The rules are a custom language. They are formatted similar to conditionals in a C/Java/Perl-like language.

You can specify a literal by placing it in single or double quotes (for strings), or by typing it in as-is (for numbers, both floating-point and integer).You can get linebreaks with\n, tab characters with\t, and you can also escape the quote character with a backslash.

Use the+ (plus) symbol toconcatenate twoliteral strings or the values of twovars with a string value.

Examples

"This is a string"'This is also a string''This string shouldn\'t fail'"This string\nHas a linebreak"12341.234-123

You can define custom variables for ease of understanding with the assign symbol:= in a line (closed by;) within a condition.Such variables may use letters, underscores, and numbers (apart from the first character) and are case-insensitive.Example (fromw:Special:AbuseFilter/79):

(line1:="(?:\{\{[Rr]ef(?:list|s)|<references\s?\/>|<\/references\s?>)";rcount(line1,removed_lines))>(rcount(line1,added_lines))

AbuseFilter has support for non-associative arrays, which can be used like in the following examples.

Caution:

Expressions likepage_namespace in [14, 15] may not work as expected. This one will evaluate totrue also ifpage_namespace is1,4, or5. For more information and possible workarounds, please seeT181024.

my_array:=[5,6,7,10];my_array[0]==5length(my_array)==4int(my_array)===4// Same as lengthfloat(my_array)===4.0// Counts the elementsstring(my_array)=="5\n6\n7\n10\n"// Note: the last linebreak could be removed in the future5inmy_array==true'5'inmy_array==true'5\n6'inmy_array==true// Note: this is due to how arrays are cast to string, i.e. by imploding them with linebreaks1inmy_array==true// Note: this happens because 'in' casts arguments to strings, so the 1 is caught in '10' and returns true.my_array[]:=57;// This appends an element at the end of the arraymy_array===[5,6,7,10,57]my_array[2]:=42;// And this is for changing an element in the arraymy_array===[5,6,42,10,57]

You can specify comments using the following syntax:

/* This is a comment */

You can use basic arithmetic symbols to do arithmetic on variables and literals with the following syntax:

• - – Subtract the right-hand operand from the left-hand operand.
• + – Add the right-hand operand to the left-hand operand.
• * – Multiply the left-hand operand by the right-hand operand.
• / – Divide the left-hand operand by the right-hand operand.
• ** – Raise the left-hand operand to the exponential power specified by the right-hand operand.
• % – Return the remainder given when the left-hand operand is divided by the right-hand operand.

The type of the returned result is the same that would be returned by PHP, for which a lot of documentation may be foundonline.More exhaustive examples may be found inthis AF parser test.

You can match if and only if all of a number of conditions are true, one of a number of conditions are true, or one and only one of all conditions are true.

• x | y — OR – returns true if one or more of the conditions is true.
• x & y — AND – returns true if both of the conditions are true.
• x ^ y — XOR – returns true if one, and only one of the two conditions is true.
• !x — NOT – returns true if the condition is not true.

Examples

You can comparevariables with other variables andliterals with the followingsyntax:

• <,> – Returntrue if the left-handoperand isless than/greater than the right-hand operand respectively. Watch out: operands are cast to strings and, like it happens in PHP,null < any number === true andnull > any number === false.
• <=,>= – Returntrue if the left-hand operand isless than or equal to/greater than or equal to the right-hand operand respectively. Watch out: operands are cast to strings and, like it happens in PHP,null <= any number === true andnull >= any number === false.
• == (or=),!= – Returntrue if the left-hand operand isequal to/not equal to the right-hand operand respectively.
• ===,!== – Returntrue if the left-hand operand isequal to/not equal to the right-hand operand AND the left-hand operand isthe same/not the same data type to the right-hand operand respectively.

The abuse filter passes various variables by name into the parser.These variables can be accessed by typing their name in, in a place where a literal would work.You can view the variables associated with each request in the abuse log.

Caution:

User-related variables are always available, except for one case: account creation when the creator is not logged in. All variables starting withuser_ are affected, exceptuser_type.

Description	Name	Data type	Notes
Action	action	string	One of the following: edit, move, createaccount, autocreateaccount, delete, upload[2], stashupload[3]
Unix timestamp of change	timestamp	string	int(timestamp) gives you a number with which you can calculate the date, time, day of week, etc.
Database name of the wiki ($1)	wiki_name	string	For instance, this is "enwiki" on the English Wikipedia, and "itwikiquote" on the Italian Wikiquote.
Language code of the wiki ($1)	wiki_language	string	For instance, this is "en" on the English Wikipedia, and "it" on the Italian Wikiquote. Multi-lingual wikis like Commons, Meta, and Wikidata will also report as "en".
Edit count of the user ($1)	user_editcount	integer/null	Null only for unregistered users. Neither 0 nor null fortemporary accounts.
Name of the user account ($1) (IP in case the user is not registered)	user_name	string	For "createaccount" and "autocreateaccount" actions, useaccount_name if you want the name of the account being created. Caution: On wikis where temporary accounts are enabled, IPs are not returned for unregistered users. Useuser_unnamed_ip instead if the IP is needed. More context is available atTrust and Safety Product/Temporary Accounts/For developers.
Type of the user account ($1)	user_type	string	The type of the user, which will be one ofip,temp (if the user is using atemporary account),named,external, orunknown.
Time email address was confirmed ($1)	user_emailconfirm	string/null	In the format: YYYYMMDDHHMMSS. Null if the email wasn't confirmed.
Age of the user account ($1)	user_age	integer	In seconds. 0 for unregistered users. Not 0 for temporary accounts.
Whether the user is blocked ($1)	user_blocked	boolean	True for blocked registered users and temporary accounts. Also true for edits from blocked IP addresses, even if the editor is a registered user who is not blocked. False otherwise. This doesn't differentiate between partial and sitewide blocks.
Groups (including implicit) the user is in ($1)	user_groups	array of strings	seeSpecial:ListGroupRights
Rights that the user has ($1)	user_rights	array of strings	seeSpecial:ListGroupRights
Page ID ($1)	article_articleid	integer	(deprecated) Usepage_id instead.
Page ID ($1) (can be seen via "page information" link in sidebar)	page_id	integer	This is 0 for new pages, but it is unreliable when inspecting past hits. If you need an exact result when inspecting past hits, use "page_age == 0" to identify new page creation. (note that it is slower, though.) This issue has been fixed in9369d08, merged on September 11th 2023.
Page namespace ($1)	article_namespace	integer	(deprecated) Usepage_namespace instead.
Page namespace ($1)	page_namespace	integer	refers tonamespace index. Check for namespace(s) using expressions like "page_namespace == 2" or "equals_to_any(page_namespace, 1, 3)"
Page age in seconds ($1)	page_age	integer	the number of seconds since the first edit (or 0 for new pages). This is reliable, but it tends to be slow; consider usingpage_id if you don't need much precision.
Page title without namespace ($1)	article_text	string	(deprecated) Usepage_title instead.
Page title without namespace ($1)	page_title	string
Full page title ($1)	article_prefixedtext	string	(deprecated) Usepage_prefixedtitle instead.
Full page title ($1)	page_prefixedtitle	string
Edit protection level of the page ($1)	article_restrictions_edit	string	(deprecated) Usepage_restrictions_edit instead.
Edit protection level of the page ($1)	page_restrictions_edit	array of strings
Move protection level of the page ($1)	article_restrictions_move	string	(deprecated) Usepage_restrictions_move instead.
Move protection level of the page ($1)	page_restrictions_move	array of strings
Upload protection of the file ($1)	article_restrictions_upload	string	(deprecated) Usepage_restrictions_upload instead.
Upload protection of the file ($1)	page_restrictions_upload	array of strings
Create protection of the page ($1)	article_restrictions_create	string	(deprecated) Usepage_restrictions_create instead.
Create protection of the page ($1)	page_restrictions_create	array of strings
Last ten users to contribute to the page ($1)	article_recent_contributors	array of strings	(deprecated) Usepage_recent_contributors instead.
Last ten users to contribute to the page ($1)	page_recent_contributors	array of strings	This tends to beslow (see#Performance). Try to put conditions more likely evaluate to false before this one, to avoid unnecessarily running the query. This value is an empty array for page creations. The resulting array will have each name only once, regardless of how many times they contributed. Only scans the last 100 revisions
First user to contribute to the page ($1)	article_first_contributor	string	(deprecated) Usepage_first_contributor instead.
First user to contribute to the page ($1)	page_first_contributor	string	This tends to beslow (see#Performance).[4] Try to put conditions more likely evaluate to false before this one, to avoid unnecessarily running the query.

Caution:

Always check that the variables you want to use are available for the current action being filtered, e.g. by using theaction variable. Failing to do so (for instance usingaccount_name for an edit, oredit_delta for a deletion) will make any code using the variable in question returnfalse.

A variable can be considered protected. For instance, on wikis with temporary accounts enabled, IPs are considered PII and access to them must be restricted.Protected variables and filters that use them (including the logs they create) are only accessible to maintainers with theabusefilter-access-protected-vars right.Using a protected variable flags the filter as protected as well.The filter subsequently cannot be unprotected, even if it no longer actively uses a protected variable, as its historical logs will remain available.

A private log is created when a filter maintainer views the value of a protected variable.This private log is not an abuse filter log.It is a private log only viewable to users with theabusefilter-protected-vars-log right and is stored atSpecial:Log/abusefilter-protected-vars.

The default protected variables are defined inAbuseFilterProtectedVariables inextension.json.

Whenaction='move', only thesummary,action,timestamp anduser_* variables are available.Thepage_* variables are also available, but the prefix is replaced bymoved_from_ andmoved_to_, that represent the values of the original article name and the destination one, respectively.For example,moved_from_title andmoved_to_title instead ofpage_title.

Since MediaWiki 1.28 (gerrit:295254),action='upload' is only used when publishing an upload, and not for uploads to stash.A newaction='stashupload' is introduced, which is used for all uploads, including uploads to stash.This behaves likeaction='upload' used to, and only provides file metadata variables (file_*).Variables related to the page edit, includingsummary,new_wikitext and several others, are now available foraction='upload'.For every file upload, filters may be called withaction='stashupload' (for uploads to stash), and are always called withaction='upload'; they are not called withaction='edit'.

Filter authors should useaction='stashupload' | action='upload' in filter code when a file can be checked based only on the file contents – for example, to reject low-resolution files – andaction='upload' only when the wikitext parts of the edit need to be examined too – for example, to reject files with no description.This allows tools that separate uploading the file and publishing the file (e.g.UploadWizard orUpload dialog) to inform the user of the failure before they spend the time filling in the upload details.

As noted in the table above, some of these variables can be very slow.While writing filters, remember that the condition limit isnot a good metric of how heavy filters are.For instance, variables like*_recent_contributors or*_links always need a DB query to be computed, while*_pst variables will have to perform parsing of the text, which again is a heavy operation; all these variables should be used very, very carefully.For instance, on Italian Wikipedia it's been observed that, with 135 active filters and an average of 450 used conditions, filters execution time was around 500ms, with peaks reaching 15 seconds.Removing theadded_links variable from a single filter, and halving the cases when another filter would useadded_lines_pst brought the average execution time to 50ms.More specifically:

• Use_links variables when you need high accuracy and checking for "http://..." in other variables (for instance,added_lines) could lead to heavy malfunctioning;
• Use_pst variables when you're really sure that non-PST variables aren't enough. You may also conditionally decide which one to check: if, for instance, you want to examine a signature, check first ifadded_lines contains~~~;
• In general, when dealing with these variables, it's always much better to consume further conditions but avoid computing heavy stuff. In order to achieve this, always put heavy variables as last conditions.

Last but not least, note that whenever a variable is computed for a given filter, it'll be saved and any other filter will immediately retrieve it. This means that one single filter computing this variable counts more or less as dozens of filters using it.

The following special keywords are included for often-used functionality:

• like (ormatches) returns true if the left-hand operand matches theglob pattern in the right-hand operand.
• in returns true if the right-hand operand (a string) contains the left-hand operand.Note: empty strings are not contained in, nor contain, any other string (not even the empty string itself).
• contains works likein, but with the left and right-hand operands switched.Note: empty strings are not contained in, nor contain, any other string (not even the empty string itself).
• rlike (orregex) andirlike return true if the left-hand operand matches (contains) theregex pattern in the right-hand operand (irlike is caseinsensitive).
  • The system usesPCRE.
  • The only PCRE option enabled isPCRE_UTF8 (modifieruin PHP); forirlike bothPCRE_CASELESS andPCRE_UTF8 are enabled (modifieriu).
• if ... then ... end
• if ... then ... else ... end
• ... ? ... : ...
• true,false,null

Examples

A number of built-in functions are included to ease some common issues.They are executed in the general formatfunctionName( arg1, arg2, arg3 ), and can be used in place of any literal or variable.Its arguments can be given as literals, variables, or even other functions.

Operations are generally done left-to-right, but there is an order to which they are resolved.As soon as the filter fails one of the conditions, it will stop checking the rest of them (due toshort-circuit evaluation) and move on to the next filter.The evaluation order is:

1. Anything surrounded by parentheses (( and)) is evaluated as a single unit.
2. Turning variables/literals into their respective data. (e.g.,page_namespace to 0)
3. Function calls (norm,lcase, etc.)
4. Unary+ and- (defining positive or negative value, e.g.-1234,+1234)
5. Keywords (in,rlike, etc.)
6. Boolean inversion (!x)
7. Exponentiation (2**3 → 8)
8. Multiplication-related (multiplication, division, modulo)
9. Addition and subtraction (3-2 → 1)
10. Comparisons (<,>,==)
11. Boolean operations (&,|,^)
12. Ternary operator (... ? ... : ...)
13. Assignments (:=)

• A & B | C is equivalent to(A & B) | C, not toA & (B | C). In particular, bothfalse & true| true andfalse & false| true evaluates totrue.
• A | B & C is equivalent to(A | B) & C, not toA | (B & C). In particular, bothtrue | true& false andtrue | false& false evaluates tofalse.
• added_lines rlike "foo" + "|bar" is wrong, useadded_lines rlike ("foo" + "|bar") instead.

The condition limit is (more or less) tracking the number of comparison operators + number of function calls entered.

Further explanation on how to reduce conditions used can be found atExtension:AbuseFilter/Conditions.

Although the AbuseFilter examine function will identify "rollback" actions as edits, the AbuseFilter will not evaluate rollback actions for matching.^[11]

• PCRE pattern syntax
• Extension:AbuseFilter/Conditions