diff --git a/BUILD b/BUILD
index 325c6ab..89cb6c3 100644
--- a/BUILD
+++ b/BUILD
@@ -5,6 +5,8 @@
     srcs = glob(["src/main/java/**/*.java"]),
     manifest_entries = [
         "Gerrit-PluginName: metrics-reporter-prometheus",
+        "Gerrit-Module: com.googlesource.gerrit.plugins.metricsreporters.GerritPrometheusModule",
+        "Gerrit-HttpModule: com.googlesource.gerrit.plugins.metricsreporters.GerritPrometheusHttpModule",
     ],
     resources = glob(["src/main/resources/**/*"]),
     deps = [
diff --git a/pom.xml b/pom.xml
index 17da0a2..15a4f17 100644
--- a/pom.xml
+++ b/pom.xml
@@ -40,6 +40,8 @@
           <archive>
             <manifestEntries>
               <Gerrit-PluginName>metrics-reporter-prometheus</Gerrit-PluginName>
+              <Gerrit-Module>com.googlesource.gerrit.plugins.metricsreporters.GerritPrometheusModule</Gerrit-Module>
+              <Gerrit-HttpModule>com.googlesource.gerrit.plugins.metricsreporters.GerritPrometheusHttpModule</Gerrit-HttpModule>
               <Implementation-Vendor>Gerrit Code Review</Implementation-Vendor>
               <Implementation-URL>https://gerrit-review.googlesource.com/#/admin/projects/plugins/metrics-reporter-prometheus</Implementation-URL>
               <Implementation-Title>Prometheus metrics plugin</Implementation-Title>
diff --git a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/CapabilityChecker.java b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/CapabilityChecker.java
new file mode 100644
index 0000000..32ca8f6
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/CapabilityChecker.java
@@ -0,0 +1,38 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.googlesource.gerrit.plugins.metricsreporters;
+
+import com.google.gerrit.extensions.annotations.PluginName;
+import com.google.gerrit.server.CurrentUser;
+import com.google.gerrit.server.account.CapabilityControl;
+import com.google.inject.Inject;
+import com.google.inject.Provider;
+
+public class CapabilityChecker {
+  private final Provider<CurrentUser> userProvider;
+  private final String capabilityName;
+
+  @Inject
+  CapabilityChecker(Provider<CurrentUser> userProvider,
+      @PluginName String pluginName) {
+    this.userProvider = userProvider;
+    this.capabilityName = String.format("%s-%s", pluginName,
+        ViewMetricsCapability.ID);
+  }
+
+  public boolean canViewMetrics() {
+    CapabilityControl ctl = userProvider.get().getCapabilities();
+    return ctl.canAdministrateServer() || ctl.canPerform(capabilityName);
+  }
+}
\ No newline at end of file
diff --git a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusExporter.java b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusExporter.java
index b561c5e..54827be 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusExporter.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusExporter.java
@@ -14,20 +14,40 @@
 package com.googlesource.gerrit.plugins.metricsreporters;
 
 import com.codahale.metrics.MetricRegistry;
-import com.google.gerrit.extensions.annotations.Export;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import io.prometheus.client.CollectorRegistry;
 import io.prometheus.client.dropwizard.DropwizardExports;
 import io.prometheus.client.exporter.MetricsServlet;
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletResponse;
 
-@Export("/metrics")
 @Singleton
 public class GerritPrometheusExporter extends MetricsServlet {
+  CapabilityChecker capabilityChecker;
+
   @Inject
-  public GerritPrometheusExporter(MetricRegistry registry) {
+  public GerritPrometheusExporter(MetricRegistry registry,
+      CapabilityChecker capabilityChecker) {
+    this.capabilityChecker = capabilityChecker;
+
     // Hook the Dropwizard registry into the Prometheus registry
     // via the DropwizardExports collector.
     CollectorRegistry.defaultRegistry.register(new DropwizardExports(registry));
   }
+
+  @Override
+  public void service(ServletRequest req, ServletResponse res)
+      throws ServletException, IOException {
+    if (capabilityChecker.canViewMetrics()) {
+      super.service(req, res);
+    } else {
+      HttpServletResponse httpResponse = (HttpServletResponse) res;
+      httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN,
+          "Forbidden access");
+	  }
+  }
 };
diff --git a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusHttpModule.java b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusHttpModule.java
new file mode 100644
index 0000000..1cd11db
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusHttpModule.java
@@ -0,0 +1,23 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.googlesource.gerrit.plugins.metricsreporters;
+
+import com.google.inject.servlet.ServletModule;
+
+public class GerritPrometheusHttpModule extends ServletModule {
+  @Override
+  protected void configureServlets() {
+    serve("/metrics").with(GerritPrometheusExporter.class);
+  }
+}
\ No newline at end of file
diff --git a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusModule.java b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusModule.java
new file mode 100644
index 0000000..c49d691
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusModule.java
@@ -0,0 +1,27 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.googlesource.gerrit.plugins.metricsreporters;
+
+import com.google.gerrit.extensions.annotations.Exports;
+import com.google.gerrit.extensions.config.CapabilityDefinition;
+import com.google.inject.AbstractModule;
+
+public class GerritPrometheusModule extends AbstractModule {
+  @Override
+  protected void configure() {
+    bind(CapabilityDefinition.class)
+      .annotatedWith(Exports.named(ViewMetricsCapability.ID))
+      .to(ViewMetricsCapability.class);
+  }
+}
\ No newline at end of file
diff --git a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/ViewMetricsCapability.java b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/ViewMetricsCapability.java
new file mode 100644
index 0000000..e3f7412
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/ViewMetricsCapability.java
@@ -0,0 +1,25 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.googlesource.gerrit.plugins.metricsreporters;
+
+import com.google.gerrit.extensions.config.CapabilityDefinition;
+
+public class ViewMetricsCapability extends CapabilityDefinition {
+  static final String ID = "viewMetrics";
+
+  @Override
+  public String getDescription() {
+    return "View Metrics";
+  }
+}
\ No newline at end of file
diff --git a/src/main/resources/Documentation/about.md b/src/main/resources/Documentation/about.md
index 4bc7e2f..0092de0 100644
--- a/src/main/resources/Documentation/about.md
+++ b/src/main/resources/Documentation/about.md
@@ -1,3 +1,7 @@
 This plugin exposes Gerrit metrics to Prometheus.
 
-The metrics can be accessed at the @URL@plugins/@PLUGIN@/metrics URL.
\ No newline at end of file
+The metrics can be accessed at the @URL@plugins/@PLUGIN@/metrics URL.
+
+To access the monitoring URL, a user must be a member of a group that is granted
+the ‘View Metrics’ capability (provided by this plugin) or the ‘Administrate
+Server’ capability.
\ No newline at end of file
diff --git a/src/main/resources/Documentation/config.md b/src/main/resources/Documentation/config.md
new file mode 100644
index 0000000..fa180cf
--- /dev/null
+++ b/src/main/resources/Documentation/config.md
@@ -0,0 +1,16 @@
+Configuration
+=============
+
+To access the monitoring URL, a user must be a member of a group that is granted
+the ‘View Metrics’ capability (provided by this plugin) or the ‘Administrate
+Server’ capability.This plugin requires no configuration.
+
+This capability can be configured in the 'Global Capabilities' section of the
+['All-Projects'](@URL@#/admin/projects/All-Projects,access) access right.
+
+It is possible to allow anonymous access to the metrics by giving the capability
+to the 'Anonymous Users' group.
+
+[Back to @PLUGIN@ documentation index][index]
+
+[index]: index.html
\ No newline at end of file