Articles under extended confirmed protection (ECP) can be edited only by extended-confirmed accounts – accounts that have been registered for at least 30 days and have made at least 500 edits, or have been manually granted extended-confirmed rights by an administrator (usually because the account is a legitimate alternative account of a user who has extended-confirmed rights on another account). Extended confirmed (30/500) protection is therefore a stronger form of protection than semi-protection (rough guide).

The official policy related to applying extended confirmed protection is located at Wikipedia:Protection policy § Extended confirmed protection. This rough guide describes how that policy is currently being applied by administrators.

Generally, articles should first be placed under semi-protection to see if semi-protection in combination with appropriate blocks can give sufficient protection to obviate the need for extended confirmed protection. If semi-protection proves too weak even in combination with blocks that are appropriate, extended confirmed protection can be deployed. In the rare case of a long history of disruptive editing of an unprotected article by multiple autoconfirmed accounts (usually due to sockpuppetry), administrators can bypass semi-protection and apply extended confirmed protection immediately.

As of December 2024, Wikipedia does not have the ability to enforce ECP restrictions when those restrictions apply only to certain sections of articles, as they do for example, when ECR is applied to specific topic areas. In these cases, enforcement may be done by EC editors.

As of August 2023, it is still true that if protection is elevated from semi-protection to extended confirmed protection with an expiry that is sooner than the expiry of the original protection, the original protection will not be continued after the expiry of extended confirmed protection. Instead, it must be manually configured again when ECP has expired. It has occasionally proved useful to also enable pending changes indefinitely when setting a time-limited EC protection, so that articles do not become entirely unprotected.

Deployment of extended confirmed protection may be mandated or permitted as a remedy in Arbitration Committee (ArbCom) decisions. Any protection made as arbitration enforcement must be logged at Wikipedia:Arbitration enforcement log.

The topics which ArbCom has explicitly specified for use of ECP are the Arab–Israeli conflict and the history of Jews and antisemitism in Poland during World War II (1933–45). The community has further authorized blanket ECP for Armenia-Azerbaijan conflict topics as a general sanctions measure. Administrators may apply indefinite extended confirmed protection at any time to any page in the conflict area at their discretion, whether or not there has been disruptive editing on the page. There is a general consensus that administrators should neither apply ECP to pages with only a tenuous link to the conflict nor seek out articles in this topic area to protect pre-emptively. Many administrators will only apply ECP in circumstances where there have been editing disputes involving accounts that fail the 30/500 rule.

Discretionary sanctions (which can be applied to articles on a number of topics specified by ArbCom) do not explicitly include ECP. However, ECP has been applied to a number of pages as a discretionary sanction. This includes pages related to the Gamergate controversy and Indian castes.

As with other protection decisions, if a decision to apply ECP needs to be discussed, this should first be raised on the protecting administrator's talk page.

While the RfC that allowed ECP to be used outside topics specified by ArbCom mentions a notification on the administrator's noticeboard, most admins consider this requirement to be met by the bot that updates the table on WP:AN and so expect discussions to be held in the usual place.

• List of extended confirmed protected pages