The “Attach file” can be disabled by the Forum Accesses.

Navigate to wpForo > Accesses, edit the needed access, disable "Can attach file" option, set the current access to the needed usergroup in Forum Permissions field.

Forum Accesses, Forum Permissions FAQ: https://wpforo.com/community/faq/wordpress-user-roles-wpforo-usergroups-and-forum-accesses/#post-39664

To remove the source code and code button from TinyMCE, Put this function in your active WordPress theme functions.php file:

add_filter('wpforo_editor_settings', function ($settings) {
    if (empty($settings) || !is_array($settings)) {
        $settings = [];
    }

    // Remove the code and source code buttons from the toolbar
    $settings = str_replace(, '', $settings);

    return $settings;
});

or > How to Easily Add Custom Code in WordPress (Without Breaking Your Site)

I'm tryin gto implement the security before going live with the forum. I would like to disable:

- attachments

- Code

- Souce code

How can I do it?