User:MelanieN/Page protection

Page protection is my main administrative activity at Wikipedia. These are some thoughts - philosophy, tips, etc. - about how I deal with page protection. They are distilled from "tutorials" I have given to several new admins over the past couple of years. I hope they might be helpful to new admins or admin candidates.

Everybody has their own standards for when a page needs protection, and for how long. This is just my own thinking; other people probably have different approaches. Just as we have "deletionists" and "keepers" at AfD, at protection we tend to have "decliners" ("not enough recent vandalism to justify protection") and "protectors" with regard to page protection. Personally I tend to be more of a "protector" - sympathetic toward the need for protection. That may be a bias from my own experience, when I was the person requesting protection. 

I find Twinkle very useful for installing protection. It lists all the options to choose from, and it automatically adds a “protected” icon to the protected page.

Does the article need protection?

The purpose of protection is to stop vandalism or other disruptive activities. The disrupting must be current and ongoing - maybe three or more problem edits in the past 24 hours, maybe a problem edit or two every day for the past week. If there has been no vandalism for the past day or two I will generally not impose protection at all, since protection is supposed to be to stop an immediate problem.

To recognize disruption in the article history, commonly you will see a pattern where IPs or new users make an edit, followed by reversion of the edit by someone else, usually an established user. Be sure to determine what the nature of the edits is, from looking at the diffs and the edit summaries. Protection is appropriate for outright vandalism, particularly BLP violations; for unsourced changes to established content, such as changing a person’s age or name; or for repeated addition of unsourced content or removal of sourced content. If the same challenged edit is made by several different new users, that can be a sign of sockpuppetry.

There is a difference between vandalism and good-faith disagreement over content. People disagreeing will often call the other person's edits "vandalism" when it is not. If there is a legitimate content dispute, protection may not be appropriate. Do not assume that the established user’s version is right and the new user is wrong, and do not use protection to give preference to the established user’s version. Rather than protection, I may issue edit-warring warnings to the disputing parties. In serious cases of edit warring (which is disruptive and is forbidden by WP policy) I may install full protection for a short time. In that case I often put a note on the talk page explaining what I have done, and pinging the disputing editors to come to the talk page.

One of the basic rules about protection is that we do not apply it pre-emptively - that is, when there is no current vandalism but there is a prediction that vandalism might occur. Protection is only used to stop actual disruption, not to prevent possible future disruption. For instance, "this new movie is coming out tomorrow and the article might get vandalized when it does" is not a valid reason for protection.

What kind of protection to apply?

The most common protection is semi-protection, which is generally all that is needed, because most vandalism is done by new or anonymous editors. No prejudice toward newbies intended, that's just the way it is: vandals don't generally get to stick around long enough to become established users. Roughly my guideline: if there have been three or more vandalism edits in the past 24 hours, or five or six in the last few days, IMO that calls for semi-protection. (That's if the vandals are not autoconfirmed, which they usually aren't. If they are autoconfirmed and have been editing through existing semi-protection, that may call for extended confirmed protection - which is a trickier call best left to more experienced folk at first). In deciding whether to impose semi-protection I take into account whether there are also constructive edits from IPs; some of the sports and movie articles are built up almost entirely by IPs, and you don't want to disrupt that because of a few bad apples. If there is just one vandal and they have been blocked, protection can usually be declined; if there are dynamic IPs involved you still need it. If the vandalism isn't frequent enough for semi-protection, but has been regularly recurrent over a period of months, then Pending Change protection can help.

Pending Change protection is for articles that have a fairly low rate of editing and a long-term pattern of occasional vandalism. If the article is more frequently edited - say half a dozen or more edits a day - and particularly if a lot of those edits are from non-autoconfirmed users so they need to be evaluated, don't use PC; it's just a pain in the butt. Here's why: Each edit by a non-autoconfirmed user is put on hold to be accepted or rejected, and all subsequent edits get held up until the one on hold is dealt with. I use PC for articles that have a slow rate of editing but a pattern of occasional bad edits (and possibly occasional good edits) by IPs and new users - a slow enough pattern that they can be dealt with one at a time through regular page watching. If there is a high rate of bad edits by IPs and new users - I am talking about three or more bad edits per day - then semi-protection is more appropriate. I am also reluctant to impose PC if the article gets a lot (a dozen or more a day) of regular, noncontroversial edits by established users, simply because one challenged edit messes up all subsequent edits until the challenged edit is cleared.

Extended confirmed protection is very rarely used. It prohibits edits by users with less than 30 days tenure or fewer than 500 edits. It is intended for cases where semi-protection has not been successful because there are disruptive edits coming from autoconfirmed editors. That sometimes happens at highly controversial subjects. ArbCom has defined certain areas where EC protection may be appropriate, such as the Arab-Israel conflict, current American politics, etc.; however, admins have discretion to use it anywhere that it appears necessary. Whenever an article is put under EC protection, the action is logged by a bot and listed at WP:AN under "Pages recently put under extended-confirmed protection".[1] To understand how rarely used ECP is, take a look at that log: it shows every application of ECP, Wikipedia-wide, and it's only two to four applications a day.

Full protection can be used to stop edit warring over content. It is usually installed for a very brief time, a day or two. Instead of full protection I may just issue warnings to the combatants, and sometimes I will start a section at the talk page calling for them to work out their differences there. I am more inclined to lock the page if the warring seems very determined. I was taught by my mentor, Dennis Brown, that full protection can be useful as an alternative to blocking people for edit warring; it shuts down the edit war without any need to issue blocks. I always prefer not to block if I don’t have to, particularly established editors for whom a clean block log may be important. Of course, if the full protection doesn’t work and the edit warring immediately resumes when it expires, then blocking may be necessary. (BTW although you as an admin can edit an article despite full protection, most of us are hesitant to edit through full protection unless there is a consensus or a real need. If they do, many people will acknowledge it in the edit summary: "editing through full protection to do x-and-such".)

Create protection (aka "salting"): If a page has been created, deleted, and recreated three or more times, I will usually apply indefinite create protection with the admin-only option.

Move protection: This is used in case of recent move-warring over the title. I may install move protection after a single instance of move-and-move-back, or I may need to see it happen more than once. I usually make it indefinite with the admin-only option.

How long to apply protection for?

Our motto as "the encyclopedia anyone can edit" means we install protection only when needed, and for as short a time as possible. We apply protection for the shortest period of time that will solve the problem - that is, to stop immediate disruption and prevent future disruption for a reasonable time. How long that is depends on several factors. The factors I consider are: how long has the current disruption has been going on? and what previous protection has the article had?

Previous protection: I first take a look at the protection log. If this is the first time the article has needed protection I will use a relatively short duration. If there is a history of previous protection of increasing duration, and if the new protection is needed shortly after a previous protection expired, that tells me that the article has a persistent disruption problem. I generally apply a longer protection than the most recent previous term. See, for example, So Awkward,[2] where the previous protection had been for three months so I gave it six. Indefinite protection is rare, but may be needed for an article that has needed repeated, almost continuous applications of protection for a year or more.

Duration of current problem: After evaluating the protection history I look at the current problem - the one I am protecting against. I look at the duration of the problem and I more or less match it. If it’s only been going on for a day, without a past history of disruption, I will use a short term such as 2 days. The longer it has been going on, the longer the term I impose. My rough guideline is to protect for about the length of time the disruption has been going on, or a little longer: if it started a week ago I protect for a week or possibly two weeks, etc. This only applies if there is not a significant history of previous protection; such a history calls for longer/escalating duration.

Type of disruption: I often give longer protection than I otherwise would if the problem is BLP violations or sockpuppetry.

PC protection: Because PC is intended for articles that have a slow but persistent pattern of problem edits, it is typically applied for longer periods of time - at least a month, often three to six months, depending on how long the problems have been going on.

Full protection: Because full protection prevents all editing, I use it only for very short periods - commonly a day or two.

What kind of pages to protect?

The vast majority of protection is used on regular article pages. Article talk pages are generally not protected, or only for the shortest possible period of time. That's because if the corresponding article is protected, the talk page is the only mechanism for a new user to make a change, by submitting an edit request. Noted example. User talk pages can be protected briefly if they are under attack. A person’s main user page should not usually need protection, since they are automatically semi-protected by a filter. User pages and user talk pages do not get protected just because the user asks for it; there must be a demonstrated need.

Requests at RfPP: Before I begin to patrol the RfPP requests, I always look at the RfPP page history. (NOTE: As a result of the reorganization of RFPP in July 2021, most of that history is found at Wikipedia:Requests for page protection/Increase rather than WP:Requests for page protection. I like to do my patrolling on the "requests for increase" page so that I can see the history, and I use the redirect WP:RFPPI to get to that page.) I do this to see if any other admin is actively patrolling. If they are, I go away and do something else. Two admins trying to patrol at the same time only get in each other’s way - one protects a page and the other unintentionally supersedes that protection with another, or one declines protection just as the other is imposing it. If no one else is working the page, I start at the top and work my way down, evaluating each request, taking an action or not, and replying to the request to say what I did. Canned replies for admins to use are available, under a hat, at the top of the edit page, labeled "RFPP administrator notation templates"; just copy-paste the appropriate one and add the duration or whatever is needed. For example, if you semi-protect something for 4 days, copy ":{{subst:RFPP|semi|X}} ~~~~", paste it in as your reply, and replace the X with "4 days".  If you decline because vandalism wasn't bad enough to need protection, copy ":{{subst:RFPP|nact}} ~~~~" I know there are scripts for responding - maybe ResponseHelper? - but I like to do it manually. Always use an edit summary, such as “semi 1 week” or “PC 2 months” or “declined”, so that any other admin looking to patrol the page can see what was done. If I’m not comfortable handling a particular request I simply skip over it and leave it for someone else to deal with.

An article you come across or have on your watchlist: If you discover that an article is under attack by vandals you can simply go ahead and protect it; you don’t need to wait to be asked or go through any kind of process, you can just do it. The same applies to user talk pages on your watchlist if they are being attacked repeatedly. If the person is an administrator (One of the joys of adminship: nasty messages on your talk page) they may prefer to deal with it themselves, but if they appear to be offline or the attacks are very frequent, you can go ahead and protect it, possibly with a note on their page explaining what you did. If they don’t want protection they can always undo it.

Articles where you are personally involved as an editor: You need to be careful about articles where you are WP:INVOLVED. If the problem is simple vandalism you can protect the page without a problem, but be careful never to use your admin tools to defend your own point of view in a dispute. If you have any doubt about whether you should protect it, don’t; make a request at RfPP instead. If you have previously taken only administrative actions at that page, without editing, that does not make you involved and does not prevent you from taking additional action; however it won't hurt to ask at RfPP if you aren't sure, since if the request is honored it can demonstrate a consensus that it was required. Also, the "involved" rule does not prevent you from protecting or unprotecting your own talk page, if needed.

P.S. A little off topic but I will copy here an explanation I gave at a recent RfA, about how I handle the "involved" issue at articles where I am actively participating as an editor. Several other admins chimed in to say they handle it the same way.

How I handle the "involved" issue - basically, I point out, as often as necessary, that I am editing as a regular editor rather than an admin; I take no admin actions at those articles or their talk pages except in cases of blatant vandalism, where I may apply page protection and/or revdel; and I disclose my involved-ness if I comment at a drama board. -- MelanieN (talk) 02:39, 26 April 2019 (UTC)

See also

So much for my thoughts. The real information is at WP:Protection policy and Wikipedia:Administrators' guide/Protecting. There is also a how-to page at Wikipedia:Requests for page protection/Administrator instructions.