Skip to main content

We are currently a private community, but planning to transition to a public setting soon. 

While we can use permissions to gate specific category forums and modules, there does not appear to be a way to do that for a few core aspects of the platform like Events and Profiles. 

Is there a way to prevent profiles from being public (or at least from being indexed in search) on a public community? 

The use case: Personal information on the profile page. Community members are comfortable having it be available to others in the community, but don’t necessarily want it (and all their associated posts) to come up in a google search of their name. 

As far as I can tell from the guides, I’m afraid this isn’t really possible with anything built-in, and I’d be hesitant to ask Greg to create a script to modify the page headers to do it either.

The only reliable fix would be to remove all personal information from profiles before going public - which I strongly recommend doing for privacy and user safety reasons. Otherwise, there’s a risk of much more than people just discovering your users names that is not particularly great.

Don’t forget that just blocking out search engines wouldn’t prevent a malicious user scraping the entire community and mining out all that personal information anyway. I already know of several ways it can be done but I won’t reveal any such details for security reasons.


I really appreciate the insight @Blastoise186.

@SmartlyGreg (or other CSS pros) would it be possible to hide all of the profile fields from visibility for unregistered users? Or would the user data still be exposed? 

It sounds like there’s some risk of personal information being exposed, based on Blastoise’s comments. 


No worries. Now I must put my security hat on for a minute.

I’m afraid even with Custom CSS, the user data would still be exposed. Let’s think for a moment that you know me as being an evil hacker who wants to steal all your user data (it helps to set the scene!) and you react by using Custom CSS to simply hide it. There’d be nothing stopping me from using Chrome DevTools to temporarily disable your Custom CSS and reveal the data again, use Inspect Element to see through the Custom CSS, simply using View Page Source to grab it from there or even use a text-only user agent that’s incapable of rendering fancy graphics. And tada! I’ve just run off with all that “hidden” user data. All you’d really do is probably slow me down by about 20 seconds at most.

Even with a custom script, there’s no guarantee of truly hiding the user data because I think you’d still be reliant on Custom CSS as well.


Thanks, again. @Blastoise186. That exposed personal data is very concerning. 

For fields that are set as private visibility in control, is that data protected? Or is that information exposed as well? 


Nope, those are private to everyone except yourself and Mod+. No other users can see those fields and they’ll have (private) next to the tag in your settings.

I can also say this much. I’ve never managed to expose that field via any sneaky tactics either - the platform simply doesn’t serve those fields to you at all unless you have permission to view them.


@Blastoise186 I think you’ve explained this very clearly, there is not much we can do but artificially hide these but anyone could take a look at the content of the page at the touch of a few keys. Or at least nothing I know how to do!


Idea added for anyone who wants to vote for it:

 


Reply