# Concerns regarding safe mode

**URL:** https://meta.discourse.org/t/concerns-regarding-safe-mode/85809
**Category:** Support
**Created:** [April 20, 2018, 3:13pm UTC](https://meta.discourse.org/t/concerns-regarding-safe-mode/85809 "2018-04-20T15:13:40Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![Karl\_Romanowski](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/karl_romanowski/32/87676_2.png) [@Karl\_Romanowski](https://meta.discourse.org/u/Karl_Romanowski)
#### Post date: [April 20, 2018, 3:13pm UTC](https://meta.discourse.org/t/concerns-regarding-safe-mode/85809/1 "2018-04-20T15:13:41Z")

</div>

I believe [safe mode](https://meta.discourse.org/t/53504?silent=true) should be IP restricted.

For example, the overwatch forums redirect some built-in pages to a 404. [Safe mode](https://meta.discourse.org/t/53504?silent=true) allows anyone to bypass that 404 and just see the page:

### Site Statistics

| | All Time | Last 7 Days | Last 30 Days |
| --- | --- | --- | --- |
| Topics | 60.8k | 7.3k | 29.7k |
| Posts | 755k | 97.6k | 386k |
| Users | 92.8k | 4.3k | 22.7k |
| Active Users | — | 31.6k | 56.7k |
| Likes | 1.0M | 117k | 489k |

I can also see the other pages they wanted to hide like /faq, /tos, and /privacy

Not a big deal because there’s no real security threat. But does entering [safe mode](https://meta.discourse.org/t/53504?silent=true) disable Akismet as well?

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [April 20, 2018, 3:37pm UTC](https://meta.discourse.org/t/concerns-regarding-safe-mode/85809/2 "2018-04-20T15:37:44Z")

</div>

> [@Karl\_Romanowski](#):
>
> But does entering [safe mode](https://meta.discourse.org/t/53504?silent=true) disable Akismet as well?

Nope, [safe mode](https://meta.discourse.org/t/53504?silent=true) only disable client-side stuff like CSS/JS/HTML.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [April 21, 2018, 12:10am UTC](https://meta.discourse.org/t/concerns-regarding-safe-mode/85809/3 "2018-04-21T00:10:43Z")

</div>

Interesting, thanks for noting this and bringing it to our attention. Do you have any feelings on this @sam?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 21, 2018, 12:14am UTC](https://meta.discourse.org/t/concerns-regarding-safe-mode/85809/4 "2018-04-21T00:14:48Z")

</div>

I think the issue here is that they did not disable stuff hard enough server side on said forum, if we feel like we do not want end users to get certain info we got to close the tap on the server side, a soft 404 on part of the endpoint may not be enough

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [April 21, 2018, 12:16am UTC](https://meta.discourse.org/t/concerns-regarding-safe-mode/85809/5 "2018-04-21T00:16:43Z")

</div>

So then it is a call that @eviltrout needs to make?

---

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [April 23, 2018, 1:48pm UTC](https://meta.discourse.org/t/concerns-regarding-safe-mode/85809/9 "2018-04-23T13:48:58Z")

</div>

I think an option to disable [safe mode](https://meta.discourse.org/t/53504?silent=true) is a good thing. I’ll look into it.

---

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [April 24, 2018, 6:10pm UTC](https://meta.discourse.org/t/concerns-regarding-safe-mode/85809/12 "2018-04-24T18:10:09Z")

</div>

In the latest version of Discourse you can disable [safe mode](https://meta.discourse.org/t/53504?silent=true) via a site setting:

[https://github.com/discourse/discourse/commit/fd14ee47979ba859875eac458cc9c37c8029ead8](https://github.com/discourse/discourse/commit/fd14ee47979ba859875eac458cc9c37c8029ead8)

---

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [April 25, 2018, 3:52pm UTC](https://meta.discourse.org/t/concerns-regarding-safe-mode/85809/13 "2018-04-25T15:52:28Z")

</div>

Here’s a small change: staff members can always use [safe mode](https://meta.discourse.org/t/53504?silent=true), even if disabled. @sam suggested this and I think it’s a good idea.

[https://github.com/discourse/discourse/commit/a5172a37e0bf2089300783d95f61380e22552120](https://github.com/discourse/discourse/commit/a5172a37e0bf2089300783d95f61380e22552120)

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [September 16, 2020, 4:08pm UTC](https://meta.discourse.org/t/concerns-regarding-safe-mode/85809/14 "2020-09-16T16:08:45Z")

</div>



---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [September 28, 2020, 7:07am UTC](https://meta.discourse.org/t/concerns-regarding-safe-mode/85809/15 "2020-09-28T07:07:15Z")

</div>


