MediaWiki User Rights — Fine-Grained Permissions, Blocking, and User Rights Management

In this tutorial, you will learn about MediaWiki User Rights. We cover key concepts, practical examples, and best practices to help you master this topic.

User rights in MediaWiki are the individual permissions that control every action on a wiki, from blocking users with partial blocks and IP range blocks to managing individual rights through the Special:UserRights interface — the granular control system Wikipedia administrators use to enforce policies and protect the encyclopedia.

What You'll Learn

• Understanding individual user rights
• Blocking users, IP addresses, and IP ranges
• Creating partial blocks (page-specific and namespace-specific)
• Using the Special:UserRights interface
• Viewing and revoking permissions
• Configuring permission inheritance

Why It Matters

User groups give you broad roles, but user rights give you precision. Sometimes you need to block a user from editing one page without blocking them from the whole wiki. Sometimes you need to revoke a specific permission without changing a user's group membership. Understanding individual rights lets you manage users with surgical precision rather than broad strokes.

Real-World Use

A DodaTech wiki contributor repeatedly adds unsourced claims to the "DodaBrowser" page. Rather than blocking the entire account, the admin issues a partial block that prevents editing only the "DodaBrowser" page for 48 hours. The user can continue contributing elsewhere. Another user loses their upload permission after repeatedly uploading copyrighted images. The admin revokes the upload right for that specific user without changing their group.

Learning Path

flowchart LR
  A["19: Watchlist"] --> B["20: User Groups"]
  B --> C["21: User Rights"]
  C:::current
  D["22: Email & Notifications"]
  E["23: Bots & Automation"]
  F["24: User Preferences"]

  C --> D --> E --> F

  classDef current fill#38bdf8,color#0f172a,stroke-width:2px

Individual User Rights

Every permission in MediaWiki can be granted or revoked at the user level. While groups define permissions for a class of users, individual rights override group permissions for a specific account.

Granting Individual Rights

Use Special:UserRights to grant a specific right to a user:

1. Go to Special:UserRights
2. Enter the username
3. Under "Individual rights," select the right to add
4. Enter a reason
5. Click "Save"

Available Individual Rights

Individual rights correspond to the same permission keys used in $wgGroupPermissions:

read, edit, createpage, createtalk, move, upload, delete,
undelete, protect, block, rollback, patrol, editinterface,
editusercss, edituserjs, import, userrights, bot, suppressredirect

Each right grants a specific capability independent of group membership.

Blocking Users

Blocking prevents a user from editing or performing other actions. Only users with the block right (typically sysops) can block.

Block Form

Go to Special:Block and enter:

• Username or IP address: Who to block
• Expiration: Duration (1 hour, 1 day, 1 week, 1 month, indefinite)
• Reason: Why the block is being issued (required)
• Options:
  • Block account creation
  • Prevent user from sending email
  • Prevent user from editing their own talk page
  • Automatically block the last IP address used

Block Expiration Options

1 hour, 2 hours, 6 hours, 1 day, 3 days, 1 week,
2 weeks, 1 month, 3 months, 6 months, 1 year, indefinite

Custom durations are also supported: 2 hours, 90 minutes, 2026-12-31.

What Happens When Blocked

A blocked user sees a block notice when trying to edit:

Your username or IP address has been blocked.
Block reason: Disruptive editing
Blocked by: Admin
Expires: 1 week

The user cannot edit until the block expires or is removed.

IP Address Blocks

Blocking an IP address prevents anyone using that IP from editing. This is used when an anonymous user vandalizes.

IP: 192.168.1.100
Expiration: 24 hours
Reason: Vandalism

Anonymous-Only Blocks

Block only anonymous users on an IP, allowing registered users on that IP to edit:

☑ Allow registered users to edit from this IP

This is helpful when blocking a shared IP (school, library, office) where some users are legitimate.

IP Range Blocks

Block an entire range of IP addresses with CIDR notation:

192.168.0.0/24    — Blocks 192.168.0.0 through 192.168.0.255
10.0.0.0/16       — Blocks 10.0.0.0 through 10.0.255.255

CIDR Range Limits

MediaWiki limits IP range blocks to /16 for IPv4 and /19 for IPv6 by default. Larger ranges can block thousands of legitimate users.

// Allow larger range blocks (use with caution)
$wgBlockCIDRLimit = [
    'IPv4' => 16,
    'IPv6' => 19,
];

When to Use Range Blocks

• Persistent vandalism from a shifting IP on the same subnet
• Bots attacking from a cloud provider's IP range
• School or corporate networks where abuse originates

Never block a range larger than /24 without understanding who else uses that range.

Partial Blocks

Partial blocks restrict editing on specific pages or namespaces instead of blocking the entire wiki. Available in MediaWiki 1.38+.

Page-Specific Block

Block a user from editing a single page:

Block target: Username
Block type: Partial
Pages to block: DodaBrowser
Expiration: 48 hours
Reason: Edit warring on DodaBrowser

The user can edit every other page on the wiki except "DodaBrowser."

Namespace-Specific Block

Block a user from editing in a specific namespace:

Block type: Partial
Namespaces to block: File
Reason: Uploading inappropriate files

The user can edit all other namespaces but cannot upload or edit file pages.

Combining Restrictions

Block both pages and namespaces:

Pages to block: [DodaBrowser, DodaSync]
Namespaces to block: [File (NS_FILE)]

Use Cases for Partial Blocks

• Edit warring on a specific article
• Uploading inappropriate files (block File namespace)
• Disrupting a specific discussion (block Talk namespace)
• Vandalizing a specific template (block Template namespace)

Unblocking Users

Manual Unblock

Go to Special:Unblock or click "Unblock" from the block notice:

1. Enter the username or IP address
2. Enter a reason for unblocking
3. Click "Unblock"

Automatic Expiry

Blocks expire automatically based on the duration set. The user does not need to request unblocking.

Modifying a Block

Change block parameters without removing it:

1. Go to Special:BlockList
2. Find the block entry
3. Click "Modify"
4. Change the duration, reason, or restriction type
5. Save

Viewing Block List

Special:BlockList shows all active blocks:

Username/IP      | Expires        | Blocked by | Reason           |
─────────────────|────────────────|────────────|──────────────────|
ExampleUser      | 2026-07-05     | Admin      | Vandalism        |
192.168.1.100    | 2026-06-29     | Admin      | Spam             |
192.168.0.0/24   | 2026-12-31     | Admin      | Range block      |

Filters allow searching by username, IP range, or block type.

Special:UserRights Interface

Special:UserRights is the central interface for managing user permissions.

Granting and Revoking Permissions

Enter a username and you see:

User: ExampleUser
Groups:
  ☑ user (inherited)
  ☐ sysop
  ☐ bureaucrat
  ☐ bot
  ☐ editor (custom)

Individual rights:
  ☐ patrol
  ☐ rollback
  ☐ delete

Reason for change: Promoting to editor

Check boxes to add groups or rights, uncheck to remove. The reason is logged in the rights log.

Viewing User's Effective Permissions

Special:UserRights also shows a summary of all permissions a user has, including inherited permissions from groups. This is useful for debugging why a user can or cannot do something.

Permission Inheritance

Permissions follow this precedence:

1. Explicit grant: If a user is directly granted a right, they have it
2. Group inheritance: If any group the user belongs to has the right, they have it
3. Implicit deny: If no group or individual right grants it, they cannot do it

Override Rules

Group A has: edit, upload
Group B has: edit, delete
User in both groups: edit, upload, delete  (all permissions from both)

User has individual: patrol = true
Even if no group grants patrol, the user can patrol.

Revoking Individual Rights

To remove a right that a user gets from a group, you must either:

1. Remove the user from the group
2. Override at the user level (cannot be done in standard MediaWiki)

MediaWiki does not support negative permissions. If a user is in a group, they get all the group's permissions. The only exception is using the UserMerge extension or custom hooks.

What You Learned

• Individual user rights override group permissions
• Blocks can target users, IP addresses, or IP ranges
• Partial blocks restrict editing on specific pages or namespaces
• Special:UserRights manages group membership and individual rights
• Blocks have configurable duration, reason, and restrictions
• Permission inheritance accumulates from all groups and individual grants

In the next lesson, you'll learn about email and notification systems.

Common Mistakes

Practice Questions

1. What is the difference between a full block and a partial block?
2. When would you use an IP range block instead of blocking individual IPs?
3. How does permission inheritance work when a user belongs to multiple groups with overlapping permissions?
4. Challenge: Set up a comprehensive blocking Strategy. Create 3 user accounts: "Vandal", "Disruptor", and "Spammer". From an admin account, issue the following blocks: Block "Vandal" with an indefinite full block. Block "Disruptor" with a 48-hour partial block on two specific pages. Block "Spammer" with a 1-week block that prevents account creation and email. Test each block by attempting to edit from the blocked accounts. Verify the blocks appear on Special:BlockList. Create a page called "Blocking Policy" that documents when each block type should be used. Finally, unblock all three accounts and verify they can edit again.

FAQ

Mini Project

Goal: Implement a complete blocking and user rights management system.

1. Create 4 test user accounts: Editor1, Editor2, Uploader, AnonymousUser
2. Configure automatic user rights for Editor1 (grant patrol and rollback directly)
3. Issue blocks from an admin account:
   • Full block on Editor2 for 24 hours (simulated vandalism)
   • Partial block on Uploader, restricting File namespace only
   • IP block on a test IP address (192.168.1.50 for 1 hour)
   • Range block on 10.0.0.0/24 for anonymous users only (30 minutes)
4. Verify each block works as expected
5. Use Special:BlockList to review all active blocks
6. Use Special:UserRights to view and modify permissions
7. Modify the partial block to add an additional page restriction
8. Unblock all test accounts
9. Create a "User Rights Reference" page documenting the rights system

What's Next

User rights control what users can do. Now let's look at how users communicate and receive notifications.

Continue to Lesson 22: Email & Notifications — learn about email confirmation, Echo notifications, and digest settings.