Branch protection and admins: who can bypass your rules by default

Out of the box, GitHub branch protection rules do not apply to administrators or to custom roles with the bypass permission. Tick the option that disallows bypassing and the rules bind everyone. Even then, plan for admin access to be the weakest link, and review who holds it.

The default exemption

GitHub's documentation says admins and custom roles with the bypass branch protections permission are exempt from a rule's restrictions by default. A review requirement, a status check requirement and a signed commit requirement can all be skipped by those users until you change the setting.

The setting is named "Do not allow bypassing the above settings". Enabling it applies the rule to admins and to the bypass role.

What admins can still do

The same page notes that admins can always push to a protected branch or create a matching branch, even when push restrictions are set. Plan around that. Fewer admins means fewer people who can do it.

Other settings worth knowing

• Require approval of the most recent push. The last push must be approved by someone other than the pusher. This does not dismiss stale reviews.
• Dismiss stale approvals. New changes to the reviewed diff clear existing approvals.
• Require code owner review. Owners of changed files must approve.
• Require linear history. Merge commits are blocked, so pull requests must use squash or rebase.
• Force pushes and deletions. Both are disabled by default. Keep them that way on main branches.

A practical setup

1. Turn on required reviews with stale approval dismissal and approval of the most recent push.
2. Require status checks that actually run your tests and scans.
3. Turn on the no bypass option.
4. Shrink the admin list, then review it each quarter.
5. If you must keep an emergency path, move to rulesets and give a small named team bypass, so the exception is explicit and visible. See branch protection rules versus rulesets.

Why it matters for audits

Auditors often ask whether controls can be bypassed. "Yes, by admins, and here is the list and the log" is a better answer than silence. Pull request records are useful change evidence; see change management evidence from pull requests.

A common failure is a rule that looks strict on paper but is bypassed in practice. Teams often discover this only when an auditor asks for a sample of merged changes and a few have no review. Before that happens, sample your own recent merges to the default branch. Count how many had an approval and passing checks. If any did not, find out whether an admin bypass or a missing rule was the cause, and fix the cause rather than the single case.

Try it yourself

Click through it at your own pace, or open it full screen. Look at how a failed gate blocks the merge, then think about who could skip it in your repository.

Quick check

Sources

• About protected branches, GitHub Docs

Last reviewed: 19 October 2026.