Securing MediaWiki User Privacy: How To Hide Email Addresses And Block Email Harvesting

Hiding email addresses on a MediaWiki installation requires configuring core privacy variables within the LocalSettings.php file, restricting user-to-user communication rights, and masking personal preferences across the public interface. By turning off public user email features and revoking administrative email view permissions from default groups, system operators can prevent automated scraping bots and unauthorized users from harvesting sensitive contact details. Establishing these server-level configurations ensures full compliance with global data privacy mandates while maintaining essential system notifications.

Pre-Configuration Audit & System Requirements

Before modifying system files or altering user permission arrays, wiki administrators must perform an architecture audit to determine how email privacy choices impact system messaging. MediaWiki handles user email details through two main paths: internal notifications (such as password resets and watchlist changes) and public-facing features (such as user profile settings, user lists, and web-based email forms). Securing these paths requires direct access to the application filesystem and database configuration parameters.

Operational Prerequisites Checklist

• Essential Gear & Tools: File Transfer Protocol (SFTP) client or Secure Shell (SSH) terminal access, a plain text editor capable of handling UTF-8 encoding, and a web browser with developer tools to test API outputs.
• Mandatory Prerequisites: Superuser access to the web server hosting the MediaWiki installation, write permissions for the main configuration file located at the root directory, and an active administrative account with bureaucratic privileges on the target wiki.
• Database Safety Standard: A complete MySQL/MariaDB database backup executed via command line utilities or database management tools prior to editing global parameters.
• Estimated Benchmarks: Duration of 15 to 30 minutes for standard deployments; financial cost is zero as all controls use native MediaWiki core capabilities.

Step-by-Step Protocol to Hide Email on MediaWiki

Step 1: Suppress Email Display in Preferences via LocalSettings.php

The primary method to ensure user email addresses remain hidden from public profile views, specialized list pages, and API outputs involves updating the main system configuration file. The file named LocalSettings.php sits in the root directory of your MediaWiki installation and stores global php variables that govern core platform behaviors.

To hide email fields within user profiles:

1. Open your terminal or SFTP client and navigate to the directory containing your MediaWiki installation.
2. Locate and open the LocalSettings.php file using a text editor.
3. Scroll to the bottom of the file to append your custom configuration rules.
4. Locate or declare the hidden preferences array assigned to the variable dollar sign wgHiddenPrefs.
5. Add the string entry 'email' to the dollar sign wgHiddenPrefs array. This removes the email address field from public view inside Special:Preferences and prevents non-administrative users from viewing email parameters on Special:ListUsers.
6. Add the string entry 'realname' to the dollar sign wgHiddenPrefs array if you also want to protect real name identities tied to user accounts.

When this array is configured, MediaWiki omits the email field from profile displays across all standard skins and prevents user account APIs from serializing email addresses in external response payloads.

Pro-Tip: Always verify syntax balance when appending arrays in PHP. Missing a trailing semicolon or misplaced bracket in LocalSettings.php will result in an HTTP 500 Internal Server Error across your entire wiki instance.

Step 2: Disable User-to-User Web Email Interfaces

MediaWiki includes a feature that permits registered accounts to send messages to one another through a web form located at Special:EmailUser. While this tool conceals the recipient's actual email address during initial form delivery, sending a reply reveals the recipient's personal inbox address. Disabling this interface entirely eliminates the risk of address discovery via header extraction.

1. Open the LocalSettings.php file in your text editor.
2. Locate the global variable dollar sign wgEnableUserEmail.
3. Set the value of the dollar sign wgEnableUserEmail variable to explicit boolean false.
4. Save the file and reload your MediaWiki instance.

By setting this variable to false, MediaWiki completely removes the link labeled "Email this user" from user page sidebars and disables navigation access to Special:EmailUser. Essential backend system notifications, such as automated password reset requests, continue operating normally through the dollar sign wgEnableEmail global setting.

Step 3: Restrict Email View Permissions across User Groups

MediaWiki uses a granular rights system managed through the dollar sign wgGroupPermissions array. By default, certain permissions allow trusted user roles or administrators to view user details. Restricting these rights ensures that email data cannot be queried by compromised accounts or lower-tier user groups.

1. Locate the rights definition section in your LocalSettings.php file.
2. Target the implicit global group identified by an asterisk symbol, which governs rights for all visitors including unauthenticated users.
3. Explicitly assign false to the viewuseremail permission for the asterisk group within the dollar sign wgGroupPermissions array.
4. Target the standard registered user group key named 'user' within the dollar sign wgGroupPermissions array and set viewuseremail to false.
5. If administrative oversight is required, explicitly assign true to the viewuseremail permission key only for the 'sysop' or 'bureaucrat' groups.

Warning: Assigning the viewuseremail privilege to broad user groups exposes user account data to potential automated extraction via custom API queries or scraped special pages. Keep this permission restricted to core system administrators.

Step 4: Hide Email Requirements on Account Creation

To maximize privacy, user registration workflows should not mandate an email address unless account recovery is strictly enforced by site policy. Removing the mandatory requirement prevents storing unnecessary personal data in the backend database.

1. Search LocalSettings.php for the variable dollar sign wgEmailConfirmToEdit. Ensure this is set to false if you do not require verified emails for editing actions.
2. To make email optional on the creation form, verify that dollar sign wgRequireEmailForOptIn is set to false.
3. Modify the default options array dollar sign wgDefaultUserOptions to set 'showemail' to zero or false, ensuring new accounts do not opt into public disclosures by default.

Step 5: Sanitize Wikitext Content and User Signatures

System-level settings prevent MediaWiki from showing stored email addresses, but they do not stop users from typing plain text email addresses on discussion pages or within custom signatures.

1. Implement regular expression patterns within the MediaWiki AbuseFilter extension to scan incoming page edits for email formatting standards.
2. Configure the AbuseFilter rule to warn users or block edits that contain plain text email syntax (such as user@domain.com).
3. Provide a site-wide notice encouraging users to communicate via user talk pages rather than posting direct contact info in article wikitext.

Comparative Evaluation of MediaWiki Email Privacy Configurations

Common MediaWiki Email Exposure Risks & Remediation

API Queries Expose User Metadata to Web Crawlers

• Root Cause: The default MediaWiki Action API allows public queries via the userinfo or users modules. If permissions are misconfigured, external scripts can read user metadata through automated web requests.
• Actionable Fix: Open LocalSettings.php and ensure the permission viewuseremail is set to false for both the asterisk visitor group and the registered user group inside the dollar sign wgGroupPermissions array. Test the output using a web browser by querying api.php with action=query and list=users to confirm email properties do not appear in the JSON output.

Plain Text Email Addresses Embedded in Discussion Pages

• Root Cause: Contributors manually paste email addresses into user talk pages, signatures, or article content, bypassing core PHP system filters completely.
• Actionable Fix: Install and enable Extension:AbuseFilter. Create a new filter rule targeting the variable added_lines that matches standard email syntax via regular expressions. Set the filter action to 'warn' or 'disallow' to notify users before their edit is saved to the revision history.

Outgoing System Notification Headers Leak Server Details

• Root Cause: Automated account emails (such as password resets) use default server values for the return path or sender address, revealing administrative account names or internal server hostnames.
• Actionable Fix: Define custom values for the global variables dollar sign wgPasswordSender and dollar sign wgEmergencyContact in LocalSettings.php. Use a non-identifying generic address, such as standard no-reply at your wiki domain, to hide internal infrastructure details.

Frequently Asked Questions

Can users still receive account password reset messages if I hide their email on MediaWiki?

Yes. Suppressing email displays in user profiles or turning off inter-user email forms does not disrupt core transactional messaging. As long as the global variable dollar sign wgEnableEmail remains set to true, the MediaWiki system can process password resets and system updates while keeping addresses hidden from the public front-end interface.

How do I hide the email address requirement during new user account creation?

To make email optional during registration, set the dollar sign wgRequireEmailForOptIn variable to false in your LocalSettings.php file. You can also hide the preference field entirely by assigning the string value 'email' to the dollar sign wgHiddenPrefs array, removing the input box from the user sign-up form.

Does hiding email addresses affect notifications for watched pages?

No. Watchlist email notifications rely on internal system triggers and background job queues managed directly by the database engine. Setting preferences to hide user emails or restricting profile visibility has no effect on personalized watchlist alerts delivered to confirmed user addresses.

What is the difference between $wgEnableEmail and $wgEnableUserEmail in MediaWiki?

The dollar sign wgEnableEmail variable serves as the master switch for all outgoing mail functions, including automated notifications and password resets. In contrast, dollar sign wgEnableUserEmail controls only the web form feature located at Special:EmailUser, which allows users to send emails to one another through the wiki interface.

Secure Your MediaWiki Infrastructure Today

Auditing your MediaWiki configuration file ensures complete control over user privacy, shielding your community from unwanted spam and automated data collection. Take time today to update your server configuration, adjust system rights, and verify that personal contact details remain protected across every page of your wiki ecosystem.