Only allow admin user to add new websites

[tpimh]

Currently, with publicly exposed self-hosting Plausible instances, where registration and login are not disabled, it's possible to register new user accounts, add any websites, and use the dashboard without any limits.

It would be nice to have a setting like USERS_CAN_ADD_WEBSITES. When this setting is set to FALSE (I suggest this should be the default), anyone can still register, but only the ADMIN_USER can add new websites (other users can be invited to become Admins or Viewers of these sites, but can never become Owners). In my opinion, this behavior will prevent the unwanted external users from exploiting the self-hosted installations.

[arrigolupori]

This is important for me as well!

Even better, remove the option for other users to sign up altogether.
Since it's a self-hosted install, I don't expect external users to sign up, it's a security risk.

Is there any way that we can implement this in self-hosted?

Thank you!

[madanyang]

Add the following to your environment configuration

 DISABLE_REGISTRATION=true

You can read more about the available options in Configuration options

[arrigolupori]

Thank you, I did not see this at all in the docs!

Really helpful and easy to configure :)

[jesperordrup]

This prevents people from creating accounts but when they have an account they can still create a website.

[stefanv]

Does this actually solve the problem? Now, when I try and add users to a site, they cannot register, even when I invite them.

[stefanv]

Solution: #1706 (comment)

[jesperordrup]

This is still a valid request #1706 doesnt solve it.

First, theres a difrerence between allowing registrations (false/true/invite_only) and access to creating websites.

It seems theres a need for
ADD_WEBSITES= all/users/admins/...

Im not sure if its actually solved already ?

[ruslandoga]

👋 @jesperordrup

Im not sure if its actually solved already ?

I don't think there is an option to turn off the ability to create websites yet.

[jesperordrup]

ok, is this the best way to suggest or do I need to describe elsewhere?

[ruslandoga]

I think the feature request is clear :) I'll ask the core team on the next call if there are any plans for this to be implemented and report back!

[RasberryKai]

Hey is there a solution for this already, because I need it for my project?

[ruslandoga]

👋 @RasberryKai

No, right now all registered users can add websites.

[jesperordrup]

@RasberryKai We forked and made a temporary fix. Just hidding the button. Clearly not enough but ok because we know the users.