View source for Manual:Preventing access

<languages />
<translate><!--T:22--> For help customizing user rights, see <tvar name=1>{{ll|Manual:User rights}}</tvar>.</translate>
<translate><!--T:23--> This page contains examples useful for restricting access.</translate>

<translate>
<!--T:37-->
For information on how to edit <tvar name=1><code>LocalSettings.php</code></tvar>, check <tvar name=2>{{ll|Manual:LocalSettings.php}}</tvar>.
</translate>

__TOC__

{{anchor|Disable anonymous reading}}
<translate>
==Simple private wiki== <!--T:1-->

<!--T:38-->
For the common [[w:use case|use case]] of "a private wiki, for oneself and approved others", you need to:
</translate>

*[[#Restrict viewing of all pages|<translate><!--T:39--> Restrict viewing</translate>]]
*[[#Restrict editing of all pages|<translate><!--T:40--> Restrict editing</translate>]]
*[[#Restrict account creation|<translate><!--T:41--> Restrict account creation</translate>]]

{{warning|1=<translate><!--T:42--> See the warnings in the sections below; this is simple "general use" code, and may or may not match your requirements.</translate>}}

<syntaxhighlight lang="php">
# <translate nowrap><!--T:170--> Disable reading by anonymous users</translate>
$wgGroupPermissions['*']['read'] = false;

# <translate nowrap><!--T:171--> Disable anonymous editing</translate>
$wgGroupPermissions['*']['edit'] = false;

# <translate nowrap><!--T:172--> Prevent new user registrations except by sysops</translate>
$wgGroupPermissions['*']['createaccount'] = false;
</syntaxhighlight>

<translate><!--T:43--> Depending on what extensions you have installed, you may want to whitelist more pages.</translate>
<translate><!--T:44--> For example if you are using the <tvar name=1>{{ll|Extension:ConfirmAccount}}</tvar> extension, you probably want <tvar name=2>Special:RequestAccount</tvar> whitelisted.</translate>
<translate><!--T:45--> If the content language of your wiki is not English, you may have to use the translated name of the special pages in question.</translate>

<translate>
==Restrict account creation== <!--T:2-->

<!--T:46-->
To restrict account creation, you need to edit <tvar name=1>''LocalSettings.php''</tvar> in the root path of your MediaWiki installation.
</translate>

<syntaxhighlight lang="php">
# <translate nowrap><!--T:173--> Prevent new user registrations except by sysops</translate>
$wgGroupPermissions['*']['createaccount'] = false;
</syntaxhighlight>

{{note|1=<translate><!--T:47--> You can use the <tvar name=1>{{ll|Extension:ConfirmAccount|ConfirmAccount}}</tvar> extension if you want to set up an account confirmation queue.</translate> (<translate><!--T:48--> If not you may still proceed as follows.</translate>)}}

{{note|1=<translate><!--T:49--> New users will still be able to be created by sysops, in the following manner:</translate>}}

<translate>
<!--T:50-->
#Go to <tvar name=1>{{blue|Special:Userlogin}}</tvar>, when logged in as a sysop.</translate>
<translate>
<!--T:51-->
#Click on "Create an account" link to get to the account creation form.</translate>
<translate>
<!--T:52-->
#Enter a username and an email address, and click the "by email" button.</translate> <translate><!--T:53--> Note you need <tvar name=1>{{ll|Manual:$wgEnableEmail|$wgEnableEmail{{=}}true}}</tvar> or else the sysop must pick a password and send it to the user.</translate>
<translate>
<!--T:54-->
#The account will be created with a random password which is then emailed to the given address (as with the "forgot password" feature).</translate> <translate><!--T:55--> The user will be requested to change password at first login; when they do this, the email address will also be marked as confirmed.</translate>
#:<small><translate><!--T:56--> When you click the "create account" button instead, you have to manually send the user their password.</translate> <translate><!--T:57--> If you've set <tvar name=1>{{ll|Manual:$wgMinimalPasswordLength|$wgMinimalPasswordLength{{=}}0}}</tvar> (default configuration up to version 1.15) and you've left the password field blank, the user will be emailed an email address confirmation request but will be unable to access <tvar name=2>{{ll|Manual:Interface/Special pages summary|Special:Confirmemail}}</tvar> to perform the confirmation.</translate> <translate><!--T:58--> Instead, the user will get an error (unless you've added it to <tvar name=1>{{ll|Manual:$wgWhitelistRead|$wgWhitelistRead}}</tvar>); the user will be able to login with a blank password and then confirm email, but their password will not have been reset (it will have to be reset manually).</translate></small>

<translate><!--T:59--> It may be appropriate to edit the text displayed when a non-user attempts to log in.</translate>
<translate><!--T:60--> This can be done at <tvar name=1>[[MediaWiki:Nosuchuser]]</tvar>, when logged in as a sysop.</translate>
<translate><!--T:61--> Use plain text without any special formatting, as the formatting is ignored and the text is literally rendered.</translate>
<translate><!--T:62--> (Might have changed, see <tvar name=1>[[Mediazilla:12952|bug 12952]]</tvar>).</translate>

<translate>
<!--T:63-->
You may also modify the contents of the email sent to new users by editing the page <tvar name=1>[[MediaWiki:Createaccount-text]]</tvar>.

<!--T:64-->
To prevent even sysops from creating accounts:
</translate>

<syntaxhighlight lang="php">
# <translate nowrap><!--T:174--> Prevent new user registrations by anyone</translate>
$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['sysop']['createaccount'] = false;
</syntaxhighlight>

<translate>
<!--T:65-->
To add a message on top of the login form, modify <tvar name=1>[[MediaWiki:Loginprompt]]</tvar>.

==Restrict editing== <!--T:3-->

===Restrict editing of all pages=== <!--T:4-->
</translate>
<translate><!--T:67--> Users will still be able to read pages with these modifications, and they can view the source by using [[<tvar name=1>Special:Export</tvar>/Article name]] or other methods.</translate>
<translate><!--T:68--> See also <tvar name=1>[[Mediazilla:1859|bug 1859]]</tvar>.</translate>

<translate><!--T:69--> See <tvar name=1>{{ll|Help:User rights}}</tvar> and <tvar name=2>{{ll|Manual:$wgGroupPermissions}}</tvar>.</translate>
<translate><!--T:70--> If you use <tvar name=1>{{ll|Extension:AbuseFilter}}</tvar>, any wiki admin can also put various restrictions in place.</translate>

<translate>
<!--T:71-->
Some examples of how to protect all pages from editing (not reading) by certain classes of users:

====Restrict anonymous editing==== <!--T:5-->

<!--T:72-->
Requires that a user be registered before they can edit.
</translate>

<syntaxhighlight lang="php">
$wgGroupPermissions['*']['edit'] = false;
</syntaxhighlight>

<translate>
====Restrict editing by all non-sysop users==== <!--T:6-->

<!--T:73-->
Requires that a user be a member of the administrators (sysop) usergroup.
</translate>

<syntaxhighlight lang="php">
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['user']['edit'] = false;
$wgGroupPermissions['sysop']['edit'] = true;
</syntaxhighlight>

<translate>
====Restrict editing by absolutely everyone==== <!--T:7-->
</translate>
<syntaxhighlight lang="php">
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['user']['edit'] = false;
$wgGroupPermissions['sysop']['edit'] = false;
</syntaxhighlight>

<translate>
===Restrict editing of an entire namespace=== <!--T:8-->
</translate>
{{MW 1.10|and after}}
<translate><!--T:74--> Starting from MediaWiki version 1.10, it is possible to protect entire namespaces using the <tvar name=1>{{ll|Manual:$wgNamespaceProtection|$wgNamespaceProtection}}</tvar> variable.</translate>
<translate><!--T:75--> Examples:</translate>

<syntaxhighlight lang="php">
# <translate nowrap><!--T:175--> Only allow autoconfirmed users to edit Project namespace</translate>
$wgNamespaceProtection[NS_PROJECT] = array( 'autoconfirmed' );

# <translate nowrap><!--T:176--> Don't allow anyone to edit non-talk pages until they've confirmed their</translate>
# <translate nowrap><!--T:177--> email address (assuming we have no custom namespaces and allow edits</translate>
# <translate nowrap><!--T:178--> from non-emailconfirmed users to start with)</translate>
# <translate nowrap><!--T:179--> Note for 1.13: emailconfirmed group and right were removed from default</translate>
# <translate nowrap><!--T:180--> setup, if you want to use it, you'll have to re-enable it manually</translate>
$wgNamespaceProtection[NS_MAIN]     = $wgNamespaceProtection[NS_USER]  =
$wgNamespaceProtection[NS_PROJECT]  = $wgNamespaceProtection[NS_IMAGE] =
$wgNamespaceProtection[NS_TEMPLATE] = $wgNamespaceProtection[NS_HELP]  =
$wgNamespaceProtection[NS_CATEGORY] = array( 'emailconfirmed' );

# <translate nowrap><!--T:181--> Only allow sysops to edit "Policy" namespace</translate>
$wgGroupPermissions['sysop']['editpolicy'] = true;
$wgNamespaceProtection[NS_POLICY] = array( 'editpolicy' );
</syntaxhighlight>

<translate><!--T:76--> Note that in the last case it's assumed that a custom namespace exists and that <tvar name=1><code>NS_POLICY</code></tvar> is a defined constant equal to the namespace number.</translate>
<translate><!--T:169--> See <tvar name=1>{{ll|Manual:Using custom namespaces}}</tvar> and <tvar name=2>{{ll|Manual:Namespace constants}}</tvar> for a list of MediaWiki's core namespaces.</translate>

<translate>
===Restrict editing of certain specific pages=== <!--T:9-->
</translate>
<translate><!--T:77--> Use the {{<tvar name=1>ll|Manual:Administrators#Protection</tvar>|Protect}} feature.</translate>
<translate><!--T:78--> By default, any sysop can protect pages so only other sysops can edit them.</translate>
<translate><!--T:79--> In 1.9 and higher, by default they can also protect pages so only "autoconfirmed" users (with accounts older than a configured period) can edit them.</translate>
<translate><!--T:80--> This does not require editing configuration files.</translate>

<translate><!--T:81--> If you want to restrict editing to groups with specific permissions, edit <tvar name=1>{{ll|Manual:$wgRestrictionLevels|$wgRestrictionLevels}}</tvar>.</translate>
<translate><!--T:82--> To prevent actions other than edit and move, use <tvar name=1>{{ll|Manual:$wgRestrictionTypes|$wgRestrictionTypes}}</tvar>.</translate>

<translate>
===Restrict editing of all but a few pages=== <!--T:10-->
</translate>
<translate><!--T:83--> To impose a blanket restriction on editing for all pages, but allow a few (such as sandboxes, join request pages, etc.) to be more generously editable, you can use the <tvar name=1>{{ll|Extension:EditSubpages|nsp=0}}</tvar> extension.</translate>
<translate><!--T:84--> This may not fit too often, but you could also use the [[<tvar name=1>#Restrict editing of certain specific pages</tvar>|Restrict editing of certain specific pages]] method mentioned above, with all name spaces protected, and only a special one editable by everyone which has all the pages you want editable.</translate>

<translate>
===Restrict editing for certain IP address ranges=== <!--T:11-->
</translate>
<translate><!--T:85--> Schools and other institutions may want to block all edits not from a few specified [[w:IP address|IP address]] ranges.</translate>
<translate><!--T:86--> To do so, see <tvar name=1>{{ll|Manual:Block and unblock}}</tvar>.</translate>
<translate><!--T:87--> The only way to do this at present <!-- that I know of--> without modifying the code is to go to <tvar name=1>[[Special:Blockip]]</tvar> and systematically {{<tvar name=2>ll|Help:Range blocks</tvar>|rangeblock}} every one of the address ranges that you don't want to be able to edit.</translate>
<translate><!--T:88--> This will work for all future versions of MediaWiki.</translate>
<translate><!--T:89--> It will not work on a per-namespace basis.</translate>

<translate>
===Restrict editing by a particular user=== <!--T:12-->
</translate>
<translate><!--T:90--> Use the user {{<tvar name=1>ll|Manual:Block and unblock</tvar>|blocking}} functionality to deprive a user of all edit access.</translate>
<translate><!--T:91--> MediaWiki does not include a possibility to give rights to separate users directly; instead rights are always given to a user group.</translate>
<translate><!--T:92--> There is no way in the core software to change permissions of particular users in order to restrict or allow editing particular pages, except by changing their usergroup.</translate>

<translate>
===Restrict creating of all pages=== <!--T:13-->
</translate>

{{note|1=<translate><!--T:93--> Revoking the ''edit'' right already prevents affected users from creating new pages and talk pages.</translate>}}

<syntaxhighlight lang="php">
# <translate nowrap><!--T:182--> Anonymous users can't create pages</translate>
$wgGroupPermissions['*']['createpage'] = false;

# <translate nowrap><!--T:183--> Only users with accounts four days old or older can create pages</translate>
# <translate nowrap><!--T:184--> Requires MW 1.6 or higher.</translate>
$wgGroupPermissions['*'            ]['createpage'] = false;
$wgGroupPermissions['user'         ]['createpage'] = false;
$wgGroupPermissions['autoconfirmed']['createpage'] = true;
</syntaxhighlight>

<translate>
===Restrict creating pages in certain namespaces=== <!--T:14-->
</translate>
<translate><!--T:94--> There are separate rights for creating talk pages (<tvar name=1>createtalk</tvar>) and creating non-talk pages (<tvar name=2>createpage</tvar>).</translate>
<translate><!--T:95--> If you need per-namespace control finer than that, it is not possible in core MediaWiki, and requires an extension such as <tvar name=1>{{ll|Extension:Lockdown}}</tvar>.</translate>

<translate>
==Restrict access to uploaded files== <!--T:15-->
</translate>
: ''&rarr; {{ll|Manual:Image authorization}}, {{ll|Manual:img_auth.php|img_auth.php}}, {{ll|Manual:User rights#List of permissions|2=<translate><!--T:96--> Manual:User rights (read)</translate>}}''

<translate><!--T:97--> If you have enabled the ability to upload files, these will be served directly by the underlying web server.</translate>
<translate><!--T:98--> As a result, '''{{<tvar name=1>red</tvar>|account-based access to the file is unrestricted by default}}'''.</translate>

{{uploaded-files-access-restriction-info}}

<translate>
=== Example for access restriction to uploaded files in the server configuration === <!--T:16-->
</translate>
<translate><!--T:99--> If sensitive files are uploaded to an internet-accessible wiki, you may wish to add restrictions on where these can be accessed from.</translate>
<translate><!--T:100--> On Apache, if your local network were 10.1.2.*, you could restrict serving files to local addresses with:</translate>

<pre>
  <Location /mediawiki/images>
    Order deny,allow
    Allow from 10.1.2.3
    Deny from all
  </Location>
</pre>

<translate>
==Restrict viewing== <!--T:17-->

===Restrict viewing of all pages=== <!--T:18-->
</translate>
{{warning|1=<translate><!--T:101--> If you want anonymous users to be unable to view the wiki markup/code, you should not allow them to edit any page (see [[<tvar name=1>#Restrict editing of all pages</tvar>|#Restrict editing of all pages]] above).</translate> <translate><!--T:102--> If they can edit any page, they can use {{<tvar name=1>ll|Help:Templates</tvar>|template inclusion}} to view even pages they can't edit.</translate> <translate><!--T:103--> This may be possible to avoid by using <tvar name=1>{{ll|Manual:$wgNonincludableNamespaces|$wgNonincludableNamespaces}}</tvar></translate>}}

{{warning|1=<translate><!--T:104--> This method allows any visitor to view the wiki after creating an account.</translate> <translate><!--T:105--> You may wish to combine it with [[<tvar name=1>#Restrict account creation</tvar>|#Restrict account creation]] above.</translate>}}

{{warning|1=<translate><!--T:106--> Uploaded images will still be viewable to anyone who knows the image directory's name.</translate> <translate><!--T:107--> Either point <tvar name=1>{{ll|Manual:$wgUploadPath|$wgUploadPath}}</tvar> to the <tvar name=2>img_auth.php</tvar> script and follow the instructions in <tvar name=3>{{ll|Manual:Image authorization}}</tvar>, or use some external method to protect images, like .htaccess.</translate>}}

{{warning|1=<translate><!--T:168--> Wiki pages like <tvar name="1"><code>MediaWiki:Common.css</code></tvar> and <tvar name="2"><code>MediaWiki:Gadget-foo.css</code></tvar> may be part of a public ResourceLoader module, and thus can have their source code exposed through <tvar name=1000>[[ResourceLoader|load.php]]</tvar>. Turn off <tvar name=1001>{{wg|UseSiteJs}}</tvar> and <tvar name=1002>{{wg|UseSiteCss}}</tvar> to disable this functionality.</translate>}}

{{note|1=<translate><!--T:108--> If anonymous users can't view your page, neither can search engines.</translate> <translate><!--T:109--> Your site will not be indexed on Google.</translate>}}

<translate>
<!--T:110-->
Add this line to your LocalSettings.php file:
</translate>

<syntaxhighlight lang="php">
# <translate nowrap><!--T:185--> Disable reading by anonymous users</translate>
$wgGroupPermissions['*']['read'] = false;

# <translate nowrap><!--T:186--> But allow them to read e.g., these pages:</translate>
$wgWhitelistRead = [ "Main Page", "Help:Contents" ];
</syntaxhighlight>

<translate><!--T:122--> The <tvar name=1><code>{{ll|Manual:$wgWhitelistRead|$wgWhitelistRead}}</code></tvar> setting allows users to view the main page.</translate>
<translate><!--T:123--> If page names have more than one word, use a space "<tvar name=1> </tvar>" between them, not an underscore "<tvar name=2>_</tvar>".</translate>

<translate>
<!--T:124-->
In addition to the main page of such a private site, you could give access to the Recentchanges page (if you think that its content isn't private) for feed readers by adding <tvar name=2>Special:Recentchanges</tvar> to <tvar name=1><code>{{ll|Manual:$wgWhitelistRead|$wgWhitelistRead}}</code></tvar>.

<!--T:125-->
If you need to protect even the sidebar, main page, or login screen for any reason, it's recommended that you use higher-level authentication such as <tvar name=1>.htpasswd</tvar> or equivalent.
</translate>

{{Security warning 2021-12}}

{{note|1=<translate><!--T:126--> Although <tvar name=1>[[Special:Listusers]]</tvar> won't be available, it can be determined if a username is correct from Userlogin errors.</translate> <translate><!--T:127--> You may want to give a common text for <tvar name=1>[[MediaWiki:wrongpassword]]</tvar> and <tvar name=2>[[MediaWiki:nosuchusershort]]</tvar>.</translate>}}

<translate>
===Restrict viewing of certain specific pages=== <!--T:19-->
</translate>
{{Page security extension disclaimer}}

<translate><!--T:128--> To prevent anyone but sysops from viewing a page, it can simply be {{<tvar name=1>ll|Help:Deletion and undeletion</tvar>|deleted}}.</translate>
<translate><!--T:129--> To prevent even sysops from viewing it, it can be removed more permanently using <tvar name=1>{{ll|Manual:RevisionDelete}}</tvar>.</translate>
<translate><!--T:130--> To completely destroy the text of the page, it can be manually removed from the database.</translate>
<translate><!--T:131--> In any case, the page cannot be edited while in this state, and for most purposes no longer exists.</translate>

<translate><!--T:132--> To have a page act normally for some users but be invisible to others, as is possible for instance in most forum software, is a very different matter.</translate>
<translate><!--T:133--> MediaWiki is designed for two basic access modes:</translate>

<translate>
<!--T:134-->
# Everyone can view every single page on the wiki (with the possible exception of a few special pages).</translate> <translate><!--T:135--> This is the mode used by Wikipedia and its sister projects.</translate>
<translate>
<!--T:136-->
# Anonymous users can only view the Main Page and login page, and cannot edit any page.</translate> <translate><!--T:137--> This is basically the same as the above, in terms of technical implementation (just an extra check for every page view), which is why it exists.</translate> <translate><!--T:138--> This is the mode of operation used by certain private wikis such as those used by various Wikimedia committees.</translate>

'''<translate><!--T:139--> If you intend to have different view permissions than that, MediaWiki is not designed for your usage.</translate>'''
(<translate><!--T:140--> See <tvar name=1>[[phab:T3924|T3924]]</tvar>.</translate>)
<translate><!--T:141--> Data is not necessarily clearly delineated by namespace, page name, or other criteria, and there are a lot of leaks you'll have to plug if you want to make it so (see <tvar name=1>''{{ll|security issues with authorization extensions}}''</tvar> for a sample).</translate>
<translate><!--T:142--> Other wiki software may be more suitable for your purpose.</translate>
<translate><!--T:143--> You have been warned.</translate>
<translate><!--T:144--> If you must use MediaWiki, there are three basic possibilities:</translate>

<translate>
<!--T:145-->
# Set your wiki up private and whitelist specific pages that will be public with <tvar name=1><code>{{ll|Manual:$wgWhitelistRead|$wgWhitelistRead}}</code></tvar> in the <tvar name=2>LocalSetting.php</tvar> file.</translate> <translate><!--T:146--> See the section above.</translate>
<translate>
<!--T:147-->
# Set up separate wikis with a {{<tvar name=1>ll|Manual:$wgSharedDB</tvar>|shared user database}}, configure one as viewable and one as unviewable ([[<tvar name=2>#Disable anonymous reading</tvar>|see above]]), and {{<tvar name=3>ll|Help:Interwiki linking</tvar>|make interwiki links}} between them.</translate>
<translate>
<!--T:148-->
# Install a third-party hack or extension.</translate> <translate><!--T:149--> You will have to reapply it every time you upgrade the software, and it may not be updated immediately when new security fixes or upgrades of MediaWiki are released.</translate> <translate><!--T:150--> Third-party hacks are, of course, not supported by MediaWiki developers, and if you're having problems you shouldn't ask on <tvar name=1>MediaWiki-l</tvar>, <tvar name=2>#mediawiki</tvar>, or other official support channels.</translate> <translate><!--T:151--> A number of hacks are listed in <tvar name=1>{{ll|Category:Page specific user rights extensions}}</tvar>.</translate> <translate><!--T:152--> Read about <tvar name=1>{{ll|security issues with authorization extensions}}</tvar> if you plan to use one of those.</translate>

<translate>
==Restricting exporting== <!--T:20-->
</translate>
''<translate><!--T:153--> See also:</translate> {{ll|Manual:Parameters to Special:Export}}''

<translate>
<!--T:154-->
It is not possible to export the contents of a page that cannot be read since <tvar name=1>{{rev|19935}}</tvar>.

==Removing the Login link from all pages== <!--T:155-->
</translate>
<translate><!--T:156--> One can remove the login/create account link from the upper right corner of all pages, as users can still go to <tvar name=1>[[Special:SpecialPages]]</tvar> > <tvar name=2>[[Special:UserLogin]]</tvar> to login.</translate>
<translate><!--T:158--> In <tvar name=1>LocalSettings.php</tvar> use (tested with MediaWiki 1.16)</translate>

<syntaxhighlight lang="php">
function NoLoginLinkOnMainPage( &$personal_urls ){
    unset( $personal_urls['login'] );
    unset( $personal_urls['anonlogin'] );
    return true;
}
$wgHooks['PersonalUrls'][]='NoLoginLinkOnMainPage';
</syntaxhighlight>

<translate>
==Removing accounts== <!--T:159-->
</translate>
<translate><!--T:160--> If you want to completely remove access to a user, e.g. on a [[<tvar name=1>#Simple private wiki</tvar>|simple private wiki]], it's not possible to simply delete the account ({{<tvar name=2>ll|Manual:removeUnusedAccounts.php</tvar>|unless no edits have been made}}); you can {{<tvar name=3>ll|Manual:Block and unblock</tvar>|block}} it, but the user will still {{<tvar name=4>ll|Manual:Block_and_unblock#Effects_of_being_blocked</tvar>|be able}} to read pages.</translate>
<translate><!--T:161--> However, using <tvar name=1>{{ll|Extension:User Merge and Delete|nsp=0}}</tvar> extension you can merge the account in another one and delete the former; the original account will then "disappear".</translate>
<translate><!--T:162--> If you want to preserve history readability (i.e., to have edits from the user to be still shown under their name), you can create a new account e.g. with username "OriginalUserName (deactivated)" and then merge "OriginalUserName" into the former, or even use <tvar name=1>{{ll|Extension:Renameuser|nsp=0}}</tvar> extension to rename "OriginalUserName" into "AnotherUserName", then create an account under "OriginalUserName" and merge "AnotherUserName" into it: in this manner, "OriginalUserName" will be completely "usurped" (if you've set a non-null password).</translate>

<translate>
<!--T:163-->
Since MediaWiki 1.16.0, it is possible to set <tvar name=1>{{ll|Manual:$wgBlockDisablesLogin|$wgBlockDisablesLogin}}</tvar> to true to prevent access and reading to blocked users.

==Other restrictions== <!--T:164-->
</translate>
<translate><!--T:165--> You may want to have pages editable only by their creator, or ban viewing of history, or any of a number of other things.</translate>
<translate><!--T:166--> None of these features are available in an unhacked version of MediaWiki.</translate>
<translate><!--T:167--> If you need more fine-grained permissions, see the [[<tvar name=1>#See also</tvar>|#See also]] section for links to other wiki packages that are designed for this, as well as hacks that attempt to contort MediaWiki into something it's not designed to be but may work anyway.</translate>

<translate>
==See also== <!--T:21-->

<!--T:111-->
There are some related manual/help pages that may be of interest:
</translate>

*{{ll|Manual:LocalSettings.php}}
*{{ll|Manual:$wgGroupPermissions}}
*{{ll|Manual:$wgRestrictionTypes}}
*{{ll|Manual:$wgRestrictionLevels}}
*{{ll|Manual:$wgNamespaceProtection}}
*{{ll|Manual:$wgEmailConfirmToEdit}}
*{{ll|Manual:$wgNonincludableNamespaces}}
*{{ll|Manual:User rights}}
*{{ll|Help:User rights and groups}}

<translate>
<!--T:112-->
'''Other wiki software''' may have better support for fine-grained access control than MediaWiki:
</translate>

*[http://moinmo.in/HelpOnAccessControlLists MoinMoin]
*[http://twiki.org/ TWiki]
*[http://tikiwiki.org/ TikiWiki] - <translate><!--T:114--> has fully configuable access control to features and permission levels.</translate>

<translate><!--T:115--> If you want better access control but want to use MediaWiki, this is a list of '''extensions''' and hacks to allow restrictions not possible in the software proper.</translate>
<translate><!--T:116--> These hacks may be out-of-date (check the version they're for).</translate>
<translate><!--T:117--> Please don't ask in official MediaWiki support channels if something goes wrong with a third-party hack.</translate>

*{{ll|Extension:FlaggedRevs|Extension:Flagged Revisions}}
*{{ll|Extension:Moderation}}
*{{ll|Extension:Approved Revs}}
*{{ll|Extension:Lockdown}}
*{{ll|Extension:AuthorProtect}}
*{{ll|Extension:EditSubpages}} -  <translate><!--T:119--> restricts anonymous users from editing most pages</translate>
*{{ll|Extension:NSFileRepo}}

[[Category:MediaWiki configuration{{#translation:}}]]
[[Category:Configure{{#translation:}}]]
[[Category:Permission{{#translation:}}]]
[[Category:Namespace{{#translation:}}]]