We are using GeoServer 2.8, PostgreSQL 9.6 & QGIS 2.16 on our side. We have certain WFS layers. As per documentation disabled Anonymous WFS access and looking more settings for Web part.
However in QGIS by adding our GeoServer IP details using URL like "http://123.456.789.25/geoserver/wfs?" can able to add WFS service connection and able to download data in shapefile format, but not able to 'edit data' that's good part.
How to disable 'save as to shapefile' option for WFS service? Is there anything more need to configure on GeoServer?
Checking on Geo-server security links for reference