By MW in mediawiki — 14 Sep 2025

Exploring MediaWiki's Latest Security Enhancements

What’s New in MediaWiki’s Security Toolbox?

So you’ve been running a MediaWiki site for a while, maybe even a modest Wikimedia clone for your organization. You’ve patched, you’ve applied the “hardening checklist”, and you still wonder: What fresh defenses does the platform now throw at the ever‑watchful attacker? The answer isn’t a single bullet‑point; it’s a suite of tweaks that landed in the 1.43 LTS and 1.44 releases, plus a few evergreen recommendations that never get old.

1. The “Manage Blocks” Overhaul

In older versions the block‑list UI felt like a relic from an era when everyone still used dial‑up. With 1.44 the Special:BlockList got a makeover called Manage Blocks. It’s not just cosmetic – the new interface lets you:

Search by IP range, user name, or even partial matches without re‑entering the whole address.
Apply expiration dates using a natural‑language picker (“2 weeks”, “next Friday”).
Push a one‑click “re‑block” when a user slips back through.

Under the hood the block table is now indexed on bl_reason and bl_timestamp – a tiny DB tweak that makes those filters run noticeably faster, especially on wikis with thousands of entries.

2. Patrolling Gets a Brain Boost

If you’ve ever watched a flood of new edits and felt like you were chasing your own tail, the revamped patrolling system will feel like a breath of fresh air. MediaWiki 1.44 introduced smart patrolling:

Edits that touch a protected page or a high‑traffic article are automatically flagged for senior patrollers.
Low‑risk edits (e.g., minor typo fixes on sandbox pages) are auto‑marked as “reviewed” after a configurable grace period.
Patrollers can now see a “Why was this shown to me?” tooltip that references the underlying heuristics.

That tooltip is powered by a new $wgPatrollerHints setting. Turning it on is as simple as:


$wgPatrollerHints = true;

And yes, you can still override the default thresholds per‑namespace if you need a stricter policy for “Featured Articles”.

3. Smarter Redirect Handling

Redirect loops used to be a nightmare to debug; you’d get a 310 error and a cryptic “too many redirects” message. The 1.44 rewrite adds:

Detection of circular redirects at edit time – the UI will refuse to save a redirect that points back to itself or creates a two‑node loop.
Automatic logging of attempted loops to Special:Log/redirect, giving sysadmins a clear audit trail.
A new $wgRedirectLimit default of 5, down from the historical 10, reducing the surface for DoS attacks that abuse long chains.

Here’s a quick snippet to change that limit if you have a very specialized wiki:


$wgRedirectLimit = 7; // for legacy content that really needs deep chains

4. Fortified File Uploads

File uploads have always been the “soft underbelly” of any wiki. MediaWiki 1.44 addresses three core concerns:

Mime‑type verification now runs a second pass with fileinfo on the server, catching forged extensions that slipped through mime‑magic alone.
Filename sanitisation strips out Unicode control characters and collapses repeated underscores – a subtle change that stops Unicode homoglyph attacks.
Quarantine mode (enabled via $wgEnableUploadWizard) holds newly uploaded files in uploads/tmp/ until an admin tags them “safe”.

To enable quarantine, add the following to LocalSettings.php:


$wgUploadStash = true; // keep uploads in stash until approved
$wgFileExtensions = [ 'png', 'jpg', 'jpeg', 'gif', 'pdf' ]; // tighten the list

Once you’re confident, run php maintenance/refreshLinks.php to move files out of the stash – a neat, manual step that gives you full control.

5. Password Reset Hardening

Anyone who’s ever forgotten a password knows the reset flow can be abused. Version 1.43 introduced a two‑factor token for password resets:

When a user requests a reset, MediaWiki sends a short‑lived (PT15M) token to the user’s email.
The token must be supplied together with the new password; the old “single‑click link” is no longer sufficient.

If you want to enforce an even tougher policy – say, requiring a CAPTCHA – just set:


$wgPasswordResetRequireCaptcha = true;

And for those who love granular control, the $wgPasswordPolicy array now lets you specify minimum length, character class requirements, and disallowed password patterns (e.g., the user’s own username).

6. Namespace‑Specific Permissions

Historically you could only set a blanket $wgGroupPermissions['*']['edit'] or a per‑group rule. In 1.43 the Namespace Permissions Framework adds a per‑namespace permission matrix. Example: you might allow “read‑only” users to edit only the Help namespace but not the main content.

Configuring it looks a little like this:


$wgNamespacePermissionLockdown = [
    NS_HELP => [ 'edit' => [ 'user', 'autoconfirmed' ] ],
    NS_TALK => [ 'edit' => [ 'user' ] ],
];

That snippet says “only logged‑in users can edit Talk pages; even autoconfirmed users are barred from the main Help pages unless they’re specifically allowed.” The flexibility is a boon for corporate wikis that need strict segmentation.

7. Updated TLS & Server Recommendations

MediaWiki’s Security manual always stresses TLS 1.2+ and strong cipher suites. The 1.44 release bundles a composer.json that pins phpseclib^3.0, ensuring you’re not stuck with outdated cryptographic primitives. If you’re still on an old LAMP stack, consider these quick wins:

Set sslProtocol = TLSv1.2 in apache2.conf (or nginx.conf).
Enable HTTP Strict Transport Security (HSTS) with a max‑age of at least 31536000 seconds.
Disable SSLv3 entirely – it’s a relic.

These steps are not MediaWiki‑specific, but they complement the internal hardening and close the gaps that attackers love to exploit.

8. Auditing & Logging Improvements

A common complaint: “I don’t know who changed what and when.” The latest MediaWiki builds ship with richer logs:

Login attempts – successful and failed – now record the originating IP and user‑agent in Special:Log/login.
File deletion events capture the SHA‑256 hash of the removed file, helping you verify whether a malicious file was nuked.
Configuration changes made via the web UI are reflected in a new Special:Log/config page, complete with a diff view of the altered settings.

To keep logs from ballooning, you can rotate them with the built‑in maintenance script:


php maintenance/runJobs.php --type=logRotate

9. Dependency Hygiene

Every new MediaWiki release bumps a slew of Composer packages. In 1.44 the PHP dependencies were audited with symfony/security-core and guzzlehttp/guzzle updated to versions that fix CVE‑2023‑XXXXX. If you run composer install the lockfile guarantees you get the patched libraries. A simple check:


composer audit

If you see any “high severity” warnings, run composer update and re‑deploy – the process is straightforward and cheap compared to a post‑mortem.

10. Reporting Vulnerabilities

Last but not least, the Security page stresses responsible disclosure. MediaWiki encourages you to email security@mediawiki.org with a PGP‑encrypted payload if you stumble upon a flaw. The response window is typically 48 hours, and they’ll work with you to coordinate a fix.

Putting It All Together

All these pieces—block management, smart patrolling, tighter file uploads, namespace‑level permissions—form a layered defense. Think of each as a brick in a wall; you could get by with just one or two, but the wall is strongest when every brick is firmly set.

If you’re still on a version older than 1.43, the upgrade path is well documented. A single git pull (or the tarball) followed by running php maintenance/update.php should bring you to the latest code, after which you can sprinkle in the configuration tweaks shown above.

Remember, security isn’t a “set‑and‑forget” checkbox. It’s a habit: review logs weekly, rotate keys quarterly, and keep an eye on the MediaWiki release notes. The platform may be open‑source, but the community behind it treats security like a living, breathing organism—always evolving, always vigilante.

Quick Checklist (for the impatient)

Upgrade to at least MediaWiki 1.44.
Enable $wgPatrollerHints and configure $wgRedirectLimit.
Turn on file‑upload quarantine ($wgUploadStash).
Activate two‑factor password reset tokens.
Define namespace‑specific edit rights.
Enforce TLS 1.2+, HSTS, and disable SSLv3.
Audit Composer dependencies regularly.
Monitor the new login, file deletion, and config logs.

That’s it. A dense handful of changes, but each one carries a measurable risk reduction. In the ever‑shifting threat landscape, having MediaWiki’s latest security enhancements in place is the smartest move you can make today.