MediaWiki User Permissions & Security — Managing Access and Preventing Spam

In this tutorial, you'll set up user accounts, configure permissions, and secure your MediaWiki wiki. This is Lesson 7 of our project: Build Your Own Documentation Wiki.

What You'll Build Today

By the end of this lesson, your wiki will have:

• A second user account (a "team member")
• Different user groups with different permissions
• CAPTCHA protection for new registrations
• Email verification required for editing
• Your wiki configured for team use

Your wiki transforms from a private sandbox into a collaborative workspace.

Why Permissions Matter

A wiki without permissions is like a house with no locks:

• Anyone can delete pages
• Spam bots fill your wiki with garbage
• You can't control who sees sensitive information

MediaWiki's permission system lets you decide:

• Who can read pages
• Who can edit pages
• Who can create new pages
• Who can delete or protect pages

Step-by-Step: Set Up Users and Permissions

Step 1: Create a Second User Account

Let's create a test account to see how permissions work from a non-admin perspective.

1. Go to Special:CreateAccount on your wiki (Or click "Log in" → "Create an account")

2. Fill in:

   • Username: TestUser
   • Password: testpassword123
   • Confirm password: same
   • Email: (leave blank for now)

3. Click "Create your account"

Step 2: Understand the Default User Groups

MediaWiki comes with these built-in groups:

Click around your wiki while logged out to see what anonymous users can see. If you set up a private wiki during installation, anonymous users can't read anything.

Step 3: Log In as TestUser and Try Editing

1. Log out of your admin account
2. Log in as TestUser
3. Try editing the API Reference page

If editing works, permission is granted. But we want more control. Let's configure finer-grained permissions.

Step 4: Configure Permissions in LocalSettings.php

Open LocalSettings.php in a text editor. Add these lines at the end (before the closing <?php or at the bottom of the file):

// Require login to read any page
$wgGroupPermissions['*']['read'] = false;
$wgGroupPermissions['user']['read'] = true;

// Only autoconfirmed users can edit
$wgGroupPermissions['user']['edit'] = false;
$wgGroupPermissions['autoconfirmed']['edit'] = true;
$wgAutoConfirmAge = 86400; // 24 hours in seconds

// Allow admins to delete and protect pages
$wgGroupPermissions['sysop']['delete'] = true;
$wgGroupPermissions['sysop']['protect'] = true;
$wgGroupPermissions['sysop']['block'] = true;

// Prevent new users from creating pages
$wgGroupPermissions['user']['createpage'] = false;
$wgGroupPermissions['autoconfirmed']['createpage'] = true;

Let's understand each setting:

Step 5: Test the New Permissions

1. Refresh your wiki while logged out — you should see a login page instead of your wiki
2. Log in as TestUser — you can read but editing may be restricted (if TestUser was just created, it's not autoconfirmed yet)

Step 6: Add Anti-Spam Protection

Now let's protect your wiki from spam bots. Spam bots automatically create accounts and post garbage. Here's how to stop them.

Add CAPTCHA:

Download the ConfirmEdit extension (if you followed Lesson 2, it should be included with MediaWiki). Add this to LocalSettings.php:

wfLoadExtension( 'ConfirmEdit' );
$wgCaptchaTriggers['edit'] = true;
$wgCaptchaTriggers['create'] = true;
$wgCaptchaTriggers['addurl'] = true;

// Simple math captcha (no external services needed)
$wgCaptchaClass = 'Captcha\SimpleCaptcha\SimpleCaptcha';

The SimpleCaptcha asks users to solve a math problem (e.g., "What is 7 + 3?"). It's simple but effective against automated bots.

Require email confirmation:

$wgEmailConfirmToEdit = true;

This forces new users to verify their email address before they can edit.

Step 7: Block a User (Test)

As an admin, you can block users who violate wiki rules. Let's see how:

1. Log in as your admin user
2. Go to Special:Block
3. Enter TestUser in the username field
4. Reason: Testing the block feature
5. Expiry: Select "1 hour"
6. Click "Block this user"

Now log out and try logging in as TestUser. You'll see a message: "Your username or IP address has been blocked."

To unblock: Go to Special:Unblock, enter TestUser, and unblock.

What You Learned

• User groups control permissions hierarchically
• $wgGroupPermissions arrays control read, edit, create, and admin actions
• Autoconfirmed status prevents new accounts from editing immediately
• CAPTCHA blocks automated spam bots
• Email verification adds another layer of security
• The block tool stops problematic users temporarily or permanently

In the next lesson, you'll extend your wiki's functionality with extensions.

Common Errors

FAQ

Can I make certain pages read-only for everyone except admins?

Yes, use page protection. Log in as admin, go to the page, click the "Protect" tab, and select which groups can edit. This is useful for critical pages like the Main Page or legal documents.

How do I create a custom user group?

Add to LocalSettings.php:

$wgGroupPermissions['editor']['edit'] = true;
$wgGroupPermissions['editor']['delete'] = false;

Then assign users to this group via Special:UserRights. You need to be a bureaucrat to assign groups.

What's the difference between sysop and bureaucrat?

• Sysop: Can delete pages, block users, protect pages — the daily admin tasks
• Bureaucrat: Can promote other users to sysop or bureaucrat — the top-level role

A wiki typically has 1-2 bureaucrats and several sysops.

How do I make my wiki completely public (anyone can edit)?

The default installation is already public. If you changed permissions, revert them:

$wgGroupPermissions['*']['read'] = true;
$wgGroupPermissions['*']['edit'] = true;
$wgGroupPermissions['user']['edit'] = true;

Be aware: a fully public wiki will attract spam. Always have CAPTCHA and email verification enabled.

Can I see who changed what on my wiki?

Yes. Special:RecentChanges shows every edit in real-time. Special:Log shows admin actions (blocks, deletions, protections). Both are accessible from the sidebar.

What's Next

Your wiki is now secure with user accounts and permissions. But we can make it more powerful.

Continue to Lesson 8: Extensions — Adding Features to Your Wiki — install VisualEditor for WYSIWYG editing, Scribunto for Lua templates, and more.