# Configuration All settings are stored in `settings.py` (as is usual for Django). #### NOTE After changing any of these settings, you need to restart Weblate — both WSGI and Celery processes. In case it is run as `mod_wsgi`, you need to restart Apache to reload the configuration. #### SEE ALSO Please also check [Django’s documentation](https://docs.djangoproject.com/en/stable/ref/settings/) for parameters configuring Django itself. ## ADMINS_CONTACT Configures where contact form sends e-mails. If not configured, e-mail addresses from [`ADMINS`](https://docs.weblate.org/no/latest/admin/install.md#std-setting-ADMINS) are used. Configure this as a list of e-mail addresses: ```python ADMINS_CONTACT = ["admin@example.com", "support@example.com"] ``` #### SEE ALSO * [`CONTACT_FORM`](#std-setting-CONTACT_FORM) * [`ADMINS`](https://docs.weblate.org/no/latest/admin/install.md#std-setting-ADMINS) ## ALLOWED_ASSET_DOMAINS #### Versionadded Added in version 5.14. Configures which domains are allowed for fetching assets in Weblate. This enhances security by preventing loading assets from untrusted sources. Assets are downloaded once by the Weblate server and stored locally, rather than being served directly from external domains to users. The allowlist is applied to the initial URL and to every HTTP redirect target before Weblate follows it. Redirects to hosts outside of this allowlist are rejected. It expects a list of host/domain names. You can use fully qualified names (e.g `www.example.com`) or prepend with a period as a wildcard to match all subdomains (e.g `.example.com` will match `cdn.example.com` or `static.example.com`). Defaults to `["*"]`, which allows all domains. **Example** ```python ALLOWED_ASSET_DOMAINS = [ # Allows only cdn.anotherdomain.org "cdn.anotherdomain.org", # Allows example.com and all its subdomains ".example.com", ] ``` This is currently used in the following places: * Screenshot uploads, see [Screenshots and visual context](https://docs.weblate.org/no/latest/admin/translating.md#screenshots) * Remote HTML downloads for the [JavaScript localization CDN](https://docs.weblate.org/no/latest/admin/addons.md#addon-weblate-cdn-cdnjs) add-on #### SEE ALSO * [`ALLOWED_ASSET_SIZE`](#std-setting-ALLOWED_ASSET_SIZE) * [`ASSET_RESTRICT_PRIVATE`](#std-setting-ASSET_RESTRICT_PRIVATE) * [`ASSET_PRIVATE_ALLOWLIST`](#std-setting-ASSET_PRIVATE_ALLOWLIST) ## ALLOWED_MACHINERY_DOMAINS Configures which custom machinery domains are explicitly allowed in project-level machine translation configuration. This setting applies only to machinery services and does not affect [`ALLOWED_ASSET_DOMAINS`](#std-setting-ALLOWED_ASSET_DOMAINS). It expects a list of host/domain names. You can use fully qualified names or prepend with a period as a wildcard to match all subdomains. Defaults to `[]`. The allowlist affects project-managed machinery in two ways: it permits the configured endpoint during outbound validation, and it marks matching hosts as trusted when deciding whether remote provider error details or response bodies can be shown to the user. Matching hosts are also exempt from private-target restrictions. For direct connections, Weblate does not resolve, pin, or verify the peer address of matching hosts. Only add hosts or domains whose network destinations are trusted. When a configured [HTTP proxy](https://docs.weblate.org/no/latest/admin/install.md#http-proxy) is used, the proxy is trusted to resolve the destination hostname. ## ALLOWED_ASSET_SIZE #### Versionadded Added in version 5.14. Configures size limit in bytes for fetching or uploading assets into Weblate. Defaults to 10 MB. #### SEE ALSO * [Screenshots and visual context](https://docs.weblate.org/no/latest/admin/translating.md#screenshots) * [Managing fonts](https://docs.weblate.org/no/latest/admin/checks.md#fonts) * [`ALLOWED_ASSET_DOMAINS`](#std-setting-ALLOWED_ASSET_DOMAINS) ## ASSET_PRIVATE_ALLOWLIST #### Versionadded Added in version 2025.5. Defines hostnames or domains exempt from [`ASSET_RESTRICT_PRIVATE`](#std-setting-ASSET_RESTRICT_PRIVATE) for remote asset downloads that enforce private-target checks. Entries follow Django host matching semantics, so values such as `assets.internal.example` or `.internal.example` can be used. This does not replace [`ALLOWED_ASSET_DOMAINS`](#std-setting-ALLOWED_ASSET_DOMAINS); remote assets must still match the asset domain allowlist. Default configuration: ```python ASSET_PRIVATE_ALLOWLIST = [] ``` #### SEE ALSO * [`ALLOWED_ASSET_DOMAINS`](#std-setting-ALLOWED_ASSET_DOMAINS) * [`ASSET_RESTRICT_PRIVATE`](#std-setting-ASSET_RESTRICT_PRIVATE) ## ASSET_RESTRICT_PRIVATE #### Versionadded Added in version 2025.5. Reject remote asset URLs pointing to internal or non-public addresses unless the target host is included in [`ASSET_PRIVATE_ALLOWLIST`](#std-setting-ASSET_PRIVATE_ALLOWLIST). On by default. When enabled, hostnames that cannot be resolved during validation are rejected unless they are explicitly included in [`ASSET_PRIVATE_ALLOWLIST`](#std-setting-ASSET_PRIVATE_ALLOWLIST). This currently applies to screenshot URL uploads and remote HTML downloads for the [JavaScript localization CDN](https://docs.weblate.org/no/latest/admin/addons.md#addon-weblate-cdn-cdnjs) add-on. #### SEE ALSO * [Screenshots and visual context](https://docs.weblate.org/no/latest/admin/translating.md#screenshots) * [JavaScript localization CDN](https://docs.weblate.org/no/latest/admin/addons.md#addon-weblate-cdn-cdnjs) * [`ALLOWED_ASSET_DOMAINS`](#std-setting-ALLOWED_ASSET_DOMAINS) * [`ASSET_PRIVATE_ALLOWLIST`](#std-setting-ASSET_PRIVATE_ALLOWLIST) ## ALTCHA_COST #### Versionadded Added in version 2025.5. Argon2id time cost for the ALTCHA proof-of-work challenge. Defaults to `3`. Replaces `ALTCHA_MAX_NUMBER`, which applied to the removed ALTCHA widget v2. ## ALTCHA_MEMORY_COST #### Versionadded Added in version 2025.5. Argon2id memory cost in KiB. Defaults to `65536`. ## ALTCHA_PARALLELISM #### Versionadded Added in version 2025.5. Argon2id parallelism factor. Defaults to `1`. #### SEE ALSO [ALTCHA Proof of Work Mechanism](https://altcha.org/docs/integration/proof-of-work-captcha/) ## ANONYMOUS_USER_NAME Username of users that are not signed in. #### SEE ALSO [Access control](https://docs.weblate.org/no/latest/admin/access.md#access-control) ## AUDITLOG_EXPIRY The maximum number of days Weblate will keep audit logs containing information about the account activity. Defaults to 180 days. ## AUTH_LOCK_ATTEMPTS Maximum number of failed authentication attempts before rate limiting is applied. This is currently applied in the following locations: * Sign in. Deletes the account password, preventing the user from signing in without requesting a new password. * Second-factor sign in. Deletes the account password after this many rejected second-factor submissions since the last successful second-factor sign in. This also invalidates pending password sign-ins. Other authentication methods and API tokens remain usable. * Password reset. Prevents new e-mails from being sent, avoiding spamming users with too many password-reset attempts. Defaults to 10. #### SEE ALSO [Rate limiting](https://docs.weblate.org/no/latest/admin/optionals.md#rate-limit) ## AUTO_UPDATE Updates all repositories on a daily basis. Every hour, Weblate queues updates for repositories whose component ID modulo 24 matches the current UTC hour. This distributes updates throughout the day. For example, component ID `25` is selected during the hour from 01:00 to 01:59 UTC. Linked components use the schedule of the component that owns their shared repository. The assigned hour determines when updates are queued, not when they finish. Execution can be delayed by queued tasks or repository operations. Restarting Celery does not change the assigned hour. This setting does not provide a configurable update time window. #### HINT Useful if you are not using [Notification hooks](https://docs.weblate.org/no/latest/api.md#hooks) to update Weblate repositories automatically. #### NOTE On/off options exist in addition to string selection for backward compatibility. The options are: `"none"` : No daily updates. `"remote"` also `False` : Fetch remote changes without merging them into the working copy. This is the default; `False` does not disable daily updates. `"full"` also `True` : Fetch remote changes and merge them into the working copy. #### NOTE Automatic updates require that [Background tasks using Celery](https://docs.weblate.org/no/latest/admin/install.md#celery) is working. Restart Celery after changing this setting for the new value to take effect. ## AVATAR_URL_PREFIX Prefix for constructing avatar URLs as: `${AVATAR_URL_PREFIX}/avatar/${MAIL_HASH}?${PARAMS}`. The following services are known to work: Gravatar (default), as per [https://gravatar.com/](https://gravatar.com/) : `AVATAR_URL_PREFIX = 'https://www.gravatar.com/'` Libravatar, as per [https://www.libravatar.org/](https://www.libravatar.org/) : `AVATAR_URL_PREFIX = 'https://www.libravatar.org/'` #### SEE ALSO * [Avatar caching](https://docs.weblate.org/no/latest/admin/install.md#production-cache-avatar) * [`ENABLE_AVATARS`](#std-setting-ENABLE_AVATARS) * [Avatars](https://docs.weblate.org/no/latest/admin/optionals.md#avatars) ## AVATAR_URL_TEMPLATE #### Versionadded Added in version 2026.10. Template to generate avatar URLs. Defaults to `"{AVATAR_URL_PREFIX}avatar/{mail_hash}?{querystring}"`. It can contain `{AVATAR_URL_PREFIX}`, `{mail_hash}`, `{querystring}`, `{username}`, and `{size}`. For example, to fetch avatars by username instead of e-mail hash (as needed by Codeberg’s Forgejo-backed avatar service): ```default AVATAR_URL_TEMPLATE = "{AVATAR_URL_PREFIX}avatar/{username}/{size}" ``` #### SEE ALSO * [`AVATAR_URL_PREFIX`](#std-setting-AVATAR_URL_PREFIX) * [Avatar caching](https://docs.weblate.org/no/latest/admin/install.md#production-cache-avatar) * [`ENABLE_AVATARS`](#std-setting-ENABLE_AVATARS) * [Avatars](https://docs.weblate.org/no/latest/admin/optionals.md#avatars) ## AUTH_TOKEN_VALID How long the authentication token and temporary password from password reset e-mails is valid for. Set in number of seconds, defaulting to 172800 (2 days). E-mail validation codes are checked against this lifetime when used, even if scheduled cleanup has not yet removed them. This does not set a deadline for other authentication pipeline steps. ## AUTH_PASSWORD_DAYS How many days Weblate rejects reusing a previously used password for a user. The checking is based on the audit log, [`AUDITLOG_EXPIRY`](#std-setting-AUDITLOG_EXPIRY) needs to be at least same as this. #### NOTE Password changes made prior to Weblate 2.15 will not be accounted for in this policy. Defaults to 180 days. ## AUTOFIX_LIST List of automatic fixes to apply when saving a string. #### NOTE Provide a fully-qualified path to the Python class that implements the autofixer interface. Available fixes are described at [Automatic fixups](https://docs.weblate.org/no/latest/user/checks.md#autofix). You can select which ones to use: ```python AUTOFIX_LIST = ( "weblate.trans.autofixes.whitespace.SameBookendingWhitespace", "weblate.trans.autofixes.chars.ReplaceTrailingDotsWithEllipsis", ) ``` #### SEE ALSO * [Automatic fixups](https://docs.weblate.org/no/latest/user/checks.md#autofix) * [Custom automatic fixups](https://docs.weblate.org/no/latest/admin/checks.md#custom-autofix) * [Custom quality checks, add-ons, automatic suggestions and auto-fixes](https://docs.weblate.org/no/latest/admin/customize.md#custom-modules) ## BACKGROUND_TASKS #### Versionadded Added in version 4.5.2. Defines how often lengthy maintenance tasks should be triggered for a component. Right now this controls: * [Automatic translation](https://docs.weblate.org/no/latest/admin/addons.md#addon-weblate-autotranslate-autotranslate) add-on * [Checks and fixups](https://docs.weblate.org/no/latest/admin/checks.md) recalculation Possible choices: * `monthly` (this is the default) * `weekly` * `daily` * `never` #### NOTE Increasing the frequency is not recommended when Weblate contains thousands of components. ## BASIC_LANGUAGES #### Versionadded Added in version 4.4. List of languages to offer users for starting a new translation. When not specified, a built-in list is used (which includes all commonly used languages, but without country specific variants). This only limits non privileged users to add unwanted languages. Project admins are still presented with the full selection of languages defined in Weblate. #### NOTE This does not define new languages for Weblate — it only filters existing ones in the database. **Example:** ```python BASIC_LANGUAGES = {"cs", "it", "ja", "en"} ``` #### SEE ALSO [Language definitions](https://docs.weblate.org/no/latest/admin/languages.md#languages) ## BORG_EXTRA_ARGS #### Versionadded Added in version 4.9. You can pass additional arguments to **borg create** when built-in backups are triggered. **Example:** ```python BORG_EXTRA_ARGS = ["--exclude", "vcs/"] ``` #### SEE ALSO * [Backing up and moving Weblate](https://docs.weblate.org/no/latest/admin/backup.md#backup) * [borg create](https://borgbackup.readthedocs.io/en/stable/usage/create.html) ## CACHE_DIR #### Versionadded Added in version 4.16. Directory where Weblate stores cache files. Defaults to `cache` subfolder in [`DATA_DIR`](#std-setting-DATA_DIR). Change this to local or temporary filesystem if [`DATA_DIR`](#std-setting-DATA_DIR) is on a network filesystem. Weblate stores generated helper files here and executes some of them, so [`CACHE_DIR`](#std-setting-CACHE_DIR) has to be writable and mounted on a filesystem that allows execution. Avoid using `noexec` mount options for this directory. The Docker container uses a separate volume for this, see [Docker container volumes](https://docs.weblate.org/no/latest/admin/install/docker.md#docker-volume). The following subdirectories usually exist: `ssh` : Generated helper files used for VCS access. `fonts` : **font-config** cache for [Managing fonts](https://docs.weblate.org/no/latest/admin/checks.md#fonts). `avatar` : Cached user avatars, see [Avatars](https://docs.weblate.org/no/latest/admin/optionals.md#avatars). `static` : Default location for static Django files, specified by [`STATIC_ROOT`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-STATIC_ROOT). See [Serving static files](https://docs.weblate.org/no/latest/admin/install.md#static-files). `tesseract` : OCR trained data for [Screenshots and visual context](https://docs.weblate.org/no/latest/admin/translating.md#screenshots). ## CSP_SCRIPT_SRC, CSP_IMG_SRC, CSP_CONNECT_SRC, CSP_STYLE_SRC, CSP_FONT_SRC, CSP_FORM_SRC Customize the *Content-Security-Policy* header for Weblate. The header is automatically generated based on enabled integrations with third-party services (Matomo, Google Analytics, Sentry, …). All these default to an empty list. **Example:** ```python # Enable Cloudflare Javascript optimizations CSP_SCRIPT_SRC = ["ajax.cloudflare.com"] ``` #### SEE ALSO * [Content security policy](https://docs.weblate.org/no/latest/admin/install.md#csp) * [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) ## CHECK_LIST List of quality checks to perform on a translation. #### NOTE Provide a fully-qualified path to the Python class implementing the check interface. Adjust the list of checks to include ones relevant to you. All built-in [Quality checks](https://docs.weblate.org/no/latest/user/checks.md#checks) are turned on by default, from where you can change these settings. By default they are commented out in [Sample configuration](https://docs.weblate.org/no/latest/admin/sample.md#sample-configuration) so that default values are used. New checks are then carried out for each new Weblate version. You can turn off all checks: ```python CHECK_LIST = () ``` You can turn on only a few: ```python CHECK_LIST = ( "weblate.checks.chars.BeginNewlineCheck", "weblate.checks.chars.EndNewlineCheck", "weblate.checks.chars.MaxLengthCheck", ) ``` #### NOTE Changing this setting only affects newly changed translations. Existing checks will still be stored in the database. To also apply changes to the stored translations, run [`updatechecks`](https://docs.weblate.org/no/latest/admin/management.md#weblate-admin-updatechecks). #### SEE ALSO * [Quality checks](https://docs.weblate.org/no/latest/user/checks.md#checks) * [Writing own checks](https://docs.weblate.org/no/latest/admin/checks.md#own-checks) * [Custom quality checks, add-ons, automatic suggestions and auto-fixes](https://docs.weblate.org/no/latest/admin/customize.md#custom-modules) ## COMMIT_PENDING_HOURS Number of hours between committing pending changes by way of the background task. #### SEE ALSO * [Component configuration](https://docs.weblate.org/no/latest/admin/projects.md#component) * [Age of changes to commit](https://docs.weblate.org/no/latest/admin/projects.md#component-commit-pending-age) * [Running maintenance tasks](https://docs.weblate.org/no/latest/admin/install.md#production-cron) * [`commit_pending`](https://docs.weblate.org/no/latest/admin/management.md#weblate-admin-commit_pending) ## COMPONENT_ZIP_UPLOAD_MAX_SIZE #### Versionadded Added in version 5.17.1. Configures the maximum size, in bytes, for uploaded component ZIP files. Defaults to 50 MB. In Docker, configure this using the `WEBLATE_COMPONENT_ZIP_UPLOAD_MAX_SIZE` environment variable. #### SEE ALSO * [Component configuration](https://docs.weblate.org/no/latest/admin/projects.md#component) ## CONTACT_FORM #### Versionadded Added in version 4.6. Configures how e-mail from the contact form is being sent. Choose a configuration that matches the configuration of your mail server. `"reply-to"` : The sender is used as *Reply-To*, this is the default behaviour. `"from"` : The sender is used as *From*. Your mail server needs to allow sending such e-mails. `"disabled"` : Disables the contact form entirely.
#### Versionadded Added in version 5.15. #### SEE ALSO [`ADMINS_CONTACT`](#std-setting-ADMINS_CONTACT) ## DATA_DIR The folder Weblate stores all data in. It contains links to VCS repositories, a fulltext index and various configuration files for external tools. The following subdirectories usually exist: `home` : Home directory used for invoking scripts. `ssh` : SSH keys and configuration. `media` : Default location for Django media files, specified by [`MEDIA_ROOT`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-MEDIA_ROOT). Contains uploaded screenshots, see [Screenshots and visual context](https://docs.weblate.org/no/latest/admin/translating.md#screenshots). `vcs` : Version-control repositories for translations. `backups` : Daily backup data. Please check [Dumped data for backups](https://docs.weblate.org/no/latest/admin/backup.md#backup-dumps) for details. `fonts`: : User-uploaded fonts, see [Managing fonts](https://docs.weblate.org/no/latest/admin/checks.md#fonts). `cache` : Various caches. Can be placed elsewhere using [`CACHE_DIR`](#std-setting-CACHE_DIR).
The Docker container uses a separate volume for this, see [Docker container volumes](https://docs.weblate.org/no/latest/admin/install/docker.md#docker-volume). #### NOTE This directory has to be writable by Weblate. Running it as WSGI means the `www-data` user should have write access to it. The easiest way to achieve this is to make the user the owner of the directory: ```sh sudo chown www-data:www-data -R $DATA_DIR ``` Defaults to `/home/weblate/data`, but it is expected to be configured. #### SEE ALSO * [Filesystem permissions](https://docs.weblate.org/no/latest/admin/install.md#file-permissions) * [Backing up and moving Weblate](https://docs.weblate.org/no/latest/admin/backup.md) * [`CACHE_DIR`](#std-setting-CACHE_DIR) ## DATABASE_BACKUP Whether the database backups should be stored as plain text, compressed or skipped. The authorized values are: * `"plain"` * `"compressed"` * `"none"` #### SEE ALSO [Backing up and moving Weblate](https://docs.weblate.org/no/latest/admin/backup.md#backup) ## DEFAULT_ACCESS_CONTROL The default access-control setting for new projects: `0` : Public `1` : Protected `100` : Private `200` : Custom Use Custom if you are managing ACL manually, which means not relying on the internal Weblate management. #### SEE ALSO * [Project access control](https://docs.weblate.org/no/latest/admin/access.md#acl) * [Access control](https://docs.weblate.org/no/latest/admin/projects.md#project-access-control) ## DEFAULT_AUTO_WATCH #### Versionadded Added in version 4.5. Configures whether Automatically watch projects on contribution should be turned on for new users. Defaults to `True`. #### SEE ALSO [Notifications](https://docs.weblate.org/no/latest/user/profile.md#notifications) ## DEFAULT_RESTRICTED_COMPONENT #### Versionadded Added in version 4.1. The default value for component restriction. #### SEE ALSO * [Restricted access](https://docs.weblate.org/no/latest/admin/projects.md#component-restricted) * [Scope of teams](https://docs.weblate.org/no/latest/admin/access.md#perm-check) ## DEFAULT_ADD_MESSAGE, DEFAULT_ADDON_MESSAGE, DEFAULT_COMMIT_MESSAGE, DEFAULT_DELETE_MESSAGE, DEFAULT_MERGE_MESSAGE Default commit messages for different operations, please check [Component configuration](https://docs.weblate.org/no/latest/admin/projects.md#component) for details. The built-in defaults follow Conventional Commits and include Weblate links where available. Changing these settings affects newly created defaults; existing message templates can be reset in the settings forms with Restore site default. For inherited values, restoring the site default also disables inheritance for that message. #### SEE ALSO * [Template markup](https://docs.weblate.org/no/latest/admin/projects.md#markup) * [Component configuration](https://docs.weblate.org/no/latest/admin/projects.md#component) * [Commit, add, delete, merge, add-on, and merge request messages](https://docs.weblate.org/no/latest/admin/projects.md#component-commit-message) ## DEFAULT_ADDONS Default add-ons to install for every created component. #### NOTE This setting affects only newly created components. Example: ```python DEFAULT_ADDONS = { # Add-on with no parameters "weblate.flags.target_edit": {}, # Add-on with parameters "weblate.autotranslate.autotranslate": { "mode": "suggest", "filter_type": "todo", "auto_source": "mt", "component": "", "engines": ["weblate-translation-memory"], "threshold": "80", }, } ``` #### SEE ALSO * [`install_addon`](https://docs.weblate.org/no/latest/admin/management.md#weblate-admin-install_addon) * [Add-ons](https://docs.weblate.org/no/latest/admin/addons.md) * [`WEBLATE_ADDONS`](#std-setting-WEBLATE_ADDONS) ## DEFAULT_COMMITER_EMAIL Committer e-mail address, defaulting to `noreply@weblate.org`. This identifies Weblate as the committer, separately from the translator recorded as the author. To make translators’ author e-mail addresses private by default, set [`PRIVATE_COMMIT_EMAIL_OPT_IN`](#std-setting-PRIVATE_COMMIT_EMAIL_OPT_IN) to `False`. #### SEE ALSO [`DEFAULT_COMMITER_NAME`](#std-setting-DEFAULT_COMMITER_NAME) ## DEFAULT_COMMITER_NAME Committer name, defaulting to `Weblate`. This identifies Weblate as the committer, separately from the translator recorded as the author. To make translators’ author names private by default, set [`PRIVATE_COMMIT_NAME_OPT_IN`](#std-setting-PRIVATE_COMMIT_NAME_OPT_IN) to `False`. #### SEE ALSO [`DEFAULT_COMMITER_EMAIL`](#std-setting-DEFAULT_COMMITER_EMAIL) ## DEFAULT_LANGUAGE #### Versionadded Added in version 4.3.2. [Source language](https://docs.weblate.org/no/latest/admin/projects.md#component-source-language) for any new components. Defaults to en. The matching language object needs to exist in the database. #### SEE ALSO * [Language definitions](https://docs.weblate.org/no/latest/admin/languages.md#languages) * [Source language](https://docs.weblate.org/no/latest/admin/projects.md#component-source-language) ## DEFAULT_MERGE_STYLE [Merge style](https://docs.weblate.org/no/latest/admin/projects.md#component-merge-style) for any new components. * rebase - default * merge #### SEE ALSO * [Component configuration](https://docs.weblate.org/no/latest/admin/projects.md#component) * [Merge style](https://docs.weblate.org/no/latest/admin/projects.md#component-merge-style) ## DEFAULT_NOTIFICATIONS #### Versionadded Added in version 2026.10.1. Default notification settings for every newly created user. A list of 3-tuples consisting of notification scope, notification frequency and notification handler. Scopes: `0` : All `10` : Watched `20` : Administered Frequencies: `0` : No notification `1` : Instant notification `2` : Daily digest `3` : Weekly digest `4` : Monthly digest Handlers: `ApprovedStringNotificaton` : String was approved `ChangedStringNotificaton` : String was changed `ComponentTranslatedNotificaton` : Component was translated `LanguageTranslatedNotificaton` : Language was translated `LastAuthorCommentNotificaton` : String you contributed to received a comment `LicenseNotification` : License was changed `LockNotification` : Component was locked or unlocked `MentionCommentNotificaton` : You were mentioned in a comment `MergeFailureNotification` : Repository operation failed `NewAlertNotificaton` : New alert emerged in a component `NewAnnouncementNotificaton` : Announcement was published `NewCommentNotificaton` : Comment was added `NewComponentNotificaton` : New translation component was created `NewContributorNotificaton` : Contributor made their first translation `NewStringNotificaton` : String is available for translation `NewSuggestionNotificaton` : Suggestion was added `NewTranslationNotificaton` : New language was added or requested `ParseErrorNotification` : Parse error occurred `PendingSuggestionsNotification` : Pending suggestions exist `RepositoryNotification` : Operation was performed in the repository `ToDoStringsNotification` : Unfinished strings exist `TranslatedStringNotificaton` : String was edited by user `TranslationActivitySummaryNotification` : Translation activity summary #### NOTE This setting affects only newly created users. Example: ```python DEFAULT_NOTIFICATIONS = [ (0, 1, "MentionCommentNotificaton"), (10, 1, "LastAuthorCommentNotificaton"), ] ``` #### SEE ALSO * [Notifications](https://docs.weblate.org/no/latest/user/profile.md#notifications) ## DEFAULT_SHARED_TM Configures the default value of [Use shared translation memory](https://docs.weblate.org/no/latest/admin/projects.md#project-use-shared-tm) and [Contribute to shared translation memory](https://docs.weblate.org/no/latest/admin/projects.md#project-contribute-shared-tm). ## DEFAULT_TRANSLATION_REVIEW #### Versionadded Added in version 5.16. Configures the default value for [Enable reviews](https://docs.weblate.org/no/latest/admin/projects.md#project-translation-review), turned off by default. ## DEFAULT_SOURCE_REVIEW #### Versionadded Added in version 5.16. Configures the default value for [Enable source reviews](https://docs.weblate.org/no/latest/admin/projects.md#project-source-review), turned off by default. ## DEFAULT_AUTOCLEAN_TM #### Versionadded Added in version 5.13. Configures the default value of [Autoclean translation memory](https://docs.weblate.org/no/latest/admin/projects.md#project-autoclean-tm). ## DEFAULT_TRANSLATION_PROPAGATION Default setting for translation propagation, defaults to `True`. #### SEE ALSO * [Component configuration](https://docs.weblate.org/no/latest/admin/projects.md#component) * [Allow translation propagation](https://docs.weblate.org/no/latest/admin/projects.md#component-allow-translation-propagation) ## DEFAULT_PULL_MESSAGE Configures the default title and message for pull requests. The built-in default follows Conventional Commits and includes Weblate links and translation status. ## ENABLE_AVATARS Whether to turn on Gravatar-based avatars for users. On by default. Avatars are fetched and cached on the server, lowering the risk of leaking private info, speeding up the user experience. #### SEE ALSO * [Avatar caching](https://docs.weblate.org/no/latest/admin/install.md#production-cache-avatar) * [`AVATAR_URL_PREFIX`](#std-setting-AVATAR_URL_PREFIX) * [Avatars](https://docs.weblate.org/no/latest/admin/optionals.md#avatars) ## ENABLE_HOOKS Whether to turn on anonymous remote hooks. #### SEE ALSO [Notification hooks](https://docs.weblate.org/no/latest/api.md#hooks) ## ENABLE_HTTPS #### Versionchanged Changed in version 5.7: Weblate now requires https for WebAuthn support. Whether to send links to Weblate as HTTPS or HTTP. This setting affects sent e-mails and generated absolute URLs. In the default configuration this is also used for several Django settings related to HTTPS — it enables secure cookies, toggles HSTS or enables redirection to a HTTPS URL. The HTTPS redirection might be problematic in some cases and you might hit an issue with infinite redirection in case you are using a reverse proxy doing an SSL termination which does not correctly pass protocol headers to Django. Please tweak your reverse proxy configuration to emit *X-Forwarded-Proto* or *Forwarded* headers or configure [`SECURE_PROXY_SSL_HEADER`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-SECURE_PROXY_SSL_HEADER) to let Django correctly detect the SSL status. In case this is disabled, Weblate will fail to start with an `otp_webauthn.E031` error. You can silence this error by adding it to [`SILENCED_SYSTEM_CHECKS`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-SILENCED_SYSTEM_CHECKS), but still WebAuthn will not work for sites without HTTPS. #### SEE ALSO * [`SESSION_COOKIE_SECURE`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-SESSION_COOKIE_SECURE) * [`CSRF_COOKIE_SECURE`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-CSRF_COOKIE_SECURE) * [`SECURE_SSL_REDIRECT`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-SECURE_SSL_REDIRECT) * [`SECURE_PROXY_SSL_HEADER`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-SECURE_PROXY_SSL_HEADER) * [Set correct site domain](https://docs.weblate.org/no/latest/admin/install.md#production-site) ## ENABLE_SHARING Turn on/off the Community menu so users can share translation progress on social networks. #### SEE ALSO [Building the translation community](https://docs.weblate.org/no/latest/devel/share.md#promotion) ## EXTRA_HTML_HEAD #### Versionadded Added in version 4.15. Insert additional markup into the HTML header. Can be used for verification of site ownership, for example: ```python EXTRA_HTML_HEAD = '' ``` #### WARNING No sanitization is performed on the string. It is inserted as-is into the HTML header. ## GET_HELP_URL #### Versionadded Added in version 4.5.2. URL where support for your Weblate instance can be found. ## GITEA_CREDENTIALS #### Versionadded Added in version 4.12. List for credentials for Gitea servers. ```python GITEA_CREDENTIALS = { "try.gitea.io": { "username": "weblate", "token": "your-api-token", }, } ``` The configuration dictionary consists of credentials defined for each API host. The layout is same for almost all version control integrations and is described at [Configuring version control credentials](#settings-credentials). #### SEE ALSO * [Code-hosting integrations](https://docs.weblate.org/no/latest/admin/code-hosting.md) * [Gitea pull requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-gitea-pull-requests) * [Creating a Gitea personal access token](https://docs.gitea.com/development/api-usage) ## GITLAB_CREDENTIALS #### Versionadded Added in version 4.3. List for credentials for GitLab servers. ```python GITLAB_CREDENTIALS = { "gitlab.com": { "username": "weblate", "token": "your-api-token", }, } ``` #### NOTE The personal access token needs the api scope to be able to use the API. The configuration dictionary consists of credentials defined for each API host. The layout is same for almost all version control integrations and is described at [Configuring version control credentials](#settings-credentials). #### SEE ALSO * [GitLab merge requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-gitlab-merge-requests) * [GitLab: Personal access token](https://docs.gitlab.com/user/profile/personal_access_tokens/) ## GITHUB_CREDENTIALS #### Versionadded Added in version 4.3. List for credentials for GitHub servers. ```python GITHUB_CREDENTIALS = { "api.github.com": { "username": "weblate", "token": "your-api-token", }, } ``` #### NOTE It is possible to use both fine-grained personal access tokens and classic personal access tokens. The fine-grained tokens are limited to a single organization, so it won’t work if you want Weblate to fork a repository outside the organization (typically to the user namespace). To clone, push and create pull requests, the read and write access to Contents and Pull requests is required. Administration might also be necessary for forking a repository if you intend to use forking and the original repository is not public. #### HINT Use `api.github.com` as an API host for [https://github.com/](https://github.com/). The configuration dictionary consists of credentials defined for each API host. The layout is same for almost all version control integrations and is described at [Configuring version control credentials](#settings-credentials). #### SEE ALSO * [GitHub pull requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-github-pull-requests) * [Creating a GitHub personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) ## GITHUB_LEGACY_APP_WEBHOOK_SECRET #### Versionadded Added in version 2026.8. Webhook secret for a legacy GitHub App which delivers events to the generic GitHub webhook URL, `/hooks/github/`. App webhook deliveries to the generic URL are rejected when this setting is empty or their `X-Hub-Signature-256` does not match. Ordinary repository webhooks are unaffected. GitHub Apps registered through Weblate use their per-App webhook URLs and do not use this setting. ```python GITHUB_LEGACY_APP_WEBHOOK_SECRET = "your-webhook-secret" ``` #### SEE ALSO * [GitHub notifications](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-github-notifications) * [App webhook URL](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-github-app-webhook) ## BITBUCKETSERVER_CREDENTIALS #### Versionadded Added in version 4.16. List for credentials for Bitbucket Data Center. ```python BITBUCKETSERVER_CREDENTIALS = { "git.self-hosted.com": { "username": "weblate", "token": "http-access-token", }, } ``` The configuration dictionary consists of credentials defined for each API host. The layout is same for almost all version control integrations and is described at [Configuring version control credentials](#settings-credentials). #### SEE ALSO * [Bitbucket Data Center pull requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-bitbucket-data-center-pull-requests) * [Bitbucket: HTTP access token](https://confluence.atlassian.com/bitbucketserver/http-access-tokens-939515499.html) ## BITBUCKETCLOUD_CREDENTIALS #### Versionadded Added in version 5.8. List for credentials for Bitbucket Cloud servers. ```python BITBUCKETCLOUD_CREDENTIALS = { "bitbucket.org": { "username": "your-email", "workspace": "your-workspace-slug", "token": "your-api-token", }, } ``` The configuration dictionary consists of credentials defined for each API host. The API host might be different from what you use in the web browser, for example GitHub API is accessed as `api.github.com`. The following configuration is available for each host: `username` : API user. `workspace` : The user workspace slug. `token` : The API token with pullrequest:write permission. Additional settings not described here can be found at [Configuring version control credentials](#settings-credentials). #### SEE ALSO * [Bitbucket Cloud pull requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-bitbucket-cloud-pull-requests) * [Create an API token](https://support.atlassian.com/bitbucket-cloud/docs/create-an-api-token/) * [API token permissions](https://support.atlassian.com/bitbucket-cloud/docs/api-token-permissions/) ## AZURE_DEVOPS_CREDENTIALS #### Versionadded Added in version 5.2. List for credentials for Azure DevOps servers. ```python AZURE_DEVOPS_CREDENTIALS = { "dev.azure.com": { "username": "project-name", "token": "your-api-token", "organization": "organization-name", }, } ``` The configuration dictionary consists of credentials defined for each API host. The API host might be different from what you use in the web browser, for example GitHub API is accessed as `api.github.com`. The following configuration is available for each host: `username` : The name of the Azure DevOps project. This is not the repository name. `organization` : The name of the organization of the project. `workItemIds` : An optional list of work items IDs from your organization. When provided new pull requests will have these attached. `token` : API token for the API user, required. Additional settings not described here can be found at [Configuring version control credentials](#settings-credentials). #### SEE ALSO * [Azure DevOps pull requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-azure-devops-pull-requests) * [Azure DevOps: Personal access token](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=Windows) ## GOOGLE_ANALYTICS_ID Google Analytics ID to turn on monitoring of Weblate using Google Universal Analytics. #### NOTE Google Analytics 4 integration is currently not available for Weblate, please see [https://github.com/WeblateOrg/weblate/issues/14015](https://github.com/WeblateOrg/weblate/issues/14015). ## HIDE_REPO_CREDENTIALS Hide repository credentials from the web interface. In case you have repository URL with user and password, Weblate will hide it when related info is shown to users. For example instead of `https://user:password@git.example.com/repo.git` it will show just `https://git.example.com/repo.git`. It tries to clean up VCS error messages too in a similar manner. #### NOTE On by default. ## VERSION_DISPLAY #### Versionadded Added in version 5.17. Controls how prominently Weblate exposes its own version. Supported values are: `show` : Show the version in shared UI such as the footer and expose it in [`GET /api/metrics/`](https://docs.weblate.org/no/latest/api.md#get--api-metrics-). `soft` : Hide the version from prominent shared UI, while keeping it discoverable on the About page and in [`GET /api/metrics/`](https://docs.weblate.org/no/latest/api.md#get--api-metrics-). `hide` : Hide the version from shared UI and [`GET /api/metrics/`](https://docs.weblate.org/no/latest/api.md#get--api-metrics-). This also makes anonymous documentation links point to the latest documentation instead of the version matching the installed release. Hiding the version is a recommended security practice in some corporations, but it does not prevent an attacker from inferring the version by probing behavior. #### NOTE The default is `show`. ## HIDE_VERSION #### Versionadded Added in version 4.3.1. #### Deprecated Deprecated since version 5.17. Compatibility alias for [`VERSION_DISPLAY`](#std-setting-VERSION_DISPLAY). Set this to `True` to get the same behavior as `VERSION_DISPLAY = "hide"`. ## INTERNAL_BOT_EMAIL_TEMPLATE #### Versionadded Added in version 2026.7.1. Template used to generate e-mail addresses for internal Weblate bot accounts. Defaults to `"noreply-{scope}-{name}@weblate.org"`. It can contain `{scope}`, `{name}`, `{username}`, `{site_title}`, and `{site_domain}`. Use `{scope}` and `{name}` when generating the e-mail local part. The `{username}` value contains the internal `scope:name` username. Existing internal bot accounts are updated when [`migrate`](https://docs.weblate.org/no/latest/admin/management.md#weblate-admin-migrate) is run. Project API token accounts are not affected. ## IP_BEHIND_REVERSE_PROXY Indicates whether Weblate is running behind a reverse proxy. If set to `True`, Weblate gets IP address from a header defined by [`IP_PROXY_HEADER`](#std-setting-IP_PROXY_HEADER). #### WARNING The reverse proxy which connects to Weblate must overwrite the configured header or append a verified peer address at the position selected by [`IP_PROXY_OFFSET`](#std-setting-IP_PROXY_OFFSET). Weblate does not verify which peer supplied the header, so trusting a client-controlled value allows IP address spoofing. Ensure that untrusted clients cannot reach Weblate without passing through the trusted proxy. #### NOTE This is not on by default. #### SEE ALSO * [Running behind reverse proxy](https://docs.weblate.org/no/latest/admin/install.md#reverse-proxy) * [Rate limiting](https://docs.weblate.org/no/latest/admin/optionals.md#rate-limit) * [`IP_PROXY_HEADER`](#std-setting-IP_PROXY_HEADER) * [`IP_PROXY_OFFSET`](#std-setting-IP_PROXY_OFFSET) ## IP_PROXY_HEADER Indicates which header Weblate should obtain the IP address from when [`IP_BEHIND_REVERSE_PROXY`](#std-setting-IP_BEHIND_REVERSE_PROXY) is turned on. Defaults to `HTTP_X_FORWARDED_FOR`. #### SEE ALSO * [Running behind reverse proxy](https://docs.weblate.org/no/latest/admin/install.md#reverse-proxy) * [Rate limiting](https://docs.weblate.org/no/latest/admin/optionals.md#rate-limit) * [`SECURE_PROXY_SSL_HEADER`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-SECURE_PROXY_SSL_HEADER) * [`IP_BEHIND_REVERSE_PROXY`](#std-setting-IP_BEHIND_REVERSE_PROXY) * [`IP_PROXY_OFFSET`](#std-setting-IP_PROXY_OFFSET) ## IP_PROXY_OFFSET #### Versionchanged Changed in version 5.0.1: The default changed from 1 to -1. Indicates which part of [`IP_PROXY_HEADER`](#std-setting-IP_PROXY_HEADER) is used as client IP address. Depending on your setup, this header might consist of several IP addresses, (for example `X-Forwarded-For: client-ip, proxy-a, proxy-b`) and you can configure which address from the header is used as client IP address here. #### WARNING Setting this affects the security of your installation. Select only an address added or verified by a proxy under your control. Addresses supplied by the client are untrusted. Ensure that the selected offset matches how your proxies construct the header. See <[https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-For#security_and_privacy_concerns](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-For#security_and_privacy_concerns)> for more details. Defaults to -1. #### SEE ALSO * [Running behind reverse proxy](https://docs.weblate.org/no/latest/admin/install.md#reverse-proxy) * [Rate limiting](https://docs.weblate.org/no/latest/admin/optionals.md#rate-limit) * [`SECURE_PROXY_SSL_HEADER`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-SECURE_PROXY_SSL_HEADER) * [`IP_BEHIND_REVERSE_PROXY`](#std-setting-IP_BEHIND_REVERSE_PROXY) * [`IP_PROXY_HEADER`](#std-setting-IP_PROXY_HEADER) ## LEGAL_DOCUMENT_CSS_CLASS #### Versionadded Added in version 2026.7. CSS class added to the wrappers around legal document templates. Defaults to `"tos"`. Weblate does not attach styling to this class; custom legal styles can use it to target document wrappers. Set this to an empty string to render legal documents without a wrapper class. ```python LEGAL_DOCUMENT_CSS_CLASS = "" ``` #### SEE ALSO * [Legal module](https://docs.weblate.org/no/latest/admin/optionals.md#legal) * [Customizing legal documents and styles](https://docs.weblate.org/no/latest/admin/optionals.md#legal-customization) ## LEGAL_HIDDEN_DOCUMENTS #### Versionadded Added in version 2026.7. List of legal document page identifiers to hide from the legal module. The `index` page is always visible. Supported document identifiers are `terms`, `cookies`, `privacy`, and `contracts`. Hidden pages are removed from the legal menu and return a 404 response when requested directly. When legal document confirmation is enabled, hiding `terms` without [`LEGAL_URL`](#std-setting-LEGAL_URL) makes confirmation embed the terms template. Hiding `privacy` without [`PRIVACY_URL`](#std-setting-PRIVACY_URL) makes confirmation cover only the terms. Links exposed through the `terms_url` and `privacy_url` template variables use [`LEGAL_URL`](#std-setting-LEGAL_URL) and [`PRIVACY_URL`](#std-setting-PRIVACY_URL) first when configured. Otherwise, they link to the visible internal legal page. Hidden pages have no link when no external URL is configured. With legal document confirmation enabled, setting [`LEGAL_URL`](#std-setting-LEGAL_URL) makes the confirmation page link to the external terms document instead of embedding `legal/documents/tos.html`. When a privacy policy link is available, the confirmation covers both documents. If `privacy` is hidden and [`PRIVACY_URL`](#std-setting-PRIVACY_URL) is unset, it covers only the terms. In non-Docker deployments, define [`LEGAL_URL`](#std-setting-LEGAL_URL) and any [`LEGAL_HIDDEN_DOCUMENTS`](#std-setting-LEGAL_HIDDEN_DOCUMENTS) before `SPECTACULAR_SETTINGS` is created so the API schema terms link uses the same URL. ```python LEGAL_HIDDEN_DOCUMENTS = ("contracts",) ``` #### SEE ALSO [Legal module](https://docs.weblate.org/no/latest/admin/optionals.md#legal) ## LEGAL_TOS_DATE #### Versionadded Added in version 4.15. #### NOTE You need [Legal module](https://docs.weblate.org/no/latest/admin/optionals.md#legal) installed to make this work. Date of the legal documents users last agreed to. Whenever the date changes, users are required to agree with the current terms of service and, when a privacy policy link is available, the privacy policy. ```python from datetime import date LEGAL_TOS_DATE = date(2022, 2, 2) ``` ## LEGAL_URL URL where your Weblate instance shows its legal documents. #### HINT When the [Legal module](https://docs.weblate.org/no/latest/admin/optionals.md#legal) module is enabled, this URL takes priority over its internal terms page in document links. The default terms template links to this URL when visited directly. Example: ```python LEGAL_URL = "https://weblate.org/terms/" ``` #### SEE ALSO [`PRIVACY_URL`](#std-setting-PRIVACY_URL) ## LICENSE_EXTRA Additional licenses to include in the license choices. #### NOTE Each license definition should be a tuple of its short name, a long name, a URL and a boolean, indicating whether it is a libre license. For example: ```python LICENSE_EXTRA = [ ( "AGPL-3.0", "GNU Affero General Public License v3.0", "https://www.gnu.org/licenses/agpl-3.0-standalone.html", True, ), ] ``` ## LICENSE_FILTER #### Versionchanged Changed in version 4.3: Setting this to blank value now disables license alert. Filter list of licenses to show. This also disables the license alert when set to empty. #### NOTE This filter uses the short license names. For example: ```python LICENSE_FILTER = {"AGPL-3.0", "GPL-3.0-or-later"} ``` Following disables the license alert: ```python LICENSE_FILTER = set() ``` #### SEE ALSO [Translation component diagnostics](https://docs.weblate.org/no/latest/devel/alerts.md#alerts) ## LICENSE_REQUIRED Defines whether the license attribute in [Component configuration](https://docs.weblate.org/no/latest/admin/projects.md#component) is required. #### NOTE This is off by default. ## LIMIT_TRANSLATION_LENGTH_BY_SOURCE_LENGTH Whether the length of a given translation should be limited. The restriction is the length of the source string × 10 characters. #### HINT Set this to `False` to allow longer translations (up to 10,000 characters) irrespective of source string length. #### NOTE Defaults to `True`. ## LOCALIZE_CDN_URL and LOCALIZE_CDN_PATH These settings configure the CDN add-ons, including [JavaScript localization CDN](https://docs.weblate.org/no/latest/admin/addons.md#addon-weblate-cdn-cdnjs), [Translation files CDN](https://docs.weblate.org/no/latest/admin/addons.md#addon-weblate-cdn-files), and [Kotlin SDK CDN](https://docs.weblate.org/no/latest/admin/addons.md#addon-weblate-cdn-kotlin). [`LOCALIZE_CDN_URL`](#std-setting-LOCALIZE_CDN_URL) defines root URL where the localization CDN is available and [`LOCALIZE_CDN_PATH`](#std-setting-LOCALIZE_CDN_PATH) defines path where Weblate should store generated files which will be served at the [`LOCALIZE_CDN_URL`](#std-setting-LOCALIZE_CDN_URL). The files are served by your web server or CDN, not by Weblate; see [Localization CDN](https://docs.weblate.org/no/latest/admin/optionals.md#cdn-server-security) for secure serving guidance. #### HINT On Hosted Weblate, this uses `https://weblate-cdn.com/`. #### SEE ALSO * [JavaScript localization CDN](https://docs.weblate.org/no/latest/admin/addons.md#addon-weblate-cdn-cdnjs) * [Translation files CDN](https://docs.weblate.org/no/latest/admin/addons.md#addon-weblate-cdn-files) * [Kotlin SDK CDN](https://docs.weblate.org/no/latest/admin/addons.md#addon-weblate-cdn-kotlin) ## MATOMO_SITE_ID ID of the site in Matomo (formerly Piwik) you want to use for tracking Weblate. #### NOTE This integration does not support the Matomo Tag Manager. #### SEE ALSO [`MATOMO_URL`](#std-setting-MATOMO_URL) ## MATOMO_URL Full URL (including trailing slash) of a Matomo (formerly Piwik) installation you want to use to track Weblate use. Please check <[https://matomo.org/](https://matomo.org/)> for more details. #### HINT This integration does not support the Matomo Tag Manager. For example: ```python MATOMO_SITE_ID = 1 MATOMO_URL = "https://example.matomo.cloud/" ``` #### SEE ALSO [`MATOMO_SITE_ID`](#std-setting-MATOMO_SITE_ID) ## NEARBY_MESSAGES Number of nearby strings to show in each direction in the full editor. This is just a default value, users can adjust this in [User profile](https://docs.weblate.org/no/latest/user/profile.md#user-profile). ## DEFAULT_PAGE_LIMIT #### Versionadded Added in version 4.7. Default number of elements to display when pagination is active. ## PAGURE_CREDENTIALS #### Versionadded Added in version 4.3.2. List for credentials for Pagure servers. ```python PAGURE_CREDENTIALS = { "pagure.io": { "username": "weblate", "token": "your-api-token", }, } ``` The configuration dictionary consists of credentials defined for each API host. The layout is same for almost all version control integrations and is described at [Configuring version control credentials](#settings-credentials). #### SEE ALSO * [Pagure merge requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-pagure-merge-requests) * [Pagure API](https://pagure.io/api/0/) ## PASSWORD_MINIMAL_STRENGTH #### Versionadded Added in version 5.10.2. Minimal password score as evaluated by the [zxcvbn](https://github.com/dwolfhub/zxcvbn-python) password strength estimator. Defaults to 0, which means strength checking is disabled. #### SEE ALSO * [Password authentication](https://docs.weblate.org/no/latest/admin/auth.md#password-authentication) * [`WEBLATE_MIN_PASSWORD_SCORE`](https://docs.weblate.org/no/latest/admin/install/docker.md#envvar-WEBLATE_MIN_PASSWORD_SCORE) ## PASSWORD_RESET_URL #### Versionadded Added in version 5.17. URL for password reset when authentication is handled by an external identity provider, such as LDAP, SAML, or OAuth. When set, Forgot your password? on the sign-in page links to this URL instead of Weblate’s built-in password reset page. ## PRIVACY_URL #### Versionadded Added in version 4.8.1. URL where your Weblate instance shows its privacy policy. #### HINT When the [Legal module](https://docs.weblate.org/no/latest/admin/optionals.md#legal) module is enabled, this URL takes priority over its internal privacy page in document links. The default privacy template links to this URL when visited directly. Example: ```python PRIVACY_URL = "https://weblate.org/terms/" ``` #### SEE ALSO [`LEGAL_URL`](#std-setting-LEGAL_URL) ## PRIVATE_COMMIT_EMAIL_OPT_IN #### Versionadded Added in version 4.15. Configures whether the private commit e-mail is opt-in or opt-out. With `True` (the default), users use their account e-mail unless they choose a private commit e-mail. Set to `False` to use [`PRIVATE_COMMIT_EMAIL_TEMPLATE`](#std-setting-PRIVATE_COMMIT_EMAIL_TEMPLATE) by default. #### HINT This setting applies to new and existing users who have not explicitly chosen a commit e-mail. Users can still choose their account e-mail in the [Account](https://docs.weblate.org/no/latest/user/profile.md#profile-account) settings. Bot accounts do not use the private default. #### SEE ALSO * [Public profile](https://docs.weblate.org/no/latest/user/profile.md#profile) * [`PRIVATE_COMMIT_EMAIL_TEMPLATE`](#std-setting-PRIVATE_COMMIT_EMAIL_TEMPLATE) ## PRIVATE_COMMIT_EMAIL_TEMPLATE #### Versionadded Added in version 4.15. Template to generate a private commit e-mail for a user. Defaults to `"{username}@users.noreply.{site_domain}"`. It can contain `{user_id}`, `{username}`, `{site_title}`, and `{site_domain}`. Set to a blank string to disable private commit e-mails and use the account e-mail when no commit e-mail has been explicitly chosen. The default template includes the username. To avoid including it, use `"user-{user_id}@users.noreply.{site_domain}"` instead. Changing the template alone does not make private commit e-mails the default. #### NOTE Using a different commit e-mail is opt-in for users unless configured by [`PRIVATE_COMMIT_EMAIL_OPT_IN`](#std-setting-PRIVATE_COMMIT_EMAIL_OPT_IN). Users can configure their commit e-mail in the [Public profile](https://docs.weblate.org/no/latest/user/profile.md#profile). ## PRIVATE_COMMIT_NAME_OPT_IN #### Versionadded Added in version 5.16. Configures whether the private commit name is opt-in or opt-out. With `True` (the default), users use their account name unless they choose a private commit name. Set to `False` to use [`PRIVATE_COMMIT_NAME_TEMPLATE`](#std-setting-PRIVATE_COMMIT_NAME_TEMPLATE) by default. #### HINT This setting applies to new and existing users who have not explicitly chosen a commit name. Users can still choose their account name in the [Account](https://docs.weblate.org/no/latest/user/profile.md#profile-account) settings. Bot accounts use their account name. #### SEE ALSO * [Public profile](https://docs.weblate.org/no/latest/user/profile.md#profile) * [`PRIVATE_COMMIT_NAME_TEMPLATE`](#std-setting-PRIVATE_COMMIT_NAME_TEMPLATE) ## PRIVATE_COMMIT_NAME_TEMPLATE #### Versionadded Added in version 5.16. Template to generate a private commit name for a user. Defaults to `"{site_title} user {user_id}"`. It can contain `{user_id}`, `{username}`, `{site_title}`, and `{site_domain}`. Set to a blank string to disable private commit names and use the account name. Changing the template alone does not make private commit names the default. #### NOTE Using a different commit name is opt-in for users unless configured by [`PRIVATE_COMMIT_NAME_OPT_IN`](#std-setting-PRIVATE_COMMIT_NAME_OPT_IN). Users can configure their commit name in the [Public profile](https://docs.weblate.org/no/latest/user/profile.md#profile). ## PROJECT_BACKUP_KEEP_COUNT #### Versionadded Added in version 4.14. Defines how many backups per project are kept on the server. Defaults to 3. #### SEE ALSO [Project level backups](https://docs.weblate.org/no/latest/admin/backup.md#projectbackup) ## PROJECT_BACKUP_KEEP_DAYS #### Versionadded Added in version 4.14. Defines how long the project backups will be kept on the server. Defaults to 30 days. #### SEE ALSO [Project level backups](https://docs.weblate.org/no/latest/admin/backup.md#projectbackup) ## PROJECT_BACKUP_UPLOAD_MAX_SIZE #### Versionadded Added in version 5.17.1. Configures the maximum size, in bytes, for uploaded project backup ZIP files. Defaults to 536870912 bytes (512 MiB). In Docker, configure this using the `WEBLATE_PROJECT_BACKUP_UPLOAD_MAX_SIZE` environment variable. Docker setups can also be constrained by [`CLIENT_MAX_BODY_SIZE`](https://docs.weblate.org/no/latest/admin/install/docker.md#envvar-CLIENT_MAX_BODY_SIZE); other deployments can be constrained by their reverse proxy request body-size limit. #### SEE ALSO [Project level backups](https://docs.weblate.org/no/latest/admin/backup.md#projectbackup) ## PROJECT_BACKUP_IMPORT_MAX_MEMBERS #### Versionadded Added in version 5.17. Defines the maximum number of ZIP entries allowed when importing a project backup. This is a safeguard against malformed or intentionally fragmented archives. Defaults to 100000 entries. In Docker, configure this using the `WEBLATE_PROJECT_BACKUP_IMPORT_MAX_MEMBERS` environment variable. #### SEE ALSO [Project level backups](https://docs.weblate.org/no/latest/admin/backup.md#projectbackup) ## PROJECT_BACKUP_IMPORT_MAX_TOTAL_UNCOMPRESSED_SIZE #### Versionadded Added in version 5.17.1. Defines the maximum total uncompressed size, in bytes, for ZIP entries in an imported project backup. Defaults to 536870912 bytes (512 MiB). This limits archives that are small when uploaded but expand to much more data during validation or restore. In Docker, configure this using the `WEBLATE_PROJECT_BACKUP_IMPORT_MAX_TOTAL_UNCOMPRESSED_SIZE` environment variable. #### SEE ALSO [Project level backups](https://docs.weblate.org/no/latest/admin/backup.md#projectbackup) ## PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_SIZE #### Versionadded Added in version 5.17. Defines the maximum uncompressed size, in bytes, for a single highly compressed ZIP entry in an imported project backup. This limit is only applied to entries that are large enough and compress enough to look suspicious. Large low-compression files are intentionally allowed here and are expected to be constrained by the HTTP upload limit. Defaults to 262144000 bytes (250 MiB). In Docker, configure this using the `WEBLATE_PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_SIZE` environment variable. #### SEE ALSO [Project level backups](https://docs.weblate.org/no/latest/admin/backup.md#projectbackup) ## PROJECT_BACKUP_IMPORT_MIN_RATIO_SIZE #### Versionadded Added in version 5.17. Defines the minimum uncompressed size, in bytes, at which Weblate starts considering the ZIP compression ratio during project backup import. Smaller files are ignored for the compression-ratio-based validation to avoid rejecting reasonably sized files that compress well. Defaults to 1048576 bytes (1 MiB). In Docker, configure this using the `WEBLATE_PROJECT_BACKUP_IMPORT_MIN_RATIO_SIZE` environment variable. #### SEE ALSO [Project level backups](https://docs.weblate.org/no/latest/admin/backup.md#projectbackup) ## PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_RATIO #### Versionadded Added in version 5.17. Defines the maximum allowed ratio between the uncompressed and compressed size for a large ZIP entry during project backup import. This is used together with [`PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_SIZE`](#std-setting-PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_SIZE) and [`PROJECT_BACKUP_IMPORT_MIN_RATIO_SIZE`](#std-setting-PROJECT_BACKUP_IMPORT_MIN_RATIO_SIZE) to detect suspiciously compressed entries while still allowing large repository pack files and other low-compression content. Defaults to 250. In Docker, configure this using the `WEBLATE_PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_RATIO` environment variable. #### SEE ALSO [Project level backups](https://docs.weblate.org/no/latest/admin/backup.md#projectbackup) ## PROJECT_NAME_RESTRICT_RE #### Versionadded Added in version 4.15. Defines a regular expression to restrict project naming. Any matching names will be rejected. #### SEE ALSO [Project name](https://docs.weblate.org/no/latest/admin/projects.md#project-name) ## PROJECT_WEB_RESTRICT_HOST #### Versionadded Added in version 4.16.2. Reject using certain hosts in project website. Any subdomain is matched, so including `example.com` will block `test.example.com` as well. The list should contain lower case strings only, the parsed domain is lower cased before matching. Default configuration: ```python PROJECT_WEB_RESTRICT_HOST = {"localhost"} ``` #### SEE ALSO * [Project website](https://docs.weblate.org/no/latest/admin/projects.md#project-web) * [`PROJECT_WEB_RESTRICT_NUMERIC`](#std-setting-PROJECT_WEB_RESTRICT_NUMERIC) * [`PROJECT_WEB_RESTRICT_PRIVATE`](#std-setting-PROJECT_WEB_RESTRICT_PRIVATE) * [`PROJECT_WEB_RESTRICT_RE`](#std-setting-PROJECT_WEB_RESTRICT_RE) * [`PROJECT_WEB_RESTRICT_ALLOWLIST`](#std-setting-PROJECT_WEB_RESTRICT_ALLOWLIST) ## PROJECT_WEB_RESTRICT_ALLOWLIST #### Versionadded Added in version 5.17. Defines a set of project slugs exempt from [`PROJECT_WEB_RESTRICT_HOST`](#std-setting-PROJECT_WEB_RESTRICT_HOST), [`PROJECT_WEB_RESTRICT_NUMERIC`](#std-setting-PROJECT_WEB_RESTRICT_NUMERIC), [`PROJECT_WEB_RESTRICT_PRIVATE`](#std-setting-PROJECT_WEB_RESTRICT_PRIVATE), and [`PROJECT_WEB_RESTRICT_RE`](#std-setting-PROJECT_WEB_RESTRICT_RE) when validating the project website. Project slugs are matched case-insensitively. #### CAUTION This exemption weakens outbound URL protections for matching projects, including the private-target restriction enforced by [`PROJECT_WEB_RESTRICT_PRIVATE`](#std-setting-PROJECT_WEB_RESTRICT_PRIVATE). Use it only for trusted, administrator-managed projects where bypassing these checks is intentional. Default configuration: ```python PROJECT_WEB_RESTRICT_ALLOWLIST = set() ``` #### SEE ALSO * [Project website](https://docs.weblate.org/no/latest/admin/projects.md#project-web) * [`PROJECT_WEB_RESTRICT_HOST`](#std-setting-PROJECT_WEB_RESTRICT_HOST) * [`PROJECT_WEB_RESTRICT_NUMERIC`](#std-setting-PROJECT_WEB_RESTRICT_NUMERIC) * [`PROJECT_WEB_RESTRICT_PRIVATE`](#std-setting-PROJECT_WEB_RESTRICT_PRIVATE) * [`PROJECT_WEB_RESTRICT_RE`](#std-setting-PROJECT_WEB_RESTRICT_RE) ## PROJECT_WEB_RESTRICT_NUMERIC #### Versionadded Added in version 4.16.2. Reject using numeric IP address in project website. On by default. #### SEE ALSO * [Project website](https://docs.weblate.org/no/latest/admin/projects.md#project-web) * [`PROJECT_WEB_RESTRICT_HOST`](#std-setting-PROJECT_WEB_RESTRICT_HOST) * [`PROJECT_WEB_RESTRICT_PRIVATE`](#std-setting-PROJECT_WEB_RESTRICT_PRIVATE) * [`PROJECT_WEB_RESTRICT_RE`](#std-setting-PROJECT_WEB_RESTRICT_RE) ## PROJECT_WEB_RESTRICT_PRIVATE #### Versionadded Added in version 5.17. Reject using project website and repository browser URLs pointing to internal or non-public addresses. On by default. #### SEE ALSO * [Project website](https://docs.weblate.org/no/latest/admin/projects.md#project-web) * [Repository browser](https://docs.weblate.org/no/latest/admin/projects.md#component-repoweb) * [`PROJECT_WEB_RESTRICT_HOST`](#std-setting-PROJECT_WEB_RESTRICT_HOST) * [`PROJECT_WEB_RESTRICT_NUMERIC`](#std-setting-PROJECT_WEB_RESTRICT_NUMERIC) * [`PROJECT_WEB_RESTRICT_RE`](#std-setting-PROJECT_WEB_RESTRICT_RE) ## PROJECT_WEB_RESTRICT_RE #### Versionadded Added in version 4.15. Defines a regular expression to limit what can be entered as [Project website](https://docs.weblate.org/no/latest/admin/projects.md#project-web). Any matching URLs will be rejected. #### SEE ALSO * [Project website](https://docs.weblate.org/no/latest/admin/projects.md#project-web) * [`PROJECT_WEB_RESTRICT_HOST`](#std-setting-PROJECT_WEB_RESTRICT_HOST) * [`PROJECT_WEB_RESTRICT_NUMERIC`](#std-setting-PROJECT_WEB_RESTRICT_NUMERIC) * [`PROJECT_WEB_RESTRICT_PRIVATE`](#std-setting-PROJECT_WEB_RESTRICT_PRIVATE) ## WEBHOOK_PRIVATE_ALLOWLIST #### Versionadded Added in version 5.17. Defines hostnames or domains exempt from [`WEBHOOK_RESTRICT_PRIVATE`](#std-setting-WEBHOOK_RESTRICT_PRIVATE) for outbound webhook delivery. Entries follow Django host matching semantics, so values such as `hooks.internal.example` or `.internal.example` can be used. Default configuration: ```python WEBHOOK_PRIVATE_ALLOWLIST = [] ``` #### SEE ALSO * [`WEBHOOK_RESTRICT_PRIVATE`](#std-setting-WEBHOOK_RESTRICT_PRIVATE) ## WEBHOOK_RESTRICT_PRIVATE #### Versionadded Added in version 5.17. Reject webhook URLs pointing to internal or non-public addresses unless the target host is included in [`WEBHOOK_PRIVATE_ALLOWLIST`](#std-setting-WEBHOOK_PRIVATE_ALLOWLIST). On by default. When enabled, hostnames that cannot be resolved during validation are rejected unless they are explicitly included in [`WEBHOOK_PRIVATE_ALLOWLIST`](#std-setting-WEBHOOK_PRIVATE_ALLOWLIST). #### SEE ALSO * [Webhook](https://docs.weblate.org/no/latest/admin/addons.md#addon-weblate-webhook-webhook) * [`WEBHOOK_PRIVATE_ALLOWLIST`](#std-setting-WEBHOOK_PRIVATE_ALLOWLIST) ## PUBLIC_ENGAGE #### Versionadded Added in version 5.16.2. Allows public engage page even with [`REQUIRE_LOGIN`](#std-setting-REQUIRE_LOGIN). #### SEE ALSO * [Building the translation community](https://docs.weblate.org/no/latest/devel/share.md#promotion) ## REPORT_EXPIRY Defines how many days generated translation reports are retained. Defaults to 90 days. Changing the value also changes when existing reports become eligible for removal by the daily cleanup task. ## RATELIMIT_NOTIFICATION_LIMITS #### Versionadded Added in version 5.14. Limits how many notifications for a single user will be sent out. The default setting is: ```python # Multi-level rate limiting for email notifications # Each tuple contains (max_emails, time_window_seconds) RATELIMIT_NOTIFICATION_LIMITS = [ # Prevent burst sends - 3 emails per 2 minutes (3, 120), # Equalize to avoid getting blocked for too long - 10 emails per hour (10, 3600), # Daily limit: 50 emails per day (50, 86400), ] ``` ## API_RATELIMIT_ANON #### Versionadded Added in version 2026.10. Default anonymous [API rate limit](https://docs.weblate.org/no/latest/api.md#api-rate). Defaults to `"100/day"`. Rates use a request count and a period of seconds, minutes, hours, or days, for example `"100/hour"`. A zero count rejects every request covered by this throttle; `None` disables this throttle. Anonymous requests without an IP override are also subject to [`API_RATELIMIT_USER`](#std-setting-API_RATELIMIT_USER). ## API_RATELIMIT_USER #### Versionadded Added in version 2026.10. Default authenticated [API rate limit](https://docs.weblate.org/no/latest/api.md#api-rate). Defaults to `"5000/hour"`. Uses the same rate syntax as [`API_RATELIMIT_ANON`](#std-setting-API_RATELIMIT_ANON). Authenticated requests are counted per user; anonymous requests are counted per client IP. Set `None` to disable this throttle. ## API_RATELIMIT_USER_OVERRIDES #### Versionadded Added in version 2026.10. Mapping of exact usernames to API rate limits. Defaults to an empty dictionary. Override rates require a positive request count, or `None` for an exemption. These rules take precedence over [`API_RATELIMIT_IP_OVERRIDES`](#std-setting-API_RATELIMIT_IP_OVERRIDES). ```python API_RATELIMIT_USER_OVERRIDES = {"automation": "20000/hour"} ``` ## API_RATELIMIT_IP_OVERRIDES #### Versionadded Added in version 2026.10. Mapping of IPv4 or IPv6 addresses and CIDR networks to API rate limits. Defaults to an empty dictionary. The most specific matching network applies to both anonymous and authenticated requests, unless a username override matches. CIDRs must specify network addresses; duplicate normalized networks are rejected. Override rates require a positive request count, or `None` for an exemption. ```python API_RATELIMIT_IP_OVERRIDES = { "192.0.2.42": None, "198.51.100.0/24": "10000/hour", "2001:db8::/48": "10000/hour", } ``` See [API rate limiting](https://docs.weblate.org/no/latest/api.md#api-rate) for counting behavior and trusted proxy requirements. ## RATELIMIT_ATTEMPTS Maximum number of authentication attempts before rate limiting is applied. Defaults to 5. #### SEE ALSO * [Rate limiting](https://docs.weblate.org/no/latest/admin/optionals.md#rate-limit) * [`RATELIMIT_WINDOW`](#std-setting-RATELIMIT_WINDOW) * [`RATELIMIT_LOCKOUT`](#std-setting-RATELIMIT_LOCKOUT) ## RATELIMIT_WINDOW How long authentication is accepted after rate limiting applies. An amount of seconds, defaulting to 300 (5 minutes). #### SEE ALSO * [Rate limiting](https://docs.weblate.org/no/latest/admin/optionals.md#rate-limit) * [`RATELIMIT_ATTEMPTS`](#std-setting-RATELIMIT_ATTEMPTS) * [`RATELIMIT_LOCKOUT`](#std-setting-RATELIMIT_LOCKOUT) ## RATELIMIT_LOCKOUT How long authentication is locked after rate limiting applies. An amount of seconds defaulting to 600 (10 minutes). #### SEE ALSO * [Rate limiting](https://docs.weblate.org/no/latest/admin/optionals.md#rate-limit) * [`RATELIMIT_ATTEMPTS`](#std-setting-RATELIMIT_ATTEMPTS) * [`RATELIMIT_WINDOW`](#std-setting-RATELIMIT_WINDOW) ## REGISTRATION_ALLOW_BACKENDS #### Versionadded Added in version 4.1. List of authentication backends to allow registration from. This only limits new registrations, users can still authenticate and add authentication using all configured authentication backends. It is recommended to keep [`REGISTRATION_OPEN`](#std-setting-REGISTRATION_OPEN) on while limiting registration backends, otherwise users will be able to register, but Weblate will not show links to register in the user interface. Example: ```python REGISTRATION_ALLOW_BACKENDS = ["azuread-oauth2", "azuread-tenant-oauth2"] ``` #### HINT The backend names match names used in the URL for authentication. #### SEE ALSO * [`REGISTRATION_OPEN`](#std-setting-REGISTRATION_OPEN) * [Authentication](https://docs.weblate.org/no/latest/admin/auth.md) ## REGISTRATION_CAPTCHA Whether registration of new accounts is protected by a CAPTCHA. Defaults to enabled. If turned on, a CAPTCHA is added to all pages where a user enters their e-mail address: * New account registration. * Password recovery. * Adding e-mail to an account. * Contact form for users that are not signed in. The protection currently consists of following steps: * Mathematical captcha to be solved by the user. * Proof of work challenge calculated by the browser. The difficulty can be adjusted using [`ALTCHA_COST`](#std-setting-ALTCHA_COST), [`ALTCHA_MEMORY_COST`](#std-setting-ALTCHA_MEMORY_COST), and [`ALTCHA_PARALLELISM`](#std-setting-ALTCHA_PARALLELISM). ## REGISTRATION_EMAIL_MATCH Allows you to filter which e-mail addresses can register. Defaults to `.*`, which allows any e-mail address to be registered. You can use it to restrict registration to a single e-mail domain: ```python REGISTRATION_EMAIL_MATCH = r"^.*@weblate\.org$" ``` ## REGISTRATION_ALLOW_DISPOSABLE_EMAILS #### Versionadded Added in version 5.16.1. Allow registration with disposable e-mail domains. When enabled, the disposable domain blocklist is bypassed. Default is `False`. #### SEE ALSO - [`REGISTRATION_EMAIL_MATCH`](#std-setting-REGISTRATION_EMAIL_MATCH) - [`WEBLATE_REGISTRATION_ALLOW_DISPOSABLE_EMAILS`](https://docs.weblate.org/no/latest/admin/install/docker.md#envvar-WEBLATE_REGISTRATION_ALLOW_DISPOSABLE_EMAILS) ## REGISTRATION_OPEN Whether registration of new accounts is currently permitted. Defaults to enabled. This setting affects built-in authentication by e-mail address or through the Python Social Auth (you can allow certain back-ends using [`REGISTRATION_ALLOW_BACKENDS`](#std-setting-REGISTRATION_ALLOW_BACKENDS)). #### NOTE If using third-party authentication methods such as [LDAP authentication](https://docs.weblate.org/no/latest/admin/auth.md#ldap-auth), it just hides the registration form, but new users might still be able to sign in and create accounts. #### SEE ALSO * [`REGISTRATION_ALLOW_BACKENDS`](#std-setting-REGISTRATION_ALLOW_BACKENDS) * [`REGISTRATION_EMAIL_MATCH`](#std-setting-REGISTRATION_EMAIL_MATCH) * [Authentication](https://docs.weblate.org/no/latest/admin/auth.md) ## REGISTRATION_REBIND #### Versionadded Added in version 4.16. Allow rebinding authentication backends for existing users. Turn this on when migrating between authentication providers. #### NOTE Off by default to not allow adding other authentication backends to an existing account. Rebinding can lead to account compromise when using more third-party authentication backends. ## REPOSITORY_ALERT_THRESHOLD #### Versionadded Added in version 4.0.2. Threshold for triggering an alert for outdated repositories, or ones that contain too many changes. Defaults to 25. #### SEE ALSO [Translation component diagnostics](https://docs.weblate.org/no/latest/devel/alerts.md#alerts) ## REQUIRE_LOGIN #### Versionadded Added in version 4.1. This enables [`django.contrib.auth.middleware.LoginRequiredMiddleware`](https://docs.djangoproject.com/en/stable/ref/middleware/#django.contrib.auth.middleware.LoginRequiredMiddleware) and configures REST framework to require authentication for all API endpoints. #### Versionchanged Changed in version 5.15: Weblate now relies on Django built-in middleware. #### NOTE This is implemented in the [Sample configuration](https://docs.weblate.org/no/latest/admin/sample.md#sample-configuration). For Docker, use [`WEBLATE_REQUIRE_LOGIN`](https://docs.weblate.org/no/latest/admin/install/docker.md#envvar-WEBLATE_REQUIRE_LOGIN). ## GOOGLE_CLOUD_ERROR_REPORTING Configuration for [Collecting error reports and monitoring performance](https://docs.weblate.org/no/latest/admin/install.md#collecting-errors) using Google Cloud Error Reporting. Set to `None` to disable the integration, or set to a dictionary of keyword arguments for the Google Cloud Error Reporting client. Weblate automatically supplies `service` as `weblate` and `version` as the current Weblate version or Git revision. Explicit values in the dictionary override these defaults. ## OPENTELEMETRY_ENABLED #### Versionadded Added in version 2026.6. Enable backend tracing using OpenTelemetry. Disabled by default. Traces are exported only when this is enabled and [`OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT`](#std-setting-OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT) is configured. ## OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT OTLP HTTP traces endpoint for OpenTelemetry, for example `https://collector.example.com/v1/traces`. ## OPENTELEMETRY_EXPORTER_OTLP_HEADERS Additional HTTP headers for the OpenTelemetry OTLP exporter. Defaults to an empty dictionary. ## OPENTELEMETRY_EXTRA_RESOURCE_ATTRIBUTES Additional OpenTelemetry resource attributes. Defaults to an empty dictionary. ## OPENTELEMETRY_SERVICE_NAME OpenTelemetry service name. Defaults to `weblate`. ## OPENTELEMETRY_TRACES_SAMPLE_RATE Configure sampling rate for OpenTelemetry traces. Set to 1 to trace all events, 0 (the default) disables tracing. ## SENTRY_DSN Sentry DSN to use for [Collecting error reports and monitoring performance](https://docs.weblate.org/no/latest/admin/install.md#collecting-errors). #### SEE ALSO [Django integration for Sentry](https://docs.sentry.io/platforms/python/integrations/django/) ## SENTRY_ENVIRONMENT Configures environment for Sentry. Defaults to `devel`. ## SENTRY_MONITOR_BEAT_TASKS #### Versionadded Added in version 5.13. Configure whether to monitor Celery Beat tasks with Sentry. Defaults to `True`. ## SENTRY_PROFILES_SAMPLE_RATE Configure sampling rate for performance monitoring. Set to 1 to profile all traced events (the default), 0 disables profiling. #### SEE ALSO [Sentry Performance Monitoring](https://docs.sentry.io/product/sentry-basics/performance-monitoring/) ## SENTRY_SEND_PII Allow Sentry to collect certain personally identifiable information. Turned off by default. #### Versionchanged Changed in version 5.7: This is turned off by default now, used to be turned on by default. ## SENTRY_TRACES_SAMPLE_RATE Configure sampling rate for profiling monitoring. Set to 1 to trace all events, 0 (the default) disables tracing. #### SEE ALSO [Sentry Profiling](https://docs.sentry.io/product/profiling/) ## SESSION_COOKIE_AGE_2FA #### Versionadded Added in version 5.13.1. Set session expiry while in [Two-factor authentication](https://docs.weblate.org/no/latest/admin/auth.md#fa). This complements [`SESSION_COOKIE_AGE`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-SESSION_COOKIE_AGE) which is used for unauthenticated users. ## SESSION_COOKIE_AGE_AUTHENTICATED #### Versionadded Added in version 4.3. Set session expiry for authenticated users. This complements [`SESSION_COOKIE_AGE`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-SESSION_COOKIE_AGE) which is used for unauthenticated users. #### SEE ALSO [`SESSION_COOKIE_AGE`](https://docs.djangoproject.com/en/stable/ref/settings/#std-setting-SESSION_COOKIE_AGE) ## SIMPLIFY_LANGUAGES Use simple language codes for default language/country combinations. For example an `fr_FR` translation will use the `fr` language code. This is usually the desired behavior, as it simplifies listing languages for these default combinations. Turn this off if you want to different translations for each variant. ## HIDE_SHARED_GLOSSARY_COMPONENTS #### Versionadded Added in version 5.16. Glossary components are typically shared into other projects to make them available for translation work. When these are visible in the component list of projects that are using them, it can cause confusion or distract translators from the actual components that are meant to be translated. This is turned off by default, making shared glossary components visible. ## SITE_DOMAIN Configures site domain. Necessary to produce correct absolute links in many scopes (for example activation e-mails, notifications or RSS feeds). If Weblate is running on a non-standard port, include it here as well. **Examples:** ```python # Production site with domain name SITE_DOMAIN = "weblate.example.com" # Local development with IP address and port SITE_DOMAIN = "127.0.0.1:8000" ``` #### NOTE This setting should only contain the domain name. For configuring protocol, (turning on and enforcing HTTPS) use [`ENABLE_HTTPS`](#std-setting-ENABLE_HTTPS) and for changing the URL, use [`URL_PREFIX`](#std-setting-URL_PREFIX). #### HINT On a Docker container, the site domain is configured through [`WEBLATE_ALLOWED_HOSTS`](https://docs.weblate.org/no/latest/admin/install/docker.md#envvar-WEBLATE_ALLOWED_HOSTS). #### SEE ALSO * [Set correct site domain](https://docs.weblate.org/no/latest/admin/install.md#production-site) * [Allowed hosts setup](https://docs.weblate.org/no/latest/admin/install.md#production-hosts) * [Correctly configure HTTPS](https://docs.weblate.org/no/latest/admin/install.md#production-ssl) * [`WEBLATE_SITE_DOMAIN`](https://docs.weblate.org/no/latest/admin/install/docker.md#envvar-WEBLATE_SITE_DOMAIN) * [`ENABLE_HTTPS`](#std-setting-ENABLE_HTTPS) ## SITE_TITLE Site title to be used for the website and sent e-mails. ## SPECIAL_CHARS Additional characters to include in the visual keyboard, [Visual keyboard](https://docs.weblate.org/no/latest/user/translating.md#visual-keyboard). The default value is: ```python SPECIAL_CHARS = ("\t", "\n", "\u00a0", "…") ``` ## SINGLE_PROJECT Redirects users directly to a project or component instead of showing the dashboard. You can either set it to `True` so it only works if there is actually only single project in Weblate. Alternatively, set the project slug, and it will redirect unconditionally to this project. Example: ```python SINGLE_PROJECT = "test" ``` ## SSH_EXTRA_ARGS #### Versionadded Added in version 4.9. Allows adding custom parameters when Weblate is invoking SSH. Useful when connecting to servers using legacy encryption or other non-standard features. For example when SSH connection in Weblate fails with Unable to negotiate with legacyhost: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1, you can turn that on using: ```python SSH_EXTRA_ARGS = "-oKexAlgorithms=+diffie-hellman-group1-sha1" ``` #### HINT The string is evaluated by the shell, so ensure any whitespace and special characters is quoted. #### WARNING This is trusted administrator-controlled configuration. Arbitrary SSH options can alter connection routing and override the address pinning provided by [`VCS_RESTRICT_PRIVATE`](#std-setting-VCS_RESTRICT_PRIVATE). Administrators are responsible for the security and compatibility impact of all configured arguments. #### SEE ALSO [OpenSSH Legacy Options](https://www.openssh.org/legacy.html) ## STATUS_URL The URL where your Weblate instance reports its status. ## SUPPORT_STATUS_CHECK #### Versionadded Added in version 5.5. Defaults to `True`. When enabled, superusers without integrated support are redirected after login to a page offering professional support, at most once every 180 days per account. The reminder starts once the installation has a change older than 14 days and waits for an HTML page navigation. A Continue to Weblate action returns to the intended page. Set this to `False` to disable the redirect. This does not hide support or donation links elsewhere in the interface. #### HINT Improve your Weblate experience by purchasing a support subscription and boosting Weblate progress instead of turning this off. ## TRANSLATION_UPLOAD_MAX_SIZE #### Versionadded Added in version 5.17.1. Configures the maximum size, in bytes, for uploaded translation files. Defaults to 50 MB. In Docker, configure this using the `WEBLATE_TRANSLATION_UPLOAD_MAX_SIZE` environment variable. ## UNUSED_ALERT_DAYS #### Versionadded Added in version 4.17. Configures when the Component seems unused alert is triggered. Defaults to 365 days, set to 0 to turn it off. ## UPDATE_LANGUAGES #### Versionadded Added in version 4.3.2. Controls whether languages database should be updated when running database migration and is on by default. This setting has no effect on invocation of [`setuplang`](https://docs.weblate.org/no/latest/admin/management.md#weblate-admin-setuplang). #### WARNING The languages display might become inconsistent with this. Weblate language definitions expand over time and it will not display language code for the defined languages. #### SEE ALSO [Built-in language definitions](https://docs.weblate.org/no/latest/admin/languages.md#included-languages) ## URL_PREFIX This setting allows you to run Weblate under some path (otherwise it relies on being run from the webserver root). #### NOTE To use this setting, you also need to configure your server to strip this prefix. For example with WSGI, this can be achieved by setting `WSGIScriptAlias`. #### HINT The prefix should start with a `/`. Example: ```python URL_PREFIX = "/translations" ``` #### NOTE This setting does not work with Django’s built-in server, you would have to adjust `urls.py` to contain this prefix. ## VCS_ALLOW_HOSTS #### Versionadded Added in version 5.15. A set of hosts to allow when configuring VCS URL. Defaults to an empty set, which does no filtering at all. When [`VCS_RESTRICT_PRIVATE`](#std-setting-VCS_RESTRICT_PRIVATE) is enabled, matching hosts are also exempt from the private-target restriction. This exemption is also needed for VCS backends which cannot bind the client connection to the address validated by Weblate, such as Mercurial and Subversion. Use [`VCS_PRIVATE_ALLOWLIST`](#std-setting-VCS_PRIVATE_ALLOWLIST) instead when hosts should be exempt from the private-target restriction without filtering access to other public hosts. ## VCS_PRIVATE_ALLOWLIST #### Versionadded Added in version 2026.9. Defines hostnames or domains exempt from [`VCS_RESTRICT_PRIVATE`](#std-setting-VCS_RESTRICT_PRIVATE). Unlike [`VCS_ALLOW_HOSTS`](#std-setting-VCS_ALLOW_HOSTS), this setting does not filter access to other hosts. Entries follow Django host matching semantics, so values such as `vcs.internal.example` or `.internal.example` can be used. The exemption is needed for VCS backends which cannot bind the client connection to the address validated by Weblate, such as Mercurial and Subversion. It can also be used to allow private Git repository hosts. When [`VCS_ALLOW_HOSTS`](#std-setting-VCS_ALLOW_HOSTS) is non-empty, its host filter still applies and takes precedence over this allowlist. Default configuration: ```python VCS_PRIVATE_ALLOWLIST = [] ``` #### SEE ALSO * [`VCS_ALLOW_HOSTS`](#std-setting-VCS_ALLOW_HOSTS) * [`VCS_RESTRICT_PRIVATE`](#std-setting-VCS_RESTRICT_PRIVATE) ## VCS_ALLOW_SCHEMES #### Versionadded Added in version 5.15. A set of URL schemes to allow when configuring VCS URL. Only `https` and `ssh` are allowed by default. The `file` scheme and bare filesystem paths are disabled for security reasons because they could allow component editors to access repositories on the server filesystem. Including `file` in this setting prevents Weblate from starting with an `ImproperlyConfigured` error. ## VCS_RESTRICT_PRIVATE #### Versionadded Added in version 5.17. Reject VCS repository URLs pointing to internal or non-public addresses unless the target host is included in [`VCS_ALLOW_HOSTS`](#std-setting-VCS_ALLOW_HOSTS) or matches [`VCS_PRIVATE_ALLOWLIST`](#std-setting-VCS_PRIVATE_ALLOWLIST). On by default. When enabled, hostnames that cannot be resolved during validation are rejected unless they are trusted by [`VCS_ALLOW_HOSTS`](#std-setting-VCS_ALLOW_HOSTS) or [`VCS_PRIVATE_ALLOWLIST`](#std-setting-VCS_PRIVATE_ALLOWLIST). For Git repositories accessed over HTTPS or SSH, Weblate binds each VCS command to the addresses approved during runtime validation for direct connections. Configured HTTP proxies are trusted infrastructure and resolve repository hostnames instead. Automatic redirect following remains disabled. Permanent same-host HTTP redirects are probed separately through the same outbound route, validated, and stored as the canonical component repository URL. Cross-host redirects have to be configured manually. Mercurial, Subversion, custom VCS backends, and additional URL schemes are rejected unless the target host is trusted by [`VCS_ALLOW_HOSTS`](#std-setting-VCS_ALLOW_HOSTS) or [`VCS_PRIVATE_ALLOWLIST`](#std-setting-VCS_PRIVATE_ALLOWLIST). Network-level egress filtering which blocks internal, loopback, link-local, reserved, and cloud metadata address ranges is recommended as defense in depth, especially for custom integrations and administrator-installed extensions. ## VCS_API_DELAY #### Versionadded Added in version 4.15.1. Configures minimal delay in seconds between third-party API calls in [GitHub pull requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-github-pull-requests), [GitLab merge requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-gitlab-merge-requests), [Gitea pull requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-gitea-pull-requests), [Pagure merge requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-pagure-merge-requests), and [Azure DevOps pull requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-azure-devops-pull-requests). This rate-limits API calls from Weblate to these services to avoid overloading them. If you are being limited by secondary rate-limiter at GitHub, increasing this might help. The default value is 10. ## VCS_API_TIMEOUT #### Versionadded Added in version 5.15. Configures timeout in seconds for third-party API calls such as forking or creating merge requests in [GitHub pull requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-github-pull-requests), [GitLab merge requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-gitlab-merge-requests), [Gitea pull requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-gitea-pull-requests), [Pagure merge requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-pagure-merge-requests), and [Azure DevOps pull requests](https://docs.weblate.org/no/latest/admin/code-hosting.md#code-hosting-azure-devops-pull-requests). The default value is 10. ## VCS_BACKENDS Configuration of available VCS backends. #### NOTE Weblate offers configured backends when their required commands are available. Exact command versions are validated by the deployment and periodic configuration health checks. #### HINT You can limit choices or add custom VCS back-ends by using this. ```python VCS_BACKENDS = ("weblate.vcs.git.GitRepository",) ``` #### SEE ALSO [Version control integration](https://docs.weblate.org/no/latest/vcs.md#vcs) ## VCS_CLONE_DEPTH Configures how deep cloning of repositories Weblate should do. #### NOTE Currently this is only supported in [Git](https://docs.weblate.org/no/latest/vcs.md#vcs-git). By default Weblate does shallow clones of the repositories to make cloning faster and save disk space. Depending on your usage (for example when using custom [Add-ons](https://docs.weblate.org/no/latest/admin/addons.md#addons)), you might want to increase the depth or turn off shallow clones completely by setting this to 0. #### HINT In case you get `fatal: protocol error: expected old/new/ref, got 'shallow '` error when pushing from Weblate, turn off shallow clones completely by setting: ```python VCS_CLONE_DEPTH = 0 ``` ## WEBLATE_ADDONS List of add-ons available for use. To use them, they have to be enabled for a given translation component. By default this includes all built-in add-ons, when extending the list you will probably want to keep existing ones enabled, for example: ```python WEBLATE_ADDONS = ( # Built-in add-ons "weblate.addons.gettext.GenerateMoAddon", "weblate.addons.gettext.UpdateLinguasAddon", "weblate.addons.gettext.UpdateConfigureAddon", "weblate.addons.gettext.MsgmergeAddon", "weblate.addons.cleanup.CleanupAddon", "weblate.addons.consistency.LanguageConsistencyAddon", "weblate.addons.discovery.DiscoveryAddon", "weblate.addons.flags.SourceEditAddon", "weblate.addons.flags.TargetEditAddon", "weblate.addons.flags.SameEditAddon", "weblate.addons.flags.BulkEditAddon", "weblate.addons.generate.GenerateFileAddon", "weblate.addons.properties.PropertiesSortAddon", "weblate.addons.git.GitSquashAddon", "weblate.addons.removal.RemoveComments", "weblate.addons.removal.RemoveSuggestions", "weblate.addons.resx.ResxUpdateAddon", "weblate.addons.autotranslate.AutoTranslateAddon", "weblate.addons.cdn.CDNJSAddon", # Add-on you want to include "weblate.addons.example.ExampleAddon", ) ``` #### NOTE Removing the add-on from the list does not uninstall it from the components. Weblate will crash in that case. Please uninstall the add-on from all components prior to removing it from this list. #### SEE ALSO * [Add-ons](https://docs.weblate.org/no/latest/admin/addons.md#addons) * [Custom quality checks, add-ons, automatic suggestions and auto-fixes](https://docs.weblate.org/no/latest/admin/customize.md#custom-modules) * [`DEFAULT_ADDONS`](#std-setting-DEFAULT_ADDONS) * [`ADDON_ACTIVITY_LOG_EXPIRY`](#std-setting-ADDON_ACTIVITY_LOG_EXPIRY) ## ADDON_ACTIVITY_LOG_EXPIRY #### Versionadded Added in version 5.6. Configures how long activity logs for add-ons are kept. Defaults to 180 days. ## WEBLATE_EXPORTERS #### Versionadded Added in version 4.2. List of available exporters offering translation downloads or glossaries in various file formats. #### SEE ALSO [Localization file formats](https://docs.weblate.org/no/latest/formats.md#formats) ## WEBLATE_FORMATS List of file formats available for use. #### NOTE The default list already has the common formats. #### SEE ALSO [Localization file formats](https://docs.weblate.org/no/latest/formats.md#formats) ## WEBLATE_MACHINERY #### Versionadded Added in version 4.13. List of machinery services available for use. #### SEE ALSO * [Automatic suggestions](https://docs.weblate.org/no/latest/admin/machine.md) * [Custom machine translation](https://docs.weblate.org/no/latest/admin/machine.md#custom-machinery) * [Custom quality checks, add-ons, automatic suggestions and auto-fixes](https://docs.weblate.org/no/latest/admin/customize.md#custom-modules) ## WEBLATE_GPG_IDENTITY Identity used by Weblate to sign Git commits, for example: ```python WEBLATE_GPG_IDENTITY = "Weblate " ``` The Weblate GPG keyring is searched for a matching key (`home/.gnupg` under [`DATA_DIR`](#std-setting-DATA_DIR)). If not found, a key is generated, please check [Signing Git commits with GnuPG](https://docs.weblate.org/no/latest/admin/optionals.md#gpg-sign) for more details. #### SEE ALSO [Signing Git commits with GnuPG](https://docs.weblate.org/no/latest/admin/optionals.md#gpg-sign) ## WEBSITE_REQUIRED Defines whether [Project website](https://docs.weblate.org/no/latest/admin/projects.md#project-web) has to be specified when creating a project. On by default, as that suits public server setups. ## WEBSITE_ALERTS_ENABLED #### Versionadded Added in version 5.17. Default: `True` Defines whether Weblate should check project website availability and show alerts for unreachable project websites. When set to `False`, Weblate will skip website availability checks and will not generate project website alerts. This is useful when: - Your websites are behind firewalls that block Weblate’s requests - You want to avoid 403/503-type errors from bot protection - Project website availability is not a concern for your installation #### SEE ALSO [`WEBSITE_REQUIRED`](#std-setting-WEBSITE_REQUIRED) ## Configuring version control credentials #### HINT This section describes VCS credential variables as [`GITHUB_CREDENTIALS`](#std-setting-GITHUB_CREDENTIALS), [`GITLAB_CREDENTIALS`](#std-setting-GITLAB_CREDENTIALS), [`GITEA_CREDENTIALS`](#std-setting-GITEA_CREDENTIALS), [`PAGURE_CREDENTIALS`](#std-setting-PAGURE_CREDENTIALS), [`BITBUCKETSERVER_CREDENTIALS`](#std-setting-BITBUCKETSERVER_CREDENTIALS). The configuration dictionary consists of credentials defined for each API host. The API host might be different from what you use in the web browser, for example GitHub API is accessed as `api.github.com`. The credentials can also be overridden in [Repository push URL](https://docs.weblate.org/no/latest/admin/projects.md#component-push) or [Source code repository](https://docs.weblate.org/no/latest/admin/projects.md#component-repo) (if push URL is not configured), these take precedence over the ones specified in the configuration file. The following configuration is available for each host: `username` : API user, required. `token` : API token for the API user, required. `scheme` : #### Versionadded Added in version 4.18.
Scheme override. Weblate attempts to parse scheme from the repository URL and falls backs to `https`. If you are running the API server internally, you might want to use `http` instead, but consider security. #### HINT In the Docker container, the credentials can be configured using environment variables, see [Code-hosting sites credentials](https://docs.weblate.org/no/latest/admin/install/docker.md#docker-vcs-config).