MediaWiki User Groups — Sysop, Bureaucrat, Bot, Custom Groups, and Permissions

In this tutorial, you will learn about MediaWiki User Groups. We cover key concepts, practical examples, and best practices to help you master this topic.

User groups in MediaWiki define what users can do on a wiki through role-based permissions, including standard groups like sysop and bureaucrat, custom groups for specific needs, bot accounts for automation, and fine-grained permission assignment — the same system that Wikipedia uses to manage its global community of editors and administrators.

What You'll Learn

• Standard user groups and their permissions
• Creating custom user groups
• Assigning users to groups
• Setting up bot accounts
• Configuring group permissions in LocalSettings.php
• Best practices for group management

Why It Matters

Without user groups, every user on your wiki has the same permissions. Anyone can delete pages, block users, or change the site name. User groups let you create a hierarchy of trust. New users start with basic permissions. Trusted editors get additional rights. Administrators manage the wiki. Bots automate tasks. This is how wikis stay secure and manageable as they grow.

Real-World Use

A DodaTech wiki has five groups: All users can read and edit. "Trusted Editors" can patrol edits and move pages. "Documentation Managers" can delete pages and protect important documents. "Administrators" can block users and change settings. "Bots" automate backup and reporting. Each group has exactly the permissions it needs and no more.

Learning Path

flowchart LR
  A["18: Special Pages"] --> B["19: Watchlist"]
  B --> C["20: User Groups"]
  C:::current
  D["21: User Rights"]
  E["22: Email & Notifications"]
  F["23: Bots & Automation"]

  C --> D --> E --> F

  classDef current fill#38bdf8,color#0f172a,stroke-width:2px

Standard User Groups

MediaWiki comes with these built-in groups:

Group Hierarchy

Permissions accumulate. A user in multiple groups gets all permissions from all groups. Bureaucrats typically have sysop permissions plus user management. Interface-admins may not need sysop permissions.

Step 1: Understand Default Permissions

The default permissions are configured in includes/DefaultSettings.php. Key defaults:

// Everyone can read
$wgGroupPermissions['*']['read'] = true;

// Registered users can edit
$wgGroupPermissions['user']['edit'] = true;
$wgGroupPermissions['user']['createpage'] = true;
$wgGroupPermissions['user']['upload'] = true;

// Sysops get additional rights
$wgGroupPermissions['sysop']['delete'] = true;
$wgGroupPermissions['sysop']['block'] = true;
$wgGroupPermissions['sysop']['protect'] = true;
$wgGroupPermissions['sysop']['import'] = true;

These defaults are reasonable for most wikis. You override them in LocalSettings.php.

Step 2: Create a Custom Group

Create a group called "editor" with patrol and rollback rights:

// Define the group
$wgGroupPermissions['editor'] = [];

// Grant permissions
$wgGroupPermissions['editor']['patrol'] = true;
$wgGroupPermissions['editor']['rollback'] = true;
$wgGroupPermissions['editor']['move'] = true;
$wgGroupPermissions['editor']['delete'] = false;  // Editors cannot delete

Assigning Users to Custom Groups

1. Go to Special:UserRights
2. Enter the username
3. Check the groups you want to assign (e.g., "editor")
4. Give a reason: "Promoting to editor role"
5. Click "Save user groups"

Only bureaucrats can assign users to groups by default.

Step 3: Configure Permissions in LocalSettings.php

All group permissions are configured in LocalSettings.php:

// Make the wiki private — only logged-in users can read
$wgGroupPermissions['*']['read'] = false;
$wgGroupPermissions['user']['read'] = true;

// Only sysops can edit (read-only wiki for everyone else)
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['user']['edit'] = false;
$wgGroupPermissions['sysop']['edit'] = true;

// Prevent new account registration
$wgGroupPermissions['*']['createaccount'] = false;

// Allow email-only registration
$wgWhitelistAccount = [];

Group Inheritance

One group can inherit permissions from another:

// 'editor' group gets all 'user' permissions plus extras
$wgGroupPermissions['editor'] = $wgGroupPermissions['user'];
$wgGroupPermissions['editor']['patrol'] = true;

This saves duplicating permissions but means changes to user permissions also affect editor.

Step 4: Autopromotion Groups

Autopromotion groups are assigned automatically based on criteria:

// Autoconfirmed: account older than 4 days with 10+ edits
$wgAutoConfirmAge = 60 * 60 * 24 * 4;  // 4 days in seconds
$wgAutoConfirmCount = 10;               // 10 edits

Users meeting these criteria are automatically added to the autoconfirmed group. This prevents new or spam accounts from moving pages or editing semi-protected pages.

Custom Autopromotion

Configure additional automatic group promotion:

$wgAutopromote = [
    'trusted' => [
        '&',  // AND condition
        APCOND_EDITCOUNT => 100,
        APCOND_AGE => 60 * 60 * 24 * 30,  // 30 days
        APCOND_ISBOT => false,  // Not a bot
    ],
];

Users with 100+ edits and 30+ days of account age are automatically added to the "trusted" group.

Step 5: Bot Accounts

Bot accounts are user accounts used by automated scripts. They should have minimal permissions and clear identification.

Creating a Bot

1. Register a separate user account for the bot (e.g., "DodaBot")
2. Add the account to the bot group
3. Generate a bot password for API access

Bot Group Permissions

The bot group's key feature is that bot edits are hidden from RecentChanges by default:

$wgGroupPermissions['bot'] = [];
$wgGroupPermissions['bot']['bot'] = true;  // Bot flag
$wgGroupPermissions['bot']['edit'] = true;
$wgGroupPermissions['bot']['read'] = true;

Users can choose to show bot edits in RecentChanges with a filter toggle.

Bot Passwords

Bot passwords are separate from the main account password:

1. Go to Special:BotPasswords
2. Create a new bot password with specific grants
3. Use the generated username (e.g., DodaBot@DodaBot) and password in scripts

Bot passwords limit what a bot can do even if the script is compromised.

Step 6: Group Management Best Practices

Principle of Least Privilege

Give users only the permissions they need. A documentation writer does not need block rights. A bot does not need to create new accounts. Start with minimal permissions and add as needed.

Group Naming Conventions

Use clear, descriptive group names:

Good: editor, reviewer, documentation-manager, bot
Bad: group1, power-user, special-staff

Separation of Duties

Separate sensitive permissions across groups:

• Sysop: Technical operations (delete, block, protect)
• Bureaucrat: User management (group assignment)
• Editor: Content operations (patrol, rollback)

No single group should have all powers. This prevents a single compromised account from taking over the wiki.

Step 7: Viewing Group Members

Use Special:ListUsers to see users in each group:

Special:ListUsers/sysop    — List all administrators
Special:ListUsers/bot      — List all bot accounts
Special:ListUsers/editor   — List all editors

The page shows each user's registration date, edit count, and groups.

What You Learned

• Standard groups include * (all), user, autoconfirmed, sysop, bureaucrat, bot
• Custom groups are defined in LocalSettings.php with $wgGroupPermissions
• Users can be in multiple groups with cumulative permissions
• Autopromotion assigns groups automatically based on edit count and age
• Bot accounts use separate passwords with limited grants
• Principle of least privilege guides group design

In the next lesson, you'll learn about fine-grained user rights management.

Common Mistakes

Practice Questions

1. What are the five standard user groups in MediaWiki and what is the primary permission of each?
2. How would you create a custom group called "reviewer" that can patrol edits and rollback changes but cannot delete pages?
3. What is the difference between autoconfirmed and custom autopromotion?
4. Challenge: Build a complete permission system for a company wiki. Create three custom groups: "Writer" (can create and edit pages), "Reviewer" (can patrol and rollback), and "Publisher" (can delete and protect). Configure autoconfirmed for accounts older than 7 days with 20+ edits. Create a bot group with a bot password for a "ReportBot" that runs weekly reports. Document the permission structure on a "Wiki Permissions" page with a table showing each group and its permissions. Verify by creating test accounts in each group and confirming the permissions work as designed.

FAQ

Mini Project

Goal: Design and implement a user group structure for a team wiki.

1. Define three custom groups: "Contributor," "Senior Editor," "Documentation Lead"
2. Configure permissions:
   • Contributor: edit, createpage, upload
   • Senior Editor: +patrol, +rollback, +move
   • Documentation Lead: +delete, +protect, +import
3. Set up autoconfirmed for accounts older than 3 days with 5+ edits
4. Create a bot account called "WikiStatsBot" with a bot password
5. Add a group called "intern" with read-only access (view pages, no editing)
6. Create test users for each group and verify permissions
7. Document the group structure on a "User Groups" page with tables
8. Verify that group membership changes take effect immediately

What's Next

User groups define broad roles. But sometimes you need finer control over specific permissions.

Continue to Lesson 21: User Rights — learn about fine-grained permission management, blocking users, and the user rights management interface.