This is a help page forusage of theCheckUser extension.For installation instructions, please see theCheckUser page.

Special:CheckUser is an interface used to look up CheckUser data about accounts and anonymous users.The tool can only be used by users with thecheckuser right.The data shown in the tool has an expiry which is set by default to 90 days.

1. OpenSpecial:CheckUser.
2. Type in the username (without theUser: prefix), IP address, or CIDR range into theUsernames and IP addresses: field.
   • This field accepts any IPv4 or IPv6 address
   • CIDR - you can check a range of IP addresses by appending the CIDR prefix. The CIDR prefix value by default is between 16-32 for IPv4 and 19-128 for IPv6. For notation, seeHelp:Range blocks.
   • XFF - you can check aclient IP address provided byX-Forwarded-For headers by appending/xff (for example,127.0.0.1/xff).
3. Select the information you want to retrieve:
   • Get IP addresses - returns IP addresses used by a registered user.
   • Get actions - returns all edits and logged actions made by users using an IP address or range specified in the target field, or if the target is a user all edits and logged actions by that user.
   • Get users - returns user accounts that have edited from an IP or range.
4. In theReason: field, type in the reason you are running the check. A shorter reason is generally better but you should still include enough context for auditing of checks. This will be logged in a log visible only to users with thecheckuser-log permission.

TheGet IP addresses results returns the last IP addresses used by a given user account.An example check is shown on the right in the screenshot.

The format of the results is designed to the results list compact and easy to skim over.The information is laid out as follows:

TheGet actions results returns a list of actions performed by all users on the given IP address or range, or if the target is a user all edits and logged actions by that user.An example result is shown to the right in the screenshot.

Actions shown in these results includes any action sent toSpecial:RecentChanges, but also additionally includes log events only shown in Special:CheckUser such as logging in and logging out of an account.

TheGet users results returns the last user accounts that used a given IP address.An example result is shown to the right in the screenshot.

This is formatted to fit a lot of information into a format that can very easily be listed and skimmed, but is difficult to read unless you know what the information provided is.The information is laid out as follows:

Each IP/XFF combination used to edit is listed, in order of use.After the IP addresses, the last ten user agents (browser, operating system, system language, and versions) and last ten useduser agent client hints (since MW 1.41) are shown.

XFF (X-Forwarded-For) headers indicate the series of IP addresses used from the user's computer (first) to the last proxy server.The XFF header is assumed untrustworthy as it can be set to a fake value by the user's computer.The XFF header is considered trusted if all IP addresses are trusted proxies, which causes the XFF to have a green background.

When you get results from Special:CheckUser you can add personal user tool links via the following interface messages:

• MediaWiki:Checkuser-userlinks-ip - for IP addresses (for examplem:MediaWiki:checkuser-userlinks-ip)
• MediaWiki:Checkuser-userlinks - for registered users (for examplem:MediaWiki:Checkuser-userlinks)
• MediaWiki:Checkuser-toollinks - for IPs in theGet IP addresses check type (for examplem:MediaWiki:checkuser-toollinks)
• MediaWiki:Checkuser-cidr-tool-links - for IP ranges produced by the CIDR calculator present at the bottom of all Special:CheckUser pages.(introduced in 1.41)

Special:Investigate is an alternative interface used to lookup CheckUser data for accounts and anonymous users.The tool uses a single-page design which helps avoid opening too many tabs when running checks.However, it lacks several features present in Special:CheckUser such as the display of Client Hints data.The tool can only be used by users with theinvestigate right.The data shown in the tool has an expiry which is set by default to 90 days.

1. Open Special:Investigate.
2. In theUsernames and IP addresses: field, type in up to 10 targets, which may be usernames (without theUser: prefix), IP addresses, or CIDR ranges.
3. In theReason field, enter the reason for the check. A shorter reason is generally better but you should still include enough context for auditing of checks. This will be logged in a log visible only to users with thecheckuser-log permission.

• Screenshots
• 
  Input form
• 
  Account information tab
• 
  IPs and user agents tab
• 
  Timeline tab

For advanced feature usage, seeHelp:Special Investigate.

Like with Special:CheckUser, it is possible to customise the links shown near IP addresses.

The links are defined in thecheckuser-investigate-compare-toollinks message.This message is parsed to find links, which are added to the menu in theIPs & User agents tab.

Special:InvestigateBlock is interface used mass block users and IP addresses after a CheckUser check.The tool allows you to block multiple targets with the same reason and also add content to their talk page / user page.The tool can only be used by users with thecheckuser andblock rights.

1. Open Special:InvestigateBlock.
2. In theUsernames and IP addresses field, enter targets to block (which can be usernames, IP addresses, or CIDR ranges).
3. Fill out the block details, including whether you want to add content to their user pages and/or user talk pages.
4. Submit the blocks.

The tool will prevent the user from blocking usernames and IP addresses in the same use of the form to avoid accidentally publicly exposing CheckUser data.Pre-filled links from Special:Investigate and Special:CheckUser are configured so that there are two links where one contains the accounts and the other contains the IP addresses, so that the user will not see this warning when using the form.

Since MediaWiki 1.40, a button is displayed next to temporary account user links which allows the revealing of their IP address.

This functionality can be used by users with thecheckuser-temporary-account orcheckuser-temporary-account-no-preference rights.Additionally theTurn on the ability to display IP addresses of temporary accounts preference must be enabled for users with either user right to use the tool.Users that are sitewide blocked cannot use the functionality.

These buttons will appear next to temporary account usernames for actions that they have performed, such as on their edits in the history page or on Special:Contributions.

Administrators can see a list of IP addresses used by a temporary account by visiting Special:Block and entering the temporary account into the username field.This is to allow administrators to see whether an IP address block would be more appropriate for preventing abuse by the user.

These will not be shown on the following pages:Special:CheckUser, Special:Investigate, Special:InvestigateBlock, Special:ListUsers, Special:BlockList, Special:ActiveUsers.

Since MediaWiki 1.45, it is possible to enter into IP auto-reveal mode, in which temporary accounts have their IP addresses displayed next to their names by default.IP addresses display wherever IP reveal buttons would be added, so this is equivalent to clicking on all the IP reveal buttons.

This can reveal a lot of private information, so the mode should only be used for a limited duration, when needed. Usage of the mode is logged.

IP auto-reveal mode is available to users with thecheckuser-temporary-account-auto-reveal right, if they are also able to reveal IP addresses of temporary accounts.

IP auto-reveal mode can be switched on and off by clicking on the link in the sidebar tools menu and following the workflow in the dialog that is launched.

Since MediaWiki 1.44, if temporary accounts are known on a wiki, a dialog is shown to users with access to view temporary account IP addresses when they visit a history page, Recent Changes, or Watchlist.The dialog has three steps providing:

• Basic information about temporary accounts and how they work
• Introduction to the IP Reveal feature with a checkbox allowing to enable it
  • For users who can use the IP auto-reveal mode a secondary checkbox allowing to turn that mode on is shown
• Introduction to the IP Info feature.

This page is used to find all the edits performed by temporary accounts on a given IP address or CIDR range within the CheckUser data retention period (by default 90 days).This page is only available if temporary accounts are known on a wiki.

To use this page, you must have the ability to reveal the IP addresses of temporary accounts (as described in theShowing IPs for temporary accounts section).

1. Open Special:IPContributions.
2. In theIP address or range: field, input an IP (IPv4 or IPv6) or CIDR range.
3. Adjust parameters as necessary and submit a search. This action will be logged to thecheckuser-temporary-account log which will be visible to users with thecheckuser-temporary-account-log right.

• Screenshots
• 
  Input form
• 
  Example results

This special page is only available if theExtension:GlobalPreferences andExtension:CentralAuth extensions are installed.The tool allows users to see edits performed by a given target across all wikis performed within the CheckUser data retention period (by default 90 days).

The tool can search for the following types of targets:

• A username (named or temporary). This shows the recent revisions across all wikis from that user.
• An IP address or CIDR range. This shows recent revisions performed by temporary accounts on that IP address or range. The user can only see results on wikis where they have the ability to reveal the IP addresses of temporary accounts (as described in theShowing IPs for temporary accounts section).

The page does not show contributions from anonymous users whose name is their IP address.This is due to technical limitations with the current database table structure.

1. OpenSpecial:GlobalContributions.
2. In theUsername, IP address or range: field, input a user name, an IP (IPv4 or IPv6) or CIDR range.
3. Adjust parameters as necessary and submit a search. If searching with a target as an IP address or CIDR range, this action will be logged to thecheckuser-temporary-account log which will be visible to users with thecheckuser-temporary-account-log right.
4. Alongside local results, results will be returned from other wikis. If searching using an IP address as an IP address or CIDR range, then the results will be limited to the wikis where you have the ability to reveal temporary account IP addresses (as described in theShowing IPs for temporary accounts section).

• Screenshots
• 
  Input form
• 
  Example results

The Special:CheckUserLog page gives a list of all checks performed in Special:CheckUser, Special:Investigate, and the CheckUser query API.The interface is similar toSpecial:Log but has some additional features.The page can only be accessed by users with thecheckuser-log right, which by default is given to users in thecheckuser group.The page is intended to allow users to audit checks performed by others, to ensure that abuse is not being performed.

In addition to the Special:Log features:

• The page allows filtering for logs which have a given reason (this does not perform a wildcard search, so the reason needs to be exactly the same except for any wikitext included in the reason).
• When filters are applied, the timestamp of the check is a link to an unfiltered list where with an offset to include all checks performed around the same time. This can be used to find checks which were performed as a result of other checks, to assist with auditing checks.

User Info card displays data related to a user account when a logged-in user taps or clicks on the "user avatar" icon button next to a username.

The UserInfoCard provides information about a user such as:

• Date joined (local and global)
• Active local blocks (across all wikis, sitewide, or partial)
• Recent past blocks (on local wiki, sitewide, or partial)
• Edit count (local and global)
• Locally reverted edits
• New articles created
• Thanks given and received
• CheckUser investigations (local) – only CheckUsers will see this
• Date of last CU check (local) – only CheckUsers will see this
• Graph and count of editing activity over last 60 days

See theproject development page for more details.

CheckUser providesAPIs that allow access to the information shown on Special:CheckUser and Special:CheckUserLog.These APIs work similarly to the special pages but return their data in a structured format.The reason for a check using thecheckuser API is prefixed with "API:" to assist with auditing checks.More documentation on these APIs is provided below.

The following documentation is the output ofSpecial:ApiHelp/query+checkuser, automatically generated by the pre-release version of MediaWiki that is running on this site (MediaWiki.org).

The following documentation is the output ofSpecial:ApiHelp/query+checkuserlog, automatically generated by the pre-release version of MediaWiki that is running on this site (MediaWiki.org).