admin.
• WP-CLI: wp flex-explorer reset clears the plugin’s options and tables.

There is no file editor in this build

WordPress.org does not allow a plugin in the directory to edit site files, so
this build ships no editor: the Edit action explains that and points you at the
build that has one. That build is free as well, and it is downloaded from
flexacommerce.com/products/flex-explorer.
Settings, trash contents and background jobs carry over, because both builds use
the same slug, options and tables. Installing one over the other keeps your
configuration.

Security model

Access is limited to administrators (manage_options, filterable via
flex_explorer/capabilities/manage). Mutating calls require a nonce. A site
defining DISALLOW_FILE_EDIT switches the plugin off entirely, and on multisite
only network super admins pass, because the sandbox root is the whole network’s
filesystem. wp-config.php, .htpasswd, .htaccess and the WordPress core
files at the site root can never be deleted, renamed or moved by anyone, with no
bypass: removing any of them would take the site down.

External services

Your files never leave your server. Flex Explorer reads and writes the
filesystem locally, and the file manager itself makes no outbound calls. The
plugin connects to one external service, only in the admin, for the reason
below.

Deactivation feedback (Flexa Product Intelligence)

When you go to deactivate Flex Explorer on the Plugins screen, a short optional
survey asks why. This is served by Flexa’s product intelligence service at
https://product-intelligence.flexacommerce.com. It runs only on
wp-admin/plugins.php, never on the front end, and never blocks deactivation:
if the service is unreachable, the normal Deactivate link still works.

What is sent, and when:

• On opening the Plugins screen: a request to /api/v1/config (product slug and tier) to load the survey configuration. Cached for 6 hours.
• When you deactivate or interact with the survey: the reason you pick and any optional message you type, sent to /api/v1/deactivations, /api/v1/events, /api/v1/feedback, /api/v1/feature-requests and /api/v1/recovery-events.

Every request includes an anonymous per-site identifier (a random UUID), the
plugin version, and by default your WordPress version, PHP version
and locale. No email, site domain, user identity, file name, file content or
raw IP is collected.

Turn the environment details off with:
add_filter( ‘flex_explorer/deactivation_survey/config’, fn( $c ) => array( ‘collect_environment’ => false ) + $c );

Disable the survey entirely with:
add_filter( ‘flex_explorer/deactivation_survey/enabled’, ‘__return_false’ );

Service terms and privacy policy: https://flexacommerce.com/pages/terms and https://flexacommerce.com/pages/privacy