What is the best way to disable access to the user's profile for viewing and editing? Basically users can create an account but won't be able to edit or view their own or other users' profiles.

3 Answers 3


Add this to a custom module:

function MYMODULE_menu_alter(&$items) {
  $items['user/%user']['access arguments'] = array('access user profiles');
  $items['user/%user']['access callback'] = 'user_access';
  $items['user/%user/edit']['access arguments'] = array('administer users');
  $items['user/%user/edit']['access callback'] = 'user_access';

This will put the user profile view under 'View user profiles' permission and edit under 'Administer users'.

  • thanks very much! worked a treat. I thought that I tried to do this with hook_menu but I suppose it was in the wrong place and should be in hook_menu_alter Commented Aug 20, 2014 at 6:25
  • Simply superb. I was looking for a contributed module for this. But, this answer did the job in least lines of code.
    – Pupil
    Commented May 24, 2019 at 5:28

Since the question doesn't seem to be specific for Drupal 7, this is how you do it in Drupal 8.

hook_menu_alter() is no used anymore; instead you use a RouteSubscriber class, as described in Altering existing routes and adding new routes based on dynamic ones.

The code for the RouteSubscriber class would look like this one.

namespace Drupal\my_module\Services;

use Drupal\Core\Routing\RouteSubscriberBase;
use Symfony\Component\Routing\RouteCollection;

 * Listens to the dynamic route events.
class RouteSubscriber extends RouteSubscriberBase {

   * {@inheritdoc}
  protected function alterRoutes(RouteCollection $collection) {
    if ($route = $collection->get('entity.user.edit_form')) {
      $route->setRequirement('_permission', 'administer users');

    if ($route = $collection->get('entity.user.canonical')) {
      $route->setRequirement('_permission', 'administer users');


The route names are taken from the User module. In setRequirement() you can do everything you can do in the normal route config. Note that setRequirement() adds a permission (or role, etc.), but the ["_entity_access"] => "user.update" requirement is also still part of the route.

Then you need to register the service in your module's service YAML file.

    class: Drupal\my_module\Services\RouteSubscriber
      - { name: event_subscriber }
  • where to put this code? In other words how to use it?
    – Umair
    Commented Jul 12, 2021 at 15:59
  • 1
    You should put this in a custom module with a file following the namespace/class naming : web/modules/custom/my_module/src/Services/RouteSubscriber.php And after at the root of your modules you need to add the services part : web/modules/custom/my_module/my_module.services.yml
    – tostinni
    Commented Sep 10, 2021 at 2:45
  • Very simple solution. It works great in Drupal 9!
    – mbomb007
    Commented Oct 13, 2023 at 17:01

Instead of creating a module for that you could simply create a rule.

Here's a how-to:

step 1: create a rule that acts on this event: "User account page is viewed"

step 2: set a condition, something like: "NOT User has role(s) Parameter: User: [account], Roles: administrator"

step 3: create an action: "Page redirect Parameter: URL: toboggan/denied" (in case you are using login toboggan but any page url should work here so you could create a page especially for that saying something like: "We're very sorry but at this moment you can't access your profile page."

step 4: make this rule active for example in case you wanted to get the latest version of your production site, download a sql backup, fiddle around with it locally and then be sure to upload it again without disappointing any users who might wanted to update their profile in the mean time.

additionally you could also add another condition to check if the user is viewing another user's profile page or their own so that you make two different rules, one which shows a page saying that they temporarily can't update their profile and another rule which shows a page that states why they can't view a particular user's profile.

I've tested this and added this condition: "Data comparison Parameter: Data to compare: [account], Data value: [site:current-user]" What this does is only deny access to view their own account and then show the correct page you created for this denied access. I think this makes more sense.

  • Always excited to use the power of rules. However this didn't work if the user has the direct URL to the edit page /user/nn/edit. It does prevent them from going to the /user page though.
    – Tony
    Commented Dec 8, 2014 at 23:44
  • Well spotted. If we could just add one more condition that checks if a url is of the string user/* then we'd be saved. I've tried it with a text comparison comparing the [account:edit-url] and the [site:current-user:edit-url] but that didn't work. Neither did the "Path has url alias" [site:current-user:edit-url] condition. I'll keep looking.
    – BassPlaya
    Commented Dec 10, 2014 at 7:33
  • I couldn't figure it out and the code from the accepted answer worked well so I gave up.
    – Tony
    Commented Dec 10, 2014 at 13:37
  • Redirecting away from the page is not the correct way to do access control.
    – mbomb007
    Commented Oct 13, 2023 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.