# Login Only - Does it actually stop all traffic access without login?
**URL:** https://meta.discourse.org/t/login-only-does-it-actually-stop-all-traffic-access-without-login/390994
**Category:** Support
**Created:** [December 10, 2025, 10:54pm UTC](https://meta.discourse.org/t/login-only-does-it-actually-stop-all-traffic-access-without-login/390994 "2025-12-10T22:54:36Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@agemo](https://meta.discourse.org/u/agemo)
#### Post date: [December 10, 2025, 10:54pm UTC](https://meta.discourse.org/t/login-only-does-it-actually-stop-all-traffic-access-without-login/390994/1 "2025-12-10T22:54:36Z")
Based on concerns and dealing with issues raised [here](https://meta.discourse.org/t/anonymous-views-suddenly-very-high/251826/50) over time (which from reading is systemic across the web the last few months) and facing new waves of this stuff.
I tested **Login Only** , but noticed these AI bot waves hitting all kinds of discourse resources/paths, and potentially getting served a page/contents
**Can anyone confirm if Login Only is a total block or not?**
Also is there another potential entry angle via a Cloudflare cache interplay when, even when purging all caches, post **Login Only** state or does that solve the potential issue or only mitigate it until the cache is rebuilt?
---
### Author:  [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [December 12, 2025, 4:44pm UTC](https://meta.discourse.org/t/login-only-does-it-actually-stop-all-traffic-access-without-login/390994/2 "2025-12-12T16:44:25Z")
> [@agemo](#):
>
> hitting all kinds of discourse resources/paths, and potentially getting served a page/contents
Which paths specifically? anything that gets hit should redirect to login.
> [@agemo](#):
>
> **Can anyone confirm if Login Only is a total block or not?**
Yes, login only means the only way you can access the site is by logging in. It’s still possible to get some bot traffic to the `/` or `/login` routes, because those need to be public to allow humans to log in, but it will be restricted to those routes.
---
### Author:  [@agemo](https://meta.discourse.org/u/agemo)
#### Post date: [December 15, 2025, 3:17pm UTC](https://meta.discourse.org/t/login-only-does-it-actually-stop-all-traffic-access-without-login/390994/3 "2025-12-15T15:17:07Z")
As posted in the linked topic, for e.g.:
`...stylesheets/docker_manager_abc123.css`
In some simple testing I followed the links various traffic was seeking, and I was able to pull down the css or js files and who knows what else, when discourse was in Login Only mode.
---
### Author:  [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [December 15, 2025, 3:25pm UTC](https://meta.discourse.org/t/login-only-does-it-actually-stop-all-traffic-access-without-login/390994/4 "2025-12-15T15:25:23Z")
Oh I see, yes that’s expected… those are static assets used to render the app, they are often cached for performance and don’t contain sensitive post information.
---
### Author:  [@agemo](https://meta.discourse.org/u/agemo)
#### Post date: [December 15, 2025, 11:05pm UTC](https://meta.discourse.org/t/login-only-does-it-actually-stop-all-traffic-access-without-login/390994/5 "2025-12-15T23:05:29Z")
Ok I understand the but maybe true lockdown needs to be deeply and quickly considered, for technical reasons I can’t think of other than leaving no threads that can be yanked DDoS level.
I’ve just seen nearly 3K unique URL request targeting specifically `uploads/default/original/3X/c/.../...some.jpeg` route, all launched from one IP in Singapore, the paths are correct, I sampled a few links and they are to unique specific image files, but Cloudflare was set to block Singapore wholesale.
The way things are going, nothing should be left hanging out that can be used for target practice. Total block.
---
### Author:  [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [December 15, 2025, 11:19pm UTC](https://meta.discourse.org/t/login-only-does-it-actually-stop-all-traffic-access-without-login/390994/6 "2025-12-15T23:19:42Z")
Maybe [https://meta.discourse.org/t/secure-uploads/meta/140017](https://meta.discourse.org/t/secure-uploads/meta/140017) could help you on this?
---
### Author:  [@agemo](https://meta.discourse.org/u/agemo)
#### Post date: [December 16, 2025, 10:17am UTC](https://meta.discourse.org/t/login-only-does-it-actually-stop-all-traffic-access-without-login/390994/7 "2025-12-16T10:17:09Z")
Thanks for pointing that out. I was not aware of it, but yea a BIG maybe, I don’t know if I have the time and resources to implement right now.
---
### Author:  [@agemo](https://meta.discourse.org/u/agemo)
#### Post date: [December 16, 2025, 10:04pm UTC](https://meta.discourse.org/t/login-only-does-it-actually-stop-all-traffic-access-without-login/390994/8 "2025-12-16T22:04:32Z")
Searching meta I have discovered [the below option here](https://meta.discourse.org/t/theme-assets-served-from-uploads-break-when-prevent-anons-from-downloading-files-is-enabled/386380/) and have activated:
- `Prevent anonymous users from downloading attachments.`
Maybe this will block such requests or help to some degree.