Page MenuHomePhabricator

Update temporary account creation rate limits
Closed, ResolvedPublic

Description

Summary

Tighten the temporary account creation rate limits to reduce the amount of abuse and overall volume of temporary account creation, while still making it easy for good faith anonymous edits to be made.

Background

We have received persistent feedback from enwiki community members about the unexpectedly high number of temporary accounts making good- and bad-faith edits on the platform.

While our analysis shows that most temporary accounts are associated with 1 IP address, and that “clusters” of temporary accounts are comparatively uncommon, the absolute number of them, and the size that they can reach, are still causing issues for users who fight vandalism.

This includes both bad-faith editors who deliberately try to avoid bans and detection, as well as good-faith editors who (either mistakenly, or out of an attempt to preserve privacy) make a new temporary account per-edit. Both kinds of clusters cause significant overhead for anti-vandalism work.

To deal with this, we want to tighten temporary account creation rate limits to reduce the volume of unnecessary temporary account creations, while ensuring that good faith contributions can continue to be made. There are two scenarios we aim to impact:

  • abuse from users who clear cookies, change browsers, etc and generate multiple temporary accounts in a day, and dozens over the course of a week. We want to limit this avenue for abuse
  • good faith users who make dozens of good contributions via incognito windows, and frequently lose their temporary accounts as a result. We want to nudge these users towards creating accounts
Acceptance criteria
  • Lower the 6 per day limit to 2 temp account creations per day
  • Introduce a new limit of 4 temp account creations per week
  • Introduce a new limit of 6 temp account creations per month
  • No change to the 1 per 10 minute cool off period rate limit
  • These limits are global in nature and should apply to all wikis

Event Timeline

Niharika triaged this task as Medium priority.

Allow me to express my doubts.
If the limits are defined in this way, what will be done regarding public computers? In a single day, dozens of people may use the same computer, and it is not unreasonable that more than two of them want to make some change in wikipedia. Since each one uses a guest browser, the third person who wishes to edit will no longer be able to do so.
Additionally, there could also be an issue on a personal computer for people who use a guest window.

Allow me to express my doubts.
If the limits are defined in this way, what will be done regarding public computers? In a single day, dozens of people may use the same computer, and it is not unreasonable that more than two of them want to make some change in wikipedia. Since each one uses a guest browser, the third person who wishes to edit will no longer be able to do so.
Additionally, there could also be an issue on a personal computer for people who use a guest window.

Thanks for your comment, @neriah. Users in those scenarios you identified would potentially be impacted (assuming multiple logged out edits happen, which is a more rare occurrence), and that is why we have revised the rate limit message (T412105) to point users to the account creation workflow. The Growth team is going to improve on this workflow in T410386: Prompt user to create a regular account after temp account creation rate limit trip.

From looking at the data of temp account creations in November across all wikis, it seems like these rate limits should:

  • effectively close off an easy avenue for abuse
  • nudge a small number of good faith, incognito window logged-out editors to create accounts

Over the next two months, we will monitor rate limit trips and collect data on likely distinct devices behind the rate limit trips, as well as keep an eye on the rate of temporary account creations and reverted/unreverted edits. We will make changes to those limits based on what we observe.

Change #1217744 had a related patch set uploaded (by Tchanders; author: Tchanders):

[operations/mediawiki-config@master] Add experimental temp account creation rate limits for enwiki

https://gerrit.wikimedia.org/r/1217744

My understanding from internal conversations is that this is scoped to English Wikipedia, and only for a temporary period of time, as an experiment.

We discussed internally and have decided that it makes sense to make the limits global, because the account creation happens globally. We will monitor the impact nonetheless and re-evaluate these limits after a period of time.

Change #1217744 merged by jenkins-bot:

[operations/mediawiki-config@master] Add experimental temporary account creation rate limits

https://gerrit.wikimedia.org/r/1217744

Mentioned in SAL (#wikimedia-operations) [2025-12-15T11:36:08Z] <kharlan@deploy2002> Started scap sync-world: Backport for [[gerrit:1218220|Add acct_creation_throttle_hit equivalent for temp. accounts (T412105)]], [[gerrit:1218221|Add 'acct_creation_throttle_hit-temp' (T412105)]], [[gerrit:1217744|Add experimental temporary account creation rate limits (T412222)]]

Mentioned in SAL (#wikimedia-operations) [2025-12-15T12:31:31Z] <kharlan@deploy2002> kharlan, tchanders: Backport for [[gerrit:1218220|Add acct_creation_throttle_hit equivalent for temp. accounts (T412105)]], [[gerrit:1218221|Add 'acct_creation_throttle_hit-temp' (T412105)]], [[gerrit:1217744|Add experimental temporary account creation rate limits (T412222)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-12-15T12:48:32Z] <kharlan@deploy2002> Finished scap sync-world: Backport for [[gerrit:1218220|Add acct_creation_throttle_hit equivalent for temp. accounts (T412105)]], [[gerrit:1218221|Add 'acct_creation_throttle_hit-temp' (T412105)]], [[gerrit:1217744|Add experimental temporary account creation rate limits (T412222)]] (duration: 72m 23s)

Is the default mentioned at https://www.mediawiki.org/wiki/Manual:$wgTempAccountCreationThrottle still correct or should the documentation page be updated with the newly introduced limits?

Is the default mentioned at https://www.mediawiki.org/wiki/Manual:$wgTempAccountCreationThrottle still correct or should the documentation page be updated with the newly introduced limits?

The default mentioned on that page is correct, we've only overridden this value in operations/mediawiki-config.