diff --git a/addons/website_mail_group/__openerp__.py b/addons/website_mail_group/__openerp__.py
index f90d654036f..5681dc31fd3 100644
--- a/addons/website_mail_group/__openerp__.py
+++ b/addons/website_mail_group/__openerp__.py
@@ -14,6 +14,7 @@ OpenERP Mail Group : Mailing List Archive
         'views/website_mail_group.xml',
         'views/website_mail_group_backend.xml',
         'data/website_mail_group_data.xml',
+        'security/website_mail_group.xml',
     ],
     'demo': [
         'data/website_mail_group_demo.xml'
diff --git a/addons/website_mail_group/controllers/main.py b/addons/website_mail_group/controllers/main.py
index 996b5524ffd..01ec8633d55 100644
--- a/addons/website_mail_group/controllers/main.py
+++ b/addons/website_mail_group/controllers/main.py
@@ -32,6 +32,7 @@ class MailGroup(http.Controller):
     def view(self, **post):
         cr, uid, context = request.cr, request.uid, request.context
         group_obj = request.registry.get('mail.group')
+        
         group_ids = group_obj.search(cr, uid, [], context=context)
         values = {
             'groups': group_obj.browse(cr, uid, group_ids, context),
@@ -39,7 +40,7 @@ class MailGroup(http.Controller):
         return request.website.render('website_mail_group.mail_groups', values)
 
     @http.route([
-        "/groups/subscription",
+        "/groups/subscription/",
     ], type='json', auth="public", website=True)
     def subscription(self, group_id=0, action=False ,**post):
         cr, uid, context = request.cr, request.uid, request.context
diff --git a/addons/website_mail_group/security/website_mail_group.xml b/addons/website_mail_group/security/website_mail_group.xml
new file mode 100644
index 00000000000..79d4390f6f9
--- /dev/null
+++ b/addons/website_mail_group/security/website_mail_group.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<openerp>
+    <data>
+        <record model="ir.rule" id="mail.mail_group_public_and_joined">
+            <field name="name">Mail.group: access only public and joined groups</field>
+            <field name="model_id" ref="mail.model_mail_group"/>
+            <field name="domain_force">['|', '|', ('public', '=', 'public'), ('message_follower_ids', 'in', [user.partner_id.id]), '&amp;', ('public','=','groups'), ('group_public_id','in', [g.id for g in user.groups_id])]</field>
+            <field name="perm_read" eval="False"/>
+            <field name="perm_create" eval="False"/>
+        </record>
+    </data>
+</openerp>
diff --git a/addons/website_mail_group/views/website_mail_group.xml b/addons/website_mail_group/views/website_mail_group.xml
index 18c7d47d01a..e6963200290 100644
--- a/addons/website_mail_group/views/website_mail_group.xml
+++ b/addons/website_mail_group/views/website_mail_group.xml
@@ -13,7 +13,7 @@
             <t t-set="head">
                 <script type="text/javascript" src="/website_mail_group/static/src/js/website_mail_group.js"></script>
             </t>
-            <div class="row">
+            <div class="row mt16">
                 <div class="container">
                     <div class="col-md-3 col-md-push-1">
                         <t t-call="website_mail_group.navigation_menu"/>
@@ -28,8 +28,8 @@
                                 <br/>
                                 <small t-esc="group.description"/>
                                 <br/>
-                                <a t-attf-class="btn btn-default js_group #{group.message_is_follower and 'hidden' or 'visible'} follow_#{group.id}" t-attf-href="/groups/subscription/#{ group.id }/?action=follow" t-attf-id="#{group.id}">Join Group</a>
-                                <a t-attf-class="btn btn-primary js_group #{group.message_is_follower and 'visible' or 'hidden'} unfollow_#{group.id}" t-attf-href="/groups/subscription/#{ group.id }/?action=unfollow" t-attf-id="#{group.id}">UnFollow</a>
+                                <a groups="base.group_user" t-attf-class="btn btn-default js_group #{group.message_is_follower and 'hidden' or 'visible'} follow_#{group.id}" t-attf-href="/groups/subscription/#{ group.id }/?action=follow" t-attf-id="#{group.id}">Join Group</a>
+                                <a groups="base.group_user" t-attf-class="btn btn-primary js_group #{group.message_is_follower and 'visible' or 'hidden'} unfollow_#{group.id}" t-attf-href="/groups/subscription/#{ group.id }/?action=unfollow" t-attf-id="#{group.id}">UnFollow</a>
                             </div>
                         </div>
                     </div>