Users discuss whether it’s possible to block public access to Discourse’s JSON endpoints like /site/statistics.json and /site/basic-info.json. David_Foster asks if there’s a built-in admin setting to restrict access, noting these endpoints expose site data. nsuchy suggests using Cloudflare’s browser verification to deter scrapers, though acknowledges bots may bypass it. fefrei and nsuchy clarify that Discourse relies on this data for core functionality (e.g., header and /about page), making full blocking impractical. naomi offers a partial solution: disabling share anonymized statistics in Admin Settings to hide statistics.json, and recommends overriding the about.hbs template to hide data from the About page. nsuchy questions if this also blocks basic-info.json, but no direct method is confirmed. David_Foster later confirms the solution worked for him — no public JSON data remains accessible. While no native toggle fully blocks these endpoints without breaking functionality, combining settings and template overrides can significantly reduce exposure.
Just wondering if there is an option I’m not seeing for this..
its made public that any user can visit your discourse instance and goto site/basic-info.json, site/statistics.json
and gather information..
I know its not terribly sensitive information, but still would like the option to avoid any data being freely observed.
I see in the rails site_controller.rb
skip_before_action :redirect_to_login_if_required, only: [‘basic_info’, ‘statistics’]
I know I can just comment that out to resolve the issue, but it would be better if there was an option in the admin portal that would do this. Is there a setting I’m not seeing in the admin portal?
The json output is needed for the script to work, HOWEVER if you are worried about scrapers you could put your site behind Cloudflare and enable their “checking your browser” screen which would prevent bots from scraping/abusing the information. If you have privacy concerns with Cloudflare send me a private message and I can refer you to other providers (with extremely strict privacy policies) with a browser check (I don’t want to spam a list here).
Discourse needs the info to work, there’s no way to block it entirely, you could use a browser check to block bots but many bots can run javascript so that solution might not last long either.