Login Only - Does it actually stop all traffic access without login?

Support
1

Based on concerns and dealing with issues raised here over time (which from reading is systemic across the web the last few months) and facing new waves of this stuff.

I tested Login Only, but noticed these AI bot waves hitting all kinds of discourse resources/paths, and potentially getting served a page/contents

Can anyone confirm if Login Only is a total block or not?

Also is there another potential entry angle via a Cloudflare cache interplay when, even when purging all caches, post Login Only state or does that solve the potential issue or only mitigate it until the cache is rebuilt?

2

Which paths specifically? anything that gets hit should redirect to login.

Yes, login only means the only way you can access the site is by logging in. It’s still possible to get some bot traffic to the / or /login routes, because those need to be public to allow humans to log in, but it will be restricted to those routes.