🧩 WoW Addon Restrictions

What retail World of Warcraft addons can and can't do, from Midnight (12.0) through Patch 12.1 (released Aug 27, 2026). Last updated October 2026.

TL;DR Since Midnight, addons can still restyle, move, rebuild and extend the UI almost freely. What they can no longer do is read live combat data and make decisions from it during boss encounters, Mythic+, PvP and on restricted maps. Patch 12.1 applied the same rule to buffs and debuffs. The older rule that addons can't play the game for you still applies on top.

1Rules that predate Midnight

Protected actions need a real keypress or click. Addon code can't cast spells, use items, target units, move your character or click action buttons by itself. Secure templates (SecureActionButtonTemplate and similar) let a click from you do these things, but you configure them out of combat.
Combat lockdown. While InCombatLockdown() is true, you can't show, hide, move, resize or reparent protected frames (action bars, unit frames, secure buttons), or change their attributes. Queue those changes and apply them on PLAYER_REGEN_ENABLED.
Taint. If your code touches a Blizzard secure code path, it can break that path ("Interface action blocked"). Hook with hooksecurefunc; don't overwrite Blizzard functions.
Hardware-event APIs. Some calls (certain purchases, whispers, the LFG queue and others) only work directly from a click or keypress.

2The Midnight system: secret values (12.0+)

When restrictions are active, many APIs return a secret value to addon code instead of the real number or string. Blizzard UI code still sees the real value; your addon gets something it can pass along but not inspect.

✓ You can

Store it in a variable or table field
Pass it to functions
Concatenate it, or use it in string.format / string.join
Check its type with type()
Give it to widgets that accept secrets: StatusBar:SetValue, FontString:SetText, Cooldown:SetCooldown, SetAlpha, SetShown

✕ Lua error if you

Do arithmetic on it
Compare it, or boolean-test a secret boolean
Use the length operator #
Use it as a table key
Index it or iterate over it
Call it as a function

Contamination

Once you pass a secret into a widget, that widget's related getters (GetText, GetValue, position and anchors) also return secrets. This spreads to child frames and to frames anchored to it. Only SetToDefaults() clears it.

Working with secrets without reading them

C_CurveUtil.CreateCurve / CreateColorCurve: map a value to a colour, for example health-based colouring.
C_DurationUtil.CreateDuration together with StatusBar:SetTimerDuration: show timers.

Detection

issecretvalue(), canaccessvalue(), issecrettable(), C_Secrets.ShouldAurasBeSecret(), C_Secrets.ShouldCooldownsBeSecret(), C_RestrictedActions, C_ChatInfo.InChatMessagingLockdown()

Testing outside raids

These console variables force restrictions on so you can test anywhere. They reset when you restart the game:

addonCombatRestrictionsForced addonEncounterRestrictionsForced addonMapRestrictionsForced addonChallengesModeRestrictionsForced addonPvPMatchRestrictionsForced addonChatRestrictionsForced

3When secrets apply, and what becomes secret

Restrictions turn on in combat, during an active raid encounter, during a Mythic+ run, in PvP matches and on restricted maps (instances). Open-world, out-of-combat play is mostly unrestricted. After the initial backlash, Blizzard narrowed many rules to apply only "during an active encounter or M+ run".

Data	Status
Enemy and NPC health, max health, power	Secret
Cooldowns, when restricted	Secret except whitelisted spells
Auras (buffs and debuffs)	Fully secret in combat, encounters, M+ and PvP since 12.1
Unit names/identity for non-party units in instances	Secret
`UnitClass`, `UnitRace`, `UnitSex`, `UnitGroupRolesAssigned`, leader/assistant checks, `GetInspectSpecialization`	Secret whenever that unit's identity is secret (new in 12.1)
Your own stats	Secret while auras are secret (12.0.5)
Your own and your party's basic data, pets	Generally readable
Class resources: combo points, Holy Power, Maelstrom Weapon, runes, Soul Fragments	Readable (whitelisted)
Some short rotational healer spells and very long buffs	Readable (declassified in 12.0.1)
Chat events for loot, money, XP, rep, honor, currency	Readable since 12.0.7

4Other systems

Combat log: you can't register COMBAT_LOG_EVENT_UNFILTERED at all; doing so throws an error. You only get a filtered, sanitised feed through C_CombatLog. Addons that build their own damage meters from the log no longer work; Blizzard has a built-in meter with a limited C_DamageMeter API.
Addon comms and chat: during encounter or M+ lockdown, SendAddonMessage and addon-sent chat or whispers are blocked. Incoming whisper text and sender names arrive as secrets. Before and after a pull, comms work normally, so loot council, raid notes and keystone sharing still work. You can check with C_ChatInfo.AreOutgoingAddonChatMessagesRestricted().
Group management in lockdown: promote, assist, ready check, countdown and loot method calls are blocked (12.0.5).
Auras in 12.1: to display buffs and debuffs you now use Blizzard's AuraContainer, AuraGroup and AuraSlot objects. You choose the filters (spell ID, dispel type, duration, stealable), sorting and layout, and Blizzard fills them in without exposing the data to your code. You can't hook or script the aura buttons, and you can't reparent them. SecureAuraHeaderTemplate has been removed.
Blizzard replacements for banned addon types: Encounter Timeline and Encounter Warnings (instead of boss mods), Cooldown Manager (instead of WeakAuras-style tracking; WeakAuras will not be updated for Midnight), Combat Audio Alerts, the built-in damage meter, and private auras, which you may anchor and attach sounds to.

5What you can and can't do

✓ Still fine

Full reskins, layouts and moving or resizing frames, including Blizzard frames out of combat
Unit frames and nameplates that display health, power and auras through the secret-safe widgets
Anything outside combat: bags, maps, waypoints, rep and quest tracking, collections, auction house, crafting, mail, chat cosmetics, tooltips
Pre-pull and post-pull comms, loot tools, notes
Your own class resources, and whitelisted cooldowns
Cosmetic timers built on duration objects
New in 12.1: SVG textures through the VectorGraphics object, and a [Bootstrap] TOC directive

✕ Not during encounters, M+ or PvP

Making logic decisions on enemy health, auras or cooldowns, such as "warn me when the boss is below 30%" or "glow when this debuff has under 3 seconds left"
Parsing the combat log
Custom boss mods that react to events
Syncing state between players mid-pull
Rotation helpers
Reading which buffs are present to drive your own logic
Getting class or role of non-party units where identity is secret

⚠ Never allowed

Automating gameplay of any kind: casting, targeting, movement or clicking without your input
Changing protected frames in combat

Tip: If your addon reads unit data, wrap reads in issecretvalue() checks and fall back to hiding the element, or hand the value straight to a widget. Don't let the comparison throw. That one pattern fixes most addons that broke in Midnight.

6Blizzard's UI Add-On Development Policy

Addons must be free. No paid or premium tiers, and no charging for addon-related services.
No obfuscated code. The source must be publicly viewable.
No ads inside addons.
No donation requests in-game. Asking on your download page is fine.
No addons that hurt realm performance, and no offensive content.