# Restrict users use any other operation, except GET **URL:** \ **Category:** Elasticsearch\ **Created:** [October 14, 2016, 8:46pm UTC](https://discuss.elastic.co/t/restrict-users-use-any-other-operation-except-get/63082 "2016-10-14T20:46:46Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![DBS](https://avatars.discourse-cdn.com/v4/letter/d/58f4c7/32.png) [@DBS](https://discuss.elastic.co/u/DBS)\ **Post date:** [October 14, 2016, 8:46pm UTC](https://discuss.elastic.co/t/restrict-users-use-any-other-operation-except-get/63082/1 "2016-10-14T20:46:46Z")
In production, how can I restrict general users only be able to use GET request, and all of other operations are prohibited? This should apply to both from terminal and from web browser. For example, general users cannot use curl -XDELETE '[http://www.example.com:9200/customer/external/1?pretty](http://www.example.com:9200/customer/external/1?pretty)' in terminal. General users cannot use web browser to do any other operations to indices, except GET. ---
**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\ **Post date:** [October 14, 2016, 9:04pm UTC](https://discuss.elastic.co/t/restrict-users-use-any-other-operation-except-get/63082/2 "2016-10-14T21:04:32Z")
If you buy a subscription from Elastic you can get access to an Elasticsearch plugin for [security](https://www.elastic.co/products/shield) which is quite comprehensive. That said, I think you just want an HTTP proxy? That'd provide some basic security so long as you are careful with the patterns you allow access to. The subscriptions pay my salary so personally I'd prefer you use that but you've got to do what is right for you. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:12pm UTC](https://discuss.elastic.co/t/restrict-users-use-any-other-operation-except-get/63082/3 "2017-07-05T22:12:09Z")
Closed on July 5, 2017, 10:12pm UTC