Configurazione

All settings are stored in settings.py (as is usual for Django).

Nota

After changing any of these settings, you need to restart Weblate — both WSGI and Celery processes.

In case it is run as mod_wsgi, you need to restart Apache to reload the configuration.

Vedi anche

Please also check Django’s documentation for parameters configuring Django itself.

ADMINS_CONTACT

Configures where contact form sends e-mails. If not configured, e-mail addresses from ADMINS are used.

Inserisci un indirizzo e-mail valido:

ADMINS_CONTACT = ["admin@example.com", "support@example.com"]

Vedi anche

ALLOWED_ASSET_DOMAINS

Added in version 5.14.

Configures which domains are allowed for fetching assets in Weblate.

This enhances security by preventing loading assets from untrusted sources. Assets are downloaded once by the Weblate server and stored locally, rather than being served directly from external domains to users.

The allowlist is applied to the initial URL and to every HTTP redirect target before Weblate follows it. Redirects to hosts outside of this allowlist are rejected.

It expects a list of host/domain names. You can use fully qualified names (e.g www.example.com) or prepend with a period as a wildcard to match all subdomains (e.g .example.com will match cdn.example.com or static.example.com).

Defaults to ["*"], which allows all domains.

Esempio

ALLOWED_ASSET_DOMAINS = [
    # Allows only cdn.anotherdomain.org
    "cdn.anotherdomain.org",
    # Allows example.com and all its subdomains
    ".example.com",
]

Questo è attualmente utilizzato nei seguenti luoghi:

Vedi anche

ALLOWED_MACHINERY_DOMAINS

Configures which custom machinery domains are explicitly allowed in project-level machine translation configuration.

This setting applies only to machinery services and does not affect ALLOWED_ASSET_DOMAINS.

It expects a list of host/domain names. You can use fully qualified names or prepend with a period as a wildcard to match all subdomains.

Predefinito a [].

The allowlist affects project-managed machinery in two ways: it permits the configured endpoint during outbound validation, and it marks matching hosts as trusted when deciding whether remote provider error details or response bodies can be shown to the user. Matching hosts are also exempt from private-target restrictions. For direct connections, Weblate does not resolve, pin, or verify the peer address of matching hosts. Only add hosts or domains whose network destinations are trusted. When a configured HTTP proxy is used, the proxy is trusted to resolve the destination hostname.

ALLOWED_ASSET_SIZE

Added in version 5.14.

Configures size limit in bytes for fetching or uploading assets into Weblate. Defaults to 10 MB.

Vedi anche

ASSET_PRIVATE_ALLOWLIST

Added in version 2025.5.

Defines hostnames or domains exempt from ASSET_RESTRICT_PRIVATE for remote asset downloads that enforce private-target checks. Entries follow Django host matching semantics, so values such as assets.internal.example or .internal.example can be used.

This does not replace ALLOWED_ASSET_DOMAINS; remote assets must still match the asset domain allowlist.

Configurazione predefinita:

ASSET_PRIVATE_ALLOWLIST = []

Vedi anche

ASSET_RESTRICT_PRIVATE

Added in version 2025.5.

Reject remote asset URLs pointing to internal or non-public addresses unless the target host is included in ASSET_PRIVATE_ALLOWLIST. On by default.

When enabled, hostnames that cannot be resolved during validation are rejected unless they are explicitly included in ASSET_PRIVATE_ALLOWLIST. This currently applies to screenshot URL uploads and remote HTML downloads for the CDN localizzazione JavaScript add-on.

Vedi anche

ALTCHA_COST

Added in version 2025.5.

Argon2id time cost for the ALTCHA proof-of-work challenge. Defaults to 3.

Replaces ALTCHA_MAX_NUMBER, which applied to the removed ALTCHA widget v2.

ALTCHA_MEMORY_COST

Added in version 2025.5.

Argon2id memory cost in KiB. Defaults to 65536.

ALTCHA_PARALLELISM

Added in version 2025.5.

Argon2id parallelism factor. Defaults to 1.

Vedi anche

ALTCHA Proof of Work Mechanism

ANONYMOUS_USER_NAME

Username of users that are not signed in.

Vedi anche

Controllo accessi

AUDITLOG_EXPIRY

The maximum number of days Weblate will keep audit logs containing information about the account activity.

Defaults to 180 days.

AUTH_LOCK_ATTEMPTS

Maximum number of failed authentication attempts before rate limiting is applied.

This is currently applied in the following locations:

  • Sign in. Deletes the account password, preventing the user from signing in without requesting a new password.

  • Second-factor sign in. Deletes the account password after this many rejected second-factor submissions since the last successful second-factor sign in. This also invalidates pending password sign-ins. Other authentication methods and API tokens remain usable.

  • Password reset. Prevents new e-mails from being sent, avoiding spamming users with too many password-reset attempts.

Defaults to 10.

Vedi anche

Rate limiting

AUTO_UPDATE

Updates all repositories on a daily basis.

Every hour, Weblate queues updates for repositories whose component ID modulo 24 matches the current UTC hour. This distributes updates throughout the day. For example, component ID 25 is selected during the hour from 01:00 to 01:59 UTC. Linked components use the schedule of the component that owns their shared repository.

The assigned hour determines when updates are queued, not when they finish. Execution can be delayed by queued tasks or repository operations. Restarting Celery does not change the assigned hour. This setting does not provide a configurable update time window.

Suggerimento

Useful if you are not using Agganci di notifica to update Weblate repositories automatically.

Nota

On/off options exist in addition to string selection for backward compatibility.

The options are:

"none"

No daily updates.

"remote" also False

Fetch remote changes without merging them into the working copy. This is the default; False does not disable daily updates.

"full" also True

Fetch remote changes and merge them into the working copy.

Nota

Automatic updates require that Background tasks using Celery is working. Restart Celery after changing this setting for the new value to take effect.

AVATAR_URL_PREFIX

Prefix for constructing avatar URLs as: ${AVATAR_URL_PREFIX}/avatar/${MAIL_HASH}?${PARAMS}. The following services are known to work:

Gravatar (default), as per https://gravatar.com/

AVATAR_URL_PREFIX = 'https://www.gravatar.com/'

Libravatar, as per https://www.libravatar.org/

AVATAR_URL_PREFIX = 'https://www.libravatar.org/'

Vedi anche

AUTH_TOKEN_VALID

How long the authentication token and temporary password from password reset e-mails is valid for. Set in number of seconds, defaulting to 172800 (2 days).

AUTH_PASSWORD_DAYS

Per quanti giorni Weblate rifiuta di riutilizzare una password precedentemente utilizzata per un utente.

The checking is based on the audit log, AUDITLOG_EXPIRY needs to be at least same as this.

Nota

Password changes made prior to Weblate 2.15 will not be accounted for in this policy.

Defaults to 180 days.

AUTOFIX_LIST

List of automatic fixes to apply when saving a string.

Nota

Provide a fully-qualified path to the Python class that implements the autofixer interface.

Available fixes are described at Automatic fixups.

You can select which ones to use:

AUTOFIX_LIST = (
    "weblate.trans.autofixes.whitespace.SameBookendingWhitespace",
    "weblate.trans.autofixes.chars.ReplaceTrailingDotsWithEllipsis",
)

Vedi anche

BACKGROUND_TASKS

Added in version 4.5.2.

Defines how often lengthy maintenance tasks should be triggered for a component.

Right now this controls:

Possibili scelte:

  • monthly (this is the default)

  • weekly

  • daily

  • never

Nota

Increasing the frequency is not recommended when Weblate contains thousands of components.

BASIC_LANGUAGES

Added in version 4.4.

List of languages to offer users for starting a new translation. When not specified, a built-in list is used (which includes all commonly used languages, but without country specific variants).

This only limits non privileged users to add unwanted languages. Project admins are still presented with the full selection of languages defined in Weblate.

Nota

This does not define new languages for Weblate — it only filters existing ones in the database.

Esempio:

BASIC_LANGUAGES = {"cs", "it", "ja", "en"}

Vedi anche

Language definitions

BORG_EXTRA_ARGS

Added in version 4.9.

You can pass additional arguments to borg create when built-in backups are triggered.

Esempio:

BORG_EXTRA_ARGS = ["--exclude", "vcs/"]

Vedi anche

CACHE_DIR

Added in version 4.16.

Directory where Weblate stores cache files. Defaults to cache subfolder in DATA_DIR.

Change this to local or temporary filesystem if DATA_DIR is on a network filesystem.

Weblate stores generated helper files here and executes some of them, so CACHE_DIR has to be writable and mounted on a filesystem that allows execution. Avoid using noexec mount options for this directory.

The Docker container uses a separate volume for this, see Docker container volumes.

The following subdirectories usually exist:

ssh

Generated helper files used for VCS access.

fonts

font-config cache for Managing fonts.

avatar

Cached user avatars, see Avatars.

static

Default location for static Django files, specified by STATIC_ROOT. See Serving static files.

tesseract

OCR trained data for Screenshots and visual context.

CSP_SCRIPT_SRC, CSP_IMG_SRC, CSP_CONNECT_SRC, CSP_STYLE_SRC, CSP_FONT_SRC, CSP_FORM_SRC

Customize the Content-Security-Policy header for Weblate. The header is automatically generated based on enabled integrations with third-party services (Matomo, Google Analytics, Sentry, …).

All these default to an empty list.

Esempio:

# Enable Cloudflare Javascript optimizations
CSP_SCRIPT_SRC = ["ajax.cloudflare.com"]

Vedi anche

CHECK_LIST

List of quality checks to perform on a translation.

Nota

Provide a fully-qualified path to the Python class implementing the check interface.

Adjust the list of checks to include ones relevant to you.

All built-in Quality checks are turned on by default, from where you can change these settings. By default they are commented out in Sample configuration so that default values are used. New checks are then carried out for each new Weblate version.

You can turn off all checks:

CHECK_LIST = ()

You can turn on only a few:

CHECK_LIST = (
    "weblate.checks.chars.BeginNewlineCheck",
    "weblate.checks.chars.EndNewlineCheck",
    "weblate.checks.chars.MaxLengthCheck",
)

Nota

Changing this setting only affects newly changed translations. Existing checks will still be stored in the database. To also apply changes to the stored translations, run updatechecks.

Vedi anche

COMMIT_PENDING_HOURS

Number of hours between committing pending changes by way of the background task.

Vedi anche

COMPONENT_ZIP_UPLOAD_MAX_SIZE

Added in version 5.17.1.

Configures the maximum size, in bytes, for uploaded component ZIP files. Defaults to 50 MB.

In Docker, configure this using the WEBLATE_COMPONENT_ZIP_UPLOAD_MAX_SIZE environment variable.

Vedi anche

CONTACT_FORM

Added in version 4.6.

Configures how e-mail from the contact form is being sent. Choose a configuration that matches the configuration of your mail server.

"reply-to"

The sender is used as Reply-To, this is the default behaviour.

"from"

The sender is used as From. Your mail server needs to allow sending such e-mails.

"disabled"

Disables the contact form entirely.

Added in version 5.15.

Vedi anche

ADMINS_CONTACT

DATA_DIR

The folder Weblate stores all data in. It contains links to VCS repositories, a fulltext index and various configuration files for external tools.

The following subdirectories usually exist:

home

Home directory used for invoking scripts.

ssh

SSH keys and configuration.

media

Default location for Django media files, specified by MEDIA_ROOT. Contains uploaded screenshots, see Screenshots and visual context.

vcs

Repository di controllo della versione per le traduzioni.

backups

Daily backup data. Please check Dumped data for backups for details.

fonts:

User-uploaded fonts, see Managing fonts.

cache

Various caches. Can be placed elsewhere using CACHE_DIR.

The Docker container uses a separate volume for this, see Docker container volumes.

Nota

This directory has to be writable by Weblate. Running it as WSGI means the www-data user should have write access to it.

The easiest way to achieve this is to make the user the owner of the directory:

sudo chown www-data:www-data -R $DATA_DIR

Defaults to /home/weblate/data, but it is expected to be configured.

Vedi anche

DATABASE_BACKUP

Whether the database backups should be stored as plain text, compressed or skipped. The authorized values are:

  • "plain"

  • "compressed"

  • "none"

Vedi anche

Backing up and moving Weblate

DEFAULT_ACCESS_CONTROL

The default access-control setting for new projects:

0

Pubblico

1

Protetto

100

Privato

200

Personalizzato

Use Custom if you are managing ACL manually, which means not relying on the internal Weblate management.

Vedi anche

DEFAULT_AUTO_WATCH

Added in version 4.5.

Configures whether Automatically watch projects on contribution should be turned on for new users. Defaults to True.

Vedi anche

Notifiche

DEFAULT_RESTRICTED_COMPONENT

Added in version 4.1.

The default value for component restriction.

Vedi anche

DEFAULT_ADD_MESSAGE, DEFAULT_ADDON_MESSAGE, DEFAULT_COMMIT_MESSAGE, DEFAULT_DELETE_MESSAGE, DEFAULT_MERGE_MESSAGE

Default commit messages for different operations, please check Component configuration for details.

The built-in defaults follow Conventional Commits and include Weblate links where available. Changing these settings affects newly created defaults; existing message templates can be reset in the settings forms with Restore site default. For inherited values, restoring the site default also disables inheritance for that message.

Vedi anche

DEFAULT_ADDONS

Default add-ons to install for every created component.

Nota

This setting affects only newly created components.

Esempio:

DEFAULT_ADDONS = {
    # Add-on with no parameters
    "weblate.flags.target_edit": {},
    # Add-on with parameters
    "weblate.autotranslate.autotranslate": {
        "mode": "suggest",
        "filter_type": "todo",
        "auto_source": "mt",
        "component": "",
        "engines": ["weblate-translation-memory"],
        "threshold": "80",
    },
}

Vedi anche

DEFAULT_COMMITER_EMAIL

Committer e-mail address, defaulting to noreply@weblate.org.

Vedi anche

DEFAULT_COMMITER_NAME

DEFAULT_COMMITER_NAME

Committer name, defaulting to Weblate.

Vedi anche

DEFAULT_COMMITER_EMAIL

DEFAULT_LANGUAGE

Added in version 4.3.2.

Lingua di origine per eventuali nuovi componenti.

Defaults to en. The matching language object needs to exist in the database.

Vedi anche

DEFAULT_MERGE_STYLE

Stile unione per ogni nuovo componente.

  • rebase - default

  • merge

Vedi anche

DEFAULT_SHARED_TM

Configures the default value of Usa memoria traduzione condivisa and Contribuisci alla memoria traduzione condivisa.

DEFAULT_TRANSLATION_REVIEW

Added in version 5.16.

Configures the default value for Abilita revisioni, turned off by default.

DEFAULT_SOURCE_REVIEW

Added in version 5.16.

Configures the default value for Abilita revisioni sorgente, turned off by default.

DEFAULT_AUTOCLEAN_TM

Added in version 5.13.

Configures the default value of Pulizia automatica memoria di traduzione.

DEFAULT_TRANSLATION_PROPAGATION

Default setting for translation propagation, defaults to True.

Vedi anche

DEFAULT_PULL_MESSAGE

Configures the default title and message for pull requests.

The built-in default follows Conventional Commits and includes Weblate links and translation status.

ENABLE_AVATARS

Whether to turn on Gravatar-based avatars for users. On by default.

Avatars are fetched and cached on the server, lowering the risk of leaking private info, speeding up the user experience.

Vedi anche

ENABLE_HOOKS

Se attivare gli hook remoti anonimi.

Vedi anche

Agganci di notifica

ENABLE_HTTPS

Cambiato nella versione 5.7: Weblate now requires https for WebAuthn support.

Whether to send links to Weblate as HTTPS or HTTP. This setting affects sent e-mails and generated absolute URLs.

In the default configuration this is also used for several Django settings related to HTTPS — it enables secure cookies, toggles HSTS or enables redirection to a HTTPS URL.

The HTTPS redirection might be problematic in some cases and you might hit an issue with infinite redirection in case you are using a reverse proxy doing an SSL termination which does not correctly pass protocol headers to Django. Please tweak your reverse proxy configuration to emit X-Forwarded-Proto or Forwarded headers or configure SECURE_PROXY_SSL_HEADER to let Django correctly detect the SSL status.

In case this is disabled, Weblate will fail to start with an otp_webauthn.E031 error. You can silence this error by adding it to SILENCED_SYSTEM_CHECKS, but still WebAuthn will not work for sites without HTTPS.

Vedi anche

ENABLE_SHARING

Turn on/off the Community menu so users can share translation progress on social networks.

Vedi anche

Costruire la comunità dei traduttori

EXTRA_HTML_HEAD

Added in version 4.15.

Insert additional markup into the HTML header. Can be used for verification of site ownership, for example:

EXTRA_HTML_HEAD = '<link href="https://fosstodon.org/@weblate" rel="me">'

Avvertimento

No sanitization is performed on the string. It is inserted as-is into the HTML header.

GET_HELP_URL

Added in version 4.5.2.

URL where support for your Weblate instance can be found.

GITEA_CREDENTIALS

Added in version 4.12.

List for credentials for Gitea servers.

GITEA_CREDENTIALS = {
    "try.gitea.io": {
        "username": "weblate",
        "token": "your-api-token",
    },
}

The configuration dictionary consists of credentials defined for each API host. The layout is same for almost all version control integrations and is described at Configurazione delle credenziali del controllo versione.

Vedi anche

GITLAB_CREDENTIALS

Added in version 4.3.

List for credentials for GitLab servers.

GITLAB_CREDENTIALS = {
    "gitlab.com": {
        "username": "weblate",
        "token": "your-api-token",
    },
}

Nota

The personal access token needs the api scope to be able to use the API.

The configuration dictionary consists of credentials defined for each API host. The layout is same for almost all version control integrations and is described at Configurazione delle credenziali del controllo versione.

Vedi anche

GITHUB_CREDENTIALS

Added in version 4.3.

List for credentials for GitHub servers.

GITHUB_CREDENTIALS = {
    "api.github.com": {
        "username": "weblate",
        "token": "your-api-token",
    },
}

Nota

It is possible to use both fine-grained personal access tokens and classic personal access tokens. The fine-grained tokens are limited to a single organization, so it won’t work if you want Weblate to fork a repository outside the organization (typically to the user namespace).

To clone, push and create pull requests, the read and write access to Contents and Pull requests is required.

Administration might also be necessary for forking a repository if you intend to use forking and the original repository is not public.

Suggerimento

Use api.github.com as an API host for https://github.com/.

The configuration dictionary consists of credentials defined for each API host. The layout is same for almost all version control integrations and is described at Configurazione delle credenziali del controllo versione.

Vedi anche

GITHUB_LEGACY_APP_WEBHOOK_SECRET

Added in version 2026.8.

Webhook secret for a legacy GitHub App which delivers events to the generic GitHub webhook URL, /hooks/github/.

App webhook deliveries to the generic URL are rejected when this setting is empty or their X-Hub-Signature-256 does not match. Ordinary repository webhooks are unaffected. GitHub Apps registered through Weblate use their per-App webhook URLs and do not use this setting.

GITHUB_LEGACY_APP_WEBHOOK_SECRET = "your-webhook-secret"

Vedi anche

BITBUCKETSERVER_CREDENTIALS

Added in version 4.16.

List for credentials for Bitbucket Data Center.

BITBUCKETSERVER_CREDENTIALS = {
    "git.self-hosted.com": {
        "username": "weblate",
        "token": "http-access-token",
    },
}

The configuration dictionary consists of credentials defined for each API host. The layout is same for almost all version control integrations and is described at Configurazione delle credenziali del controllo versione.

Vedi anche

BITBUCKETCLOUD_CREDENTIALS

Added in version 5.8.

List for credentials for Bitbucket Cloud servers.

BITBUCKETCLOUD_CREDENTIALS = {
    "bitbucket.org": {
        "username": "your-email",
        "workspace": "your-workspace-slug",
        "token": "your-api-token",
    },
}

The configuration dictionary consists of credentials defined for each API host. The API host might be different from what you use in the web browser, for example GitHub API is accessed as api.github.com.

Per ciascun host è disponibile la seguente configurazione:

username

Utente API.

workspace

The user workspace slug.

token

The API token with pullrequest:write permission.

Additional settings not described here can be found at Configurazione delle credenziali del controllo versione.

Vedi anche

AZURE_DEVOPS_CREDENTIALS

Added in version 5.2.

List for credentials for Azure DevOps servers.

AZURE_DEVOPS_CREDENTIALS = {
    "dev.azure.com": {
        "username": "project-name",
        "token": "your-api-token",
        "organization": "organization-name",
    },
}

The configuration dictionary consists of credentials defined for each API host. The API host might be different from what you use in the web browser, for example GitHub API is accessed as api.github.com.

Per ciascun host è disponibile la seguente configurazione:

username

The name of the Azure DevOps project. This is not the repository name.

organization

Il nome dell’organizzazione del progetto.

workItemIds

An optional list of work items IDs from your organization. When provided new pull requests will have these attached.

token

API token for the API user, required.

Additional settings not described here can be found at Configurazione delle credenziali del controllo versione.

Vedi anche

GOOGLE_ANALYTICS_ID

Google Analytics ID to turn on monitoring of Weblate using Google Universal Analytics.

Nota

Google Analytics 4 integration is currently not available for Weblate, please see https://github.com/WeblateOrg/weblate/issues/14015.

HIDE_REPO_CREDENTIALS

Hide repository credentials from the web interface. In case you have repository URL with user and password, Weblate will hide it when related info is shown to users.

For example instead of https://user:password@git.example.com/repo.git it will show just https://git.example.com/repo.git. It tries to clean up VCS error messages too in a similar manner.

Nota

Attivo per impostazione predefinita.

VERSION_DISPLAY

Added in version 5.17.

Controls how prominently Weblate exposes its own version.

I valori supportati sono:

show

Show the version in shared UI such as the footer and expose it in GET /api/metrics/.

soft

Hide the version from prominent shared UI, while keeping it discoverable on the About page and in GET /api/metrics/.

hide

Hide the version from shared UI and GET /api/metrics/. This also makes anonymous documentation links point to the latest documentation instead of the version matching the installed release.

Hiding the version is a recommended security practice in some corporations, but it does not prevent an attacker from inferring the version by probing behavior.

Nota

Il valore predefinito è show.

HIDE_VERSION

Added in version 4.3.1.

Deprecato dalla versione 5.17.

Compatibility alias for VERSION_DISPLAY. Set this to True to get the same behavior as VERSION_DISPLAY = "hide".

INTERNAL_BOT_EMAIL_TEMPLATE

Added in version 2026.7.1.

Template used to generate e-mail addresses for internal Weblate bot accounts. Defaults to "noreply-{scope}-{name}@weblate.org".

It can contain {scope}, {name}, {username}, {site_title}, and {site_domain}.

Use {scope} and {name} when generating the e-mail local part. The {username} value contains the internal scope:name username.

Existing internal bot accounts are updated when migrate is run. Project API token accounts are not affected.

IP_BEHIND_REVERSE_PROXY

Indicates whether Weblate is running behind a reverse proxy.

If set to True, Weblate gets IP address from a header defined by IP_PROXY_HEADER.

Avvertimento

The reverse proxy which connects to Weblate must overwrite the configured header or append a verified peer address at the position selected by IP_PROXY_OFFSET. Weblate does not verify which peer supplied the header, so trusting a client-controlled value allows IP address spoofing.

Ensure that untrusted clients cannot reach Weblate without passing through the trusted proxy.

Nota

This is not on by default.

Vedi anche

IP_PROXY_HEADER

Indicates which header Weblate should obtain the IP address from when IP_BEHIND_REVERSE_PROXY is turned on.

Defaults to HTTP_X_FORWARDED_FOR.

Vedi anche

IP_PROXY_OFFSET

Cambiato nella versione 5.0.1: Il valore predefinito è cambiato da 1 a -1.

Indicates which part of IP_PROXY_HEADER is used as client IP address.

Depending on your setup, this header might consist of several IP addresses, (for example X-Forwarded-For: client-ip, proxy-a, proxy-b) and you can configure which address from the header is used as client IP address here.

Avvertimento

Setting this affects the security of your installation. Select only an address added or verified by a proxy under your control. Addresses supplied by the client are untrusted. Ensure that the selected offset matches how your proxies construct the header.

See <https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-For#security_and_privacy_concerns> for more details.

Predefinito a -1.

Vedi anche

LICENSE_EXTRA

Additional licenses to include in the license choices.

Nota

Each license definition should be a tuple of its short name, a long name, a URL and a boolean, indicating whether it is a libre license.

For example:

LICENSE_EXTRA = [
    (
        "AGPL-3.0",
        "GNU Affero General Public License v3.0",
        "https://www.gnu.org/licenses/agpl-3.0-standalone.html",
        True,
    ),
]

LICENSE_FILTER

Cambiato nella versione 4.3: Setting this to blank value now disables license alert.

Filter list of licenses to show. This also disables the license alert when set to empty.

Nota

This filter uses the short license names.

For example:

LICENSE_FILTER = {"AGPL-3.0", "GPL-3.0-or-later"}

Following disables the license alert:

LICENSE_FILTER = set()

Vedi anche

Translation component diagnostics

LICENSE_REQUIRED

Defines whether the license attribute in Component configuration is required.

Nota

This is off by default.

LIMIT_TRANSLATION_LENGTH_BY_SOURCE_LENGTH

Whether the length of a given translation should be limited. The restriction is the length of the source string × 10 characters.

Suggerimento

Set this to False to allow longer translations (up to 10,000 characters) irrespective of source string length.

Nota

Defaults to True.

LOCALIZE_CDN_URL and LOCALIZE_CDN_PATH

These settings configure the CDN add-ons, including CDN localizzazione JavaScript and File di traduzione CDN. LOCALIZE_CDN_URL defines root URL where the localization CDN is available and LOCALIZE_CDN_PATH defines path where Weblate should store generated files which will be served at the LOCALIZE_CDN_URL. The files are served by your web server or CDN, not by Weblate; see Localizzazione CDN for secure serving guidance.

Suggerimento

On Hosted Weblate, this uses https://weblate-cdn.com/.

Vedi anche

MATOMO_SITE_ID

ID of the site in Matomo (formerly Piwik) you want to use for tracking Weblate.

Nota

This integration does not support the Matomo Tag Manager.

Vedi anche

MATOMO_URL

MATOMO_URL

Full URL (including trailing slash) of a Matomo (formerly Piwik) installation you want to use to track Weblate use. Please check <https://matomo.org/> for more details.

Suggerimento

This integration does not support the Matomo Tag Manager.

For example:

MATOMO_SITE_ID = 1
MATOMO_URL = "https://example.matomo.cloud/"

Vedi anche

MATOMO_SITE_ID

NEARBY_MESSAGES

Numero di stringhe vicine da visualizzare in ciascuna direzione nell’editor completo.

This is just a default value, users can adjust this in Profilo utente.

DEFAULT_PAGE_LIMIT

Added in version 4.7.

Default number of elements to display when pagination is active.

PAGURE_CREDENTIALS

Added in version 4.3.2.

List for credentials for Pagure servers.

PAGURE_CREDENTIALS = {
    "pagure.io": {
        "username": "weblate",
        "token": "your-api-token",
    },
}

The configuration dictionary consists of credentials defined for each API host. The layout is same for almost all version control integrations and is described at Configurazione delle credenziali del controllo versione.

Vedi anche

PASSWORD_MINIMAL_STRENGTH

Added in version 5.10.2.

Minimal password score as evaluated by the zxcvbn password strength estimator.

Defaults to 0, which means strength checking is disabled.

Vedi anche

PASSWORD_RESET_URL

Added in version 5.17.

URL for password reset when authentication is handled by an external identity provider, such as LDAP, SAML, or OAuth.

When set, Forgot your password? on the sign-in page links to this URL instead of Weblate’s built-in password reset page.

PRIVACY_URL

Added in version 4.8.1.

URL where your Weblate instance shows its privacy policy.

Suggerimento

Useful if you host your privacy policy outside Weblate instead of using the Modulo giuridico module. When the legal module is enabled, Weblate links to the internal legal pages by default.

Esempio:

PRIVACY_URL = "https://weblate.org/terms/"

Vedi anche

LEGAL_URL

PRIVATE_COMMIT_EMAIL_OPT_IN

Added in version 4.15.

Configures whether the private commit e-mail is opt-in or opt-out (by default it is opt-in).

Suggerimento

This setting only applies to users which have not explicitly chosen a commit e-mail.

Vedi anche

PRIVATE_COMMIT_EMAIL_TEMPLATE

Added in version 4.15.

Template to generate a private commit e-mail for a user. Defaults to "{username}@users.noreply.{site_domain}".

It can contain {user_id}, {username}, {site_title}, and {site_domain}.

Lascia la stringa vuota per disabilitarla.

Nota

Using a different commit e-mail is opt-in for users unless configured by PRIVATE_COMMIT_EMAIL_OPT_IN. Users can configure their commit e-mail in the Profilo.

PRIVATE_COMMIT_NAME_OPT_IN

Added in version 5.16.

Configures whether the private commit name is opt-in or opt-out (by default it is opt-in).

Suggerimento

This setting only applies to users which have not explicitly chosen a commit name.

Vedi anche

PRIVATE_COMMIT_NAME_TEMPLATE

Added in version 5.16.

Template to generate a private commit name for a user. Defaults to "{site_title} user {user_id}".

It can contain {user_id}, {username}, {site_title}, and {site_domain}.

Lascia la stringa vuota per disabilitarla.

Nota

Using a different commit name is opt-in for users unless configured by PRIVATE_COMMIT_NAME_OPT_IN. Users can configure their commit name in the Profilo.

PROJECT_BACKUP_KEEP_COUNT

Added in version 4.14.

Defines how many backups per project are kept on the server. Defaults to 3.

Vedi anche

Backup a livello di progetto

PROJECT_BACKUP_KEEP_DAYS

Added in version 4.14.

Defines how long the project backups will be kept on the server. Defaults to 30 days.

Vedi anche

Backup a livello di progetto

PROJECT_BACKUP_UPLOAD_MAX_SIZE

Added in version 5.17.1.

Configures the maximum size, in bytes, for uploaded project backup ZIP files. Defaults to 536870912 bytes (512 MiB).

In Docker, configure this using the WEBLATE_PROJECT_BACKUP_UPLOAD_MAX_SIZE environment variable. Docker setups can also be constrained by CLIENT_MAX_BODY_SIZE; other deployments can be constrained by their reverse proxy request body-size limit.

Vedi anche

Backup a livello di progetto

PROJECT_BACKUP_IMPORT_MAX_MEMBERS

Added in version 5.17.

Defines the maximum number of ZIP entries allowed when importing a project backup.

This is a safeguard against malformed or intentionally fragmented archives. Defaults to 100000 entries.

In Docker, configure this using the WEBLATE_PROJECT_BACKUP_IMPORT_MAX_MEMBERS environment variable.

Vedi anche

Backup a livello di progetto

PROJECT_BACKUP_IMPORT_MAX_TOTAL_UNCOMPRESSED_SIZE

Added in version 5.17.1.

Defines the maximum total uncompressed size, in bytes, for ZIP entries in an imported project backup. Defaults to 536870912 bytes (512 MiB).

This limits archives that are small when uploaded but expand to much more data during validation or restore.

In Docker, configure this using the WEBLATE_PROJECT_BACKUP_IMPORT_MAX_TOTAL_UNCOMPRESSED_SIZE environment variable.

Vedi anche

Backup a livello di progetto

PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_SIZE

Added in version 5.17.

Defines the maximum uncompressed size, in bytes, for a single highly compressed ZIP entry in an imported project backup.

This limit is only applied to entries that are large enough and compress enough to look suspicious. Large low-compression files are intentionally allowed here and are expected to be constrained by the HTTP upload limit. Defaults to 262144000 bytes (250 MiB).

In Docker, configure this using the WEBLATE_PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_SIZE environment variable.

Vedi anche

Backup a livello di progetto

PROJECT_BACKUP_IMPORT_MIN_RATIO_SIZE

Added in version 5.17.

Defines the minimum uncompressed size, in bytes, at which Weblate starts considering the ZIP compression ratio during project backup import.

Smaller files are ignored for the compression-ratio-based validation to avoid rejecting reasonably sized files that compress well. Defaults to 1048576 bytes (1 MiB).

In Docker, configure this using the WEBLATE_PROJECT_BACKUP_IMPORT_MIN_RATIO_SIZE environment variable.

Vedi anche

Backup a livello di progetto

PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_RATIO

Added in version 5.17.

Defines the maximum allowed ratio between the uncompressed and compressed size for a large ZIP entry during project backup import.

This is used together with PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_SIZE and PROJECT_BACKUP_IMPORT_MIN_RATIO_SIZE to detect suspiciously compressed entries while still allowing large repository pack files and other low-compression content. Defaults to 250.

In Docker, configure this using the WEBLATE_PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_RATIO environment variable.

Vedi anche

Backup a livello di progetto

PROJECT_NAME_RESTRICT_RE

Added in version 4.15.

Defines a regular expression to restrict project naming. Any matching names will be rejected.

Vedi anche

Nome del progetto

PROJECT_WEB_RESTRICT_HOST

Added in version 4.16.2.

Reject using certain hosts in project website. Any subdomain is matched, so including example.com will block test.example.com as well. The list should contain lower case strings only, the parsed domain is lower cased before matching.

Configurazione predefinita:

PROJECT_WEB_RESTRICT_HOST = {"localhost"}

Vedi anche

PROJECT_WEB_RESTRICT_ALLOWLIST

Added in version 5.17.

Defines a set of project slugs exempt from PROJECT_WEB_RESTRICT_HOST, PROJECT_WEB_RESTRICT_NUMERIC, PROJECT_WEB_RESTRICT_PRIVATE, and PROJECT_WEB_RESTRICT_RE when validating the project website. Project slugs are matched case-insensitively.

Attenzione

This exemption weakens outbound URL protections for matching projects, including the private-target restriction enforced by PROJECT_WEB_RESTRICT_PRIVATE. Use it only for trusted, administrator-managed projects where bypassing these checks is intentional.

Configurazione predefinita:

PROJECT_WEB_RESTRICT_ALLOWLIST = set()

Vedi anche

PROJECT_WEB_RESTRICT_NUMERIC

Added in version 4.16.2.

Reject using numeric IP address in project website. On by default.

Vedi anche

PROJECT_WEB_RESTRICT_PRIVATE

Added in version 5.17.

Reject using project website and repository browser URLs pointing to internal or non-public addresses. On by default.

Vedi anche

PROJECT_WEB_RESTRICT_RE

Added in version 4.15.

Defines a regular expression to limit what can be entered as Sito web del progetto. Any matching URLs will be rejected.

Vedi anche

WEBHOOK_PRIVATE_ALLOWLIST

Added in version 5.17.

Defines hostnames or domains exempt from WEBHOOK_RESTRICT_PRIVATE for outbound webhook delivery. Entries follow Django host matching semantics, so values such as hooks.internal.example or .internal.example can be used.

Configurazione predefinita:

WEBHOOK_PRIVATE_ALLOWLIST = []

Vedi anche

WEBHOOK_RESTRICT_PRIVATE

Added in version 5.17.

Reject webhook URLs pointing to internal or non-public addresses unless the target host is included in WEBHOOK_PRIVATE_ALLOWLIST. On by default.

When enabled, hostnames that cannot be resolved during validation are rejected unless they are explicitly included in WEBHOOK_PRIVATE_ALLOWLIST.

Vedi anche

PUBLIC_ENGAGE

Added in version 5.16.2.

Allows public engage page even with REQUIRE_LOGIN.

Vedi anche

REPORT_EXPIRY

Defines how many days generated translation reports are retained. Defaults to 90 days. Changing the value also changes when existing reports become eligible for removal by the daily cleanup task.

RATELIMIT_NOTIFICATION_LIMITS

Added in version 5.14.

Limits how many notifications for a single user will be sent out.

L’impostazione predefinita è:

# Multi-level rate limiting for email notifications
# Each tuple contains (max_emails, time_window_seconds)
RATELIMIT_NOTIFICATION_LIMITS = [
    # Prevent burst sends - 3 emails per 2 minutes
    (3, 120),
    # Equalize to avoid getting blocked for too long - 10 emails per hour
    (10, 3600),
    # Daily limit: 50 emails per day
    (50, 86400),
]

API_RATELIMIT_ANON

Added in version 2026.10.

Default anonymous API rate limit. Defaults to "100/day". Rates use a request count and a period of seconds, minutes, hours, or days, for example "100/hour". A zero count rejects every request covered by this throttle; None disables this throttle. Anonymous requests without an IP override are also subject to API_RATELIMIT_USER.

API_RATELIMIT_USER

Added in version 2026.10.

Default authenticated API rate limit. Defaults to "5000/hour". Uses the same rate syntax as API_RATELIMIT_ANON. Authenticated requests are counted per user; anonymous requests are counted per client IP. Set None to disable this throttle.

API_RATELIMIT_USER_OVERRIDES

Added in version 2026.10.

Mapping of exact usernames to API rate limits. Defaults to an empty dictionary. Override rates require a positive request count, or None for an exemption. These rules take precedence over API_RATELIMIT_IP_OVERRIDES.

API_RATELIMIT_USER_OVERRIDES = {"automation": "20000/hour"}

API_RATELIMIT_IP_OVERRIDES

Added in version 2026.10.

Mapping of IPv4 or IPv6 addresses and CIDR networks to API rate limits. Defaults to an empty dictionary. The most specific matching network applies to both anonymous and authenticated requests, unless a username override matches. CIDRs must specify network addresses; duplicate normalized networks are rejected. Override rates require a positive request count, or None for an exemption.

API_RATELIMIT_IP_OVERRIDES = {
    "192.0.2.42": None,
    "198.51.100.0/24": "10000/hour",
    "2001:db8::/48": "10000/hour",
}

See API rate limiting for counting behavior and trusted proxy requirements.

RATELIMIT_ATTEMPTS

Maximum number of authentication attempts before rate limiting is applied.

Defaults to 5.

Vedi anche

RATELIMIT_WINDOW

How long authentication is accepted after rate limiting applies.

An amount of seconds, defaulting to 300 (5 minutes).

Vedi anche

RATELIMIT_LOCKOUT

How long authentication is locked after rate limiting applies.

An amount of seconds defaulting to 600 (10 minutes).

Vedi anche

REGISTRATION_ALLOW_BACKENDS

Added in version 4.1.

List of authentication backends to allow registration from. This only limits new registrations, users can still authenticate and add authentication using all configured authentication backends.

It is recommended to keep REGISTRATION_OPEN on while limiting registration backends, otherwise users will be able to register, but Weblate will not show links to register in the user interface.

Esempio:

REGISTRATION_ALLOW_BACKENDS = ["azuread-oauth2", "azuread-tenant-oauth2"]

Suggerimento

The backend names match names used in the URL for authentication.

Vedi anche

REGISTRATION_CAPTCHA

Whether registration of new accounts is protected by a CAPTCHA. Defaults to enabled.

If turned on, a CAPTCHA is added to all pages where a user enters their e-mail address:

  • New account registration.

  • Password recovery.

  • Adding e-mail to an account.

  • Contact form for users that are not signed in.

The protection currently consists of following steps:

REGISTRATION_EMAIL_MATCH

Allows you to filter which e-mail addresses can register.

Defaults to .*, which allows any e-mail address to be registered.

You can use it to restrict registration to a single e-mail domain:

REGISTRATION_EMAIL_MATCH = r"^.*@weblate\.org$"

REGISTRATION_ALLOW_DISPOSABLE_EMAILS

Added in version 5.16.1.

Allow registration with disposable e-mail domains. When enabled, the disposable domain blocklist is bypassed. Default is False.

Vedi anche

REGISTRATION_OPEN

Whether registration of new accounts is currently permitted. Defaults to enabled.

This setting affects built-in authentication by e-mail address or through the Python Social Auth (you can allow certain back-ends using REGISTRATION_ALLOW_BACKENDS).

Nota

If using third-party authentication methods such as LDAP authentication, it just hides the registration form, but new users might still be able to sign in and create accounts.

Vedi anche

REGISTRATION_REBIND

Added in version 4.16.

Allow rebinding authentication backends for existing users. Turn this on when migrating between authentication providers.

Nota

Off by default to not allow adding other authentication backends to an existing account. Rebinding can lead to account compromise when using more third-party authentication backends.

REPOSITORY_ALERT_THRESHOLD

Added in version 4.0.2.

Threshold for triggering an alert for outdated repositories, or ones that contain too many changes. Defaults to 25.

Vedi anche

Translation component diagnostics

REQUIRE_LOGIN

Added in version 4.1.

This enables django.contrib.auth.middleware.LoginRequiredMiddleware and configures REST framework to require authentication for all API endpoints.

Cambiato nella versione 5.15: Weblate now relies on Django built-in middleware.

Nota

This is implemented in the Sample configuration. For Docker, use WEBLATE_REQUIRE_LOGIN.

GOOGLE_CLOUD_ERROR_REPORTING

Configuration for Collecting error reports and monitoring performance using Google Cloud Error Reporting. Set to None to disable the integration, or set to a dictionary of keyword arguments for the Google Cloud Error Reporting client.

Weblate automatically supplies service as weblate and version as the current Weblate version or Git revision. Explicit values in the dictionary override these defaults.

OPENTELEMETRY_ENABLED

Added in version 2026.6.

Enable backend tracing using OpenTelemetry. Disabled by default.

Traces are exported only when this is enabled and OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT is configured.

OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT

OTLP HTTP traces endpoint for OpenTelemetry, for example https://collector.example.com/v1/traces.

OPENTELEMETRY_EXPORTER_OTLP_HEADERS

Additional HTTP headers for the OpenTelemetry OTLP exporter. Defaults to an empty dictionary.

OPENTELEMETRY_EXTRA_RESOURCE_ATTRIBUTES

Additional OpenTelemetry resource attributes. Defaults to an empty dictionary.

OPENTELEMETRY_SERVICE_NAME

OpenTelemetry service name. Defaults to weblate.

OPENTELEMETRY_TRACES_SAMPLE_RATE

Configure sampling rate for OpenTelemetry traces. Set to 1 to trace all events, 0 (the default) disables tracing.

SENTRY_DSN

Sentry DSN to use for Collecting error reports and monitoring performance.

Vedi anche

Django integration for Sentry

SENTRY_ENVIRONMENT

Configures environment for Sentry. Defaults to devel.

SENTRY_MONITOR_BEAT_TASKS

Added in version 5.13.

Configure whether to monitor Celery Beat tasks with Sentry. Defaults to True.

SENTRY_PROFILES_SAMPLE_RATE

Configure sampling rate for performance monitoring. Set to 1 to profile all traced events (the default), 0 disables profiling.

Vedi anche

Sentry Performance Monitoring

SENTRY_SEND_PII

Allow Sentry to collect certain personally identifiable information. Turned off by default.

Cambiato nella versione 5.7: Ora è disattivato per impostazione predefinita, prima era attivato.

SENTRY_TRACES_SAMPLE_RATE

Configure sampling rate for profiling monitoring. Set to 1 to trace all events, 0 (the default) disables tracing.

Vedi anche

Sentry Profiling

SIMPLIFY_LANGUAGES

Use simple language codes for default language/country combinations. For example an fr_FR translation will use the fr language code. This is usually the desired behavior, as it simplifies listing languages for these default combinations.

Turn this off if you want to different translations for each variant.

HIDE_SHARED_GLOSSARY_COMPONENTS

Added in version 5.16.

Glossary components are typically shared into other projects to make them available for translation work. When these are visible in the component list of projects that are using them, it can cause confusion or distract translators from the actual components that are meant to be translated.

Questa opzione è disattivata per impostazione predefinita, rendendo visibili i componenti del glossario condiviso.

SITE_DOMAIN

Configures site domain. Necessary to produce correct absolute links in many scopes (for example activation e-mails, notifications or RSS feeds).

If Weblate is running on a non-standard port, include it here as well.

Esempi:

# Production site with domain name
SITE_DOMAIN = "weblate.example.com"

# Local development with IP address and port
SITE_DOMAIN = "127.0.0.1:8000"

Nota

This setting should only contain the domain name. For configuring protocol, (turning on and enforcing HTTPS) use ENABLE_HTTPS and for changing the URL, use URL_PREFIX.

Suggerimento

On a Docker container, the site domain is configured through WEBLATE_ALLOWED_HOSTS.

Vedi anche

SITE_TITLE

Site title to be used for the website and sent e-mails.

SPECIAL_CHARS

Additional characters to include in the visual keyboard, Visual keyboard.

The default value is:

SPECIAL_CHARS = ("\t", "\n", "\u00a0", "…")

SINGLE_PROJECT

Redirects users directly to a project or component instead of showing the dashboard. You can either set it to True so it only works if there is actually only single project in Weblate. Alternatively, set the project slug, and it will redirect unconditionally to this project.

Esempio:

SINGLE_PROJECT = "test"

SSH_EXTRA_ARGS

Added in version 4.9.

Allows adding custom parameters when Weblate is invoking SSH. Useful when connecting to servers using legacy encryption or other non-standard features.

For example when SSH connection in Weblate fails with Unable to negotiate with legacyhost: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1, you can turn that on using:

SSH_EXTRA_ARGS = "-oKexAlgorithms=+diffie-hellman-group1-sha1"

Suggerimento

The string is evaluated by the shell, so ensure any whitespace and special characters is quoted.

Avvertimento

This is trusted administrator-controlled configuration. Arbitrary SSH options can alter connection routing and override the address pinning provided by VCS_RESTRICT_PRIVATE. Administrators are responsible for the security and compatibility impact of all configured arguments.

Vedi anche

OpenSSH Legacy Options

STATUS_URL

The URL where your Weblate instance reports its status.

SUPPORT_STATUS_CHECK

Added in version 5.5.

Disables semiannual support status check and redirecting superusers upon login to the donation page in case there is no active support subscription.

Suggerimento

Improve your Weblate experience by purchasing a support subscription and boosting Weblate progress instead of turning this off.

TRANSLATION_UPLOAD_MAX_SIZE

Added in version 5.17.1.

Configures the maximum size, in bytes, for uploaded translation files. Defaults to 50 MB.

In Docker, configure this using the WEBLATE_TRANSLATION_UPLOAD_MAX_SIZE environment variable.

UNUSED_ALERT_DAYS

Added in version 4.17.

Configures when the Component seems unused alert is triggered.

Defaults to 365 days, set to 0 to turn it off.

UPDATE_LANGUAGES

Added in version 4.3.2.

Controls whether languages database should be updated when running database migration and is on by default. This setting has no effect on invocation of setuplang.

Avvertimento

The languages display might become inconsistent with this. Weblate language definitions expand over time and it will not display language code for the defined languages.

Vedi anche

Definizioni linguistiche integrate

URL_PREFIX

This setting allows you to run Weblate under some path (otherwise it relies on being run from the webserver root).

Nota

To use this setting, you also need to configure your server to strip this prefix. For example with WSGI, this can be achieved by setting WSGIScriptAlias.

Suggerimento

The prefix should start with a /.

Esempio:

URL_PREFIX = "/translations"

Nota

This setting does not work with Django’s built-in server, you would have to adjust urls.py to contain this prefix.

VCS_ALLOW_HOSTS

Added in version 5.15.

A set of hosts to allow when configuring VCS URL. Defaults to an empty set, which does no filtering at all.

When VCS_RESTRICT_PRIVATE is enabled, matching hosts are also exempt from the private-target restriction. This exemption is also needed for VCS backends which cannot bind the client connection to the address validated by Weblate, such as Mercurial and Subversion.

Use VCS_PRIVATE_ALLOWLIST instead when hosts should be exempt from the private-target restriction without filtering access to other public hosts.

VCS_PRIVATE_ALLOWLIST

Added in version 2026.9.

Defines hostnames or domains exempt from VCS_RESTRICT_PRIVATE. Unlike VCS_ALLOW_HOSTS, this setting does not filter access to other hosts. Entries follow Django host matching semantics, so values such as vcs.internal.example or .internal.example can be used.

The exemption is needed for VCS backends which cannot bind the client connection to the address validated by Weblate, such as Mercurial and Subversion. It can also be used to allow private Git repository hosts.

When VCS_ALLOW_HOSTS is non-empty, its host filter still applies and takes precedence over this allowlist.

Configurazione predefinita:

VCS_PRIVATE_ALLOWLIST = []

Vedi anche

VCS_ALLOW_SCHEMES

Added in version 5.15.

A set of URL schemes to allow when configuring VCS URL. Only https and ssh are allowed by default.

VCS_RESTRICT_PRIVATE

Added in version 5.17.

Reject VCS repository URLs pointing to internal or non-public addresses unless the target host is included in VCS_ALLOW_HOSTS or matches VCS_PRIVATE_ALLOWLIST. On by default.

When enabled, hostnames that cannot be resolved during validation are rejected unless they are trusted by VCS_ALLOW_HOSTS or VCS_PRIVATE_ALLOWLIST.

For Git repositories accessed over HTTPS or SSH, Weblate binds each VCS command to the addresses approved during runtime validation for direct connections. Configured HTTP proxies are trusted infrastructure and resolve repository hostnames instead. Automatic redirect following remains disabled. Permanent same-host HTTP redirects are probed separately through the same outbound route, validated, and stored as the canonical component repository URL. Cross-host redirects have to be configured manually. Mercurial, Subversion, custom VCS backends, and additional URL schemes are rejected unless the target host is trusted by VCS_ALLOW_HOSTS or VCS_PRIVATE_ALLOWLIST.

Network-level egress filtering which blocks internal, loopback, link-local, reserved, and cloud metadata address ranges is recommended as defense in depth, especially for custom integrations and administrator-installed extensions.

VCS_API_DELAY

Added in version 4.15.1.

Configures minimal delay in seconds between third-party API calls in Richieste di pull GitHub, Richieste di unione di GitLab, Gitea pull requests, Richieste di unione di pagine, and Azure DevOps pull requests.

This rate-limits API calls from Weblate to these services to avoid overloading them.

If you are being limited by secondary rate-limiter at GitHub, increasing this might help.

The default value is 10.

VCS_API_TIMEOUT

Added in version 5.15.

Configures timeout in seconds for third-party API calls such as forking or creating merge requests in Richieste di pull GitHub, Richieste di unione di GitLab, Gitea pull requests, Richieste di unione di pagine, and Azure DevOps pull requests.

The default value is 10.

VCS_BACKENDS

Configuration of available VCS backends.

Nota

Weblate offers configured backends when their required commands are available. Exact command versions are validated by the deployment and periodic configuration health checks.

Suggerimento

You can limit choices or add custom VCS back-ends by using this.

VCS_BACKENDS = ("weblate.vcs.git.GitRepository",)

Vedi anche

Integrazione controllo versione

VCS_CLONE_DEPTH

Configures how deep cloning of repositories Weblate should do.

Nota

Currently this is only supported in Git. By default Weblate does shallow clones of the repositories to make cloning faster and save disk space. Depending on your usage (for example when using custom Add-on), you might want to increase the depth or turn off shallow clones completely by setting this to 0.

Suggerimento

In case you get fatal: protocol error: expected old/new/ref, got 'shallow <commit hash>' error when pushing from Weblate, turn off shallow clones completely by setting:

VCS_CLONE_DEPTH = 0

WEBLATE_ADDONS

List of add-ons available for use. To use them, they have to be enabled for a given translation component. By default this includes all built-in add-ons, when extending the list you will probably want to keep existing ones enabled, for example:

WEBLATE_ADDONS = (
    # Built-in add-ons
    "weblate.addons.gettext.GenerateMoAddon",
    "weblate.addons.gettext.UpdateLinguasAddon",
    "weblate.addons.gettext.UpdateConfigureAddon",
    "weblate.addons.gettext.MsgmergeAddon",
    "weblate.addons.cleanup.CleanupAddon",
    "weblate.addons.consistency.LanguageConsistencyAddon",
    "weblate.addons.discovery.DiscoveryAddon",
    "weblate.addons.flags.SourceEditAddon",
    "weblate.addons.flags.TargetEditAddon",
    "weblate.addons.flags.SameEditAddon",
    "weblate.addons.flags.BulkEditAddon",
    "weblate.addons.generate.GenerateFileAddon",
    "weblate.addons.properties.PropertiesSortAddon",
    "weblate.addons.git.GitSquashAddon",
    "weblate.addons.removal.RemoveComments",
    "weblate.addons.removal.RemoveSuggestions",
    "weblate.addons.resx.ResxUpdateAddon",
    "weblate.addons.autotranslate.AutoTranslateAddon",
    "weblate.addons.cdn.CDNJSAddon",
    # Add-on you want to include
    "weblate.addons.example.ExampleAddon",
)

Nota

Removing the add-on from the list does not uninstall it from the components. Weblate will crash in that case. Please uninstall the add-on from all components prior to removing it from this list.

Vedi anche

ADDON_ACTIVITY_LOG_EXPIRY

Added in version 5.6.

Configures how long activity logs for add-ons are kept. Defaults to 180 days.

WEBLATE_EXPORTERS

Added in version 4.2.

List of available exporters offering translation downloads or glossaries in various file formats.

Vedi anche

Formati dei file di localizzazione

WEBLATE_FORMATS

List of file formats available for use.

Nota

The default list already has the common formats.

Vedi anche

Formati dei file di localizzazione

WEBLATE_MACHINERY

Added in version 4.13.

List of machinery services available for use.

Vedi anche

WEBLATE_GPG_IDENTITY

Identity used by Weblate to sign Git commits, for example:

WEBLATE_GPG_IDENTITY = "Weblate <weblate@example.com>"

The Weblate GPG keyring is searched for a matching key (home/.gnupg under DATA_DIR). If not found, a key is generated, please check Signing Git commits with GnuPG for more details.

Vedi anche

Signing Git commits with GnuPG

WEBSITE_REQUIRED

Defines whether Sito web del progetto has to be specified when creating a project. On by default, as that suits public server setups.

WEBSITE_ALERTS_ENABLED

Added in version 5.17.

Default: True

Defines whether Weblate should check project website availability and show alerts for unreachable project websites.

When set to False, Weblate will skip website availability checks and will not generate project website alerts. This is useful when:

  • Your websites are behind firewalls that block Weblate’s requests

  • You want to avoid 403/503-type errors from bot protection

  • Project website availability is not a concern for your installation

Vedi anche

WEBSITE_REQUIRED

Configurazione delle credenziali del controllo versione

Suggerimento

This section describes VCS credential variables as GITHUB_CREDENTIALS, GITLAB_CREDENTIALS, GITEA_CREDENTIALS, PAGURE_CREDENTIALS, BITBUCKETSERVER_CREDENTIALS.

The configuration dictionary consists of credentials defined for each API host. The API host might be different from what you use in the web browser, for example GitHub API is accessed as api.github.com.

The credentials can also be overridden in URL di invio al repository or Repository codice sorgente (if push URL is not configured), these take precedence over the ones specified in the configuration file.

Per ciascun host è disponibile la seguente configurazione:

username

API user, required.

token

API token for the API user, required.

scheme

Added in version 4.18.

Scheme override. Weblate attempts to parse scheme from the repository URL and falls backs to https. If you are running the API server internally, you might want to use http instead, but consider security.

Suggerimento

In the Docker container, the credentials can be configured using environment variables, see Code-hosting sites credentials.