diff --git a/www/common/application_config_internal.js b/www/common/application_config_internal.js
index f9d73debc..996c86936 100644
--- a/www/common/application_config_internal.js
+++ b/www/common/application_config_internal.js
@@ -6,10 +6,19 @@
 define(function() {
     var config = {};
 
-    /* Select the buttons displayed on the main page to create new collaborative sessions
-     * Existing types : pad, code, poll, slide
+    /* Select the buttons displayed on the main page to create new collaborative sessions.
+     * Removing apps from the list will prevent users from accessing them. They will instead be
+     * redirected to the drive.
+     * You should never remove the drive from this list.
      */
     config.availablePadTypes = ['drive', 'pad', 'code', 'slide', 'poll', 'kanban', 'whiteboard', 'file', 'todo', 'contacts'];
+    /* The registered only types are apps restricted to registered users.
+     * You should never remove apps from this list unless you know what you're doing. The apps
+     * listed here by default can't work without a user account.
+     * You can however add apps to this list. The new apps won't be visible for unregistered
+     * users and these users will be redirected to the login page if they still try to access
+     * the app
+     */
     config.registeredOnlyTypes = ['file', 'contacts'];
 
     /*  Cryptpad apps use a common API to display notifications to users
diff --git a/www/common/common-constants.js b/www/common/common-constants.js
index c3eb447a2..cfe9b4bcc 100644
--- a/www/common/common-constants.js
+++ b/www/common/common-constants.js
@@ -15,6 +15,8 @@ define(function () {
         displayPadCreationScreen: 'displayPadCreationScreen',
         deprecatedKey: 'deprecated',
         // Sub
-        plan: 'CryptPad_plan'
+        plan: 'CryptPad_plan',
+        // Apps
+        criticalApps: ['profile', 'settings', 'debug']
     };
 });
diff --git a/www/common/sframe-common-outer.js b/www/common/sframe-common-outer.js
index 1a528435b..d29afcc18 100644
--- a/www/common/sframe-common-outer.js
+++ b/www/common/sframe-common-outer.js
@@ -95,6 +95,7 @@ define([
                 Cryptpad.loading.onDriveEvent.reg(function (data) {
                     if (sframeChan) { sframeChan.event('EV_LOADING_INFO', data); }
                 });
+
                 Cryptpad.ready(waitFor(function () {
                     if (sframeChan) {
                         sframeChan.event('EV_LOADING_INFO', {
@@ -279,6 +280,15 @@ define([
                     if (window.CryptPad_newSharedFolder) {
                         additionalPriv.newSharedFolder = window.CryptPad_newSharedFolder;
                     }
+                    if (Utils.Constants.criticalApps.indexOf(parsed.type) === -1 &&
+                          AppConfig.availablePadTypes.indexOf(parsed.type) === -1) {
+                        additionalPriv.disabledApp = true;
+                    }
+                    if (!Utils.LocalStore.isLoggedIn() &&
+                        AppConfig.registeredOnlyTypes.indexOf(parsed.type) !== -1) {
+                        additionalPriv.registeredOnly = true;
+                    }
+
                     for (var k in additionalPriv) { metaObj.priv[k] = additionalPriv[k]; }
 
                     if (cfg.addData) {
diff --git a/www/common/sframe-common.js b/www/common/sframe-common.js
index da2e4caa6..468d724dd 100644
--- a/www/common/sframe-common.js
+++ b/www/common/sframe-common.js
@@ -555,6 +555,27 @@ define([
                 Feedback.init(feedback);
             } catch (e) { Feedback.init(false); }
 
+            try {
+                var forbidden = ctx.metadataMgr.getPrivateData().disabledApp;
+                if (forbidden) {
+                    UI.alert(Messages.disabledApp, function () {
+                        funcs.gotoURL('/drive/');
+                    }, {forefront: true});
+                    return;
+                }
+                var mustLogin = ctx.metadataMgr.getPrivateData().registeredOnly;
+                if (mustLogin) {
+                    UI.alert(Messages.mustLogin, function () {
+                        funcs.setLoginRedirect(function () {
+                            funcs.gotoURL('/login/');
+                        });
+                    }, {forefront: true});
+                    return;
+                }
+            } catch (e) {
+                console.error("Can't check permissions for the app");
+            }
+
             ctx.sframeChan.on('EV_LOADING_ERROR', function (err) {
                 if (err === 'DELETED') {
                     var msg = Messages.deletedError + '<br>' + Messages.errorRedirectToHome;
diff --git a/www/common/translations/messages.js b/www/common/translations/messages.js
index 6c5ce74c3..10b7ff4fd 100644
--- a/www/common/translations/messages.js
+++ b/www/common/translations/messages.js
@@ -55,6 +55,9 @@ define(function () {
     out.deleted = "Pad deleted from your CryptDrive";
     out.deletedFromServer = "Pad deleted from the server";
 
+    out.mustLogin = "You must be logged in to access this page";
+    out.disabledApp = "This application has been disabled. Contact the administrator of this CryptPad to have more information.";
+
     out.realtime_unrecoverableError = "An unrecoverable error has occured. Click OK to reload.";
 
     out.disconnected = 'Disconnected';
@@ -374,6 +377,7 @@ define(function () {
     out.contacts_typeHere = "Type a message here...";
     out.contacts_warning = "Everything you type here is persistent and available to all the existing and future users of this pad. Be careful with sensitive information!";
     out.contacts_padTitle = "Chat";
+    out.contacts_mustLogin = "You must be logged in to add contacts";
 
     out.contacts_info1 = "These are your contacts. From here, you can:";
     out.contacts_info2 = "Click your contact's icon to chat with them";
diff --git a/www/contacts/inner.js b/www/contacts/inner.js
index 4791d57fd..8accfd43b 100644
--- a/www/contacts/inner.js
+++ b/www/contacts/inner.js
@@ -54,6 +54,16 @@ define([
         APP.toolbar = Toolbar.create(configTb);
         APP.toolbar.$rightside.hide();
 
+        // we're in upload mode
+        if (!common.isLoggedIn()) {
+            UI.removeLoadingScreen();
+            return UI.alert(Messages.contacts_mustLogin, function () {
+                common.setLoginRedirect(function () {
+                    common.gotoURL('/login/');
+                });
+            });
+        }
+
         MessengerUI.create($(appElement), common);
 
         UI.removeLoadingScreen();