Disable Add new module page, install new module link on the Extend page in Drupal 8, 9, and 10

• drupal 8 disable install new module link
• drupal disable “Add new module” Install new module
• module to disable “Add new module” Drupal
• block access to the /admin/modules/install page and associated menu item

Add this to your settings.php or appropriate environment-specific settings.php if using that approach and wanting to allow this on some environments.

$settings['allow_authorize_operations'] = FALSE;

If you really don’t allow site administrators to access your server directly, this will prevent Drupal from lying to them and inviting them to install modules which they will not be able to do.

New updates

Clearly, other people have also wanted to do this, here they did it with an alterRoutes() function but the admin menu did not respect it:

• Menu items on Admin Toolbar still shown when access denied

And finally with Project Browser (for proper composer installs through the UI) being a thing, here they did it with an alterRoutes() a little more elegantly using the update.module_install route name:

• Add “Disable Add new module page” option to settings page [#3361123] | Drupal.org

Seems this settings approach is still best.

… except that the add new modules page is still showing up for me… ah, because $conf is out and $settings is in for this type of setting. Updated this note above to use correct modern settings for disallowing non-composer extension adding.