Option to enable search for logged in users only?

Contribute Feature
1

Is there an option to disable “Search” for anonymous users? Allow only logged in users to search the forum.. Thanks in advance.

2 Likes
2

You should hide the search box with CSS. You’d also need to see that Google doesn’t index your site, if you really want people not to be able to find things.

1 Like
3

Hi, check out this thread Hooks from: & to: syntax in yml to disable anonymous searches - #4 by opcourdis

Adding the line below in your app.yml in the env: section, then ./launcher restart app may be useful even tough I wonder if there is still a way to access contents in another way for anonymous users who may also set a session cookie to pretend to be connected, but I may be wrong.. If anyone has an opinion on this, feel free to share

env:
  DISCOURSE_RATE_LIMIT_SEARCH_ANON_GLOBAL_PER_MINUTE: 0
4

I’m trying that, but direct links to search pages now just return this JSON:

{
  "failed":"FAILED",
  "message":"You’ve performed this action too many times, please try again later."
}

Is there another way to do it?

The reason that I can’t let anonymous users search the forum is that a sophisticated bot is scraping data with queries like this:

/search?q=%40UserName+%23general+in%3Afirst

It looks like they are mapping users and their content for some kind of data mining task. In order to protect user data, I want to prevent any anonymous access to search. The problem is that there are internal links to search pages, so anyone who isn’t logged in will hit that incorrect JSON message.

I edited the themes so that they can’t find the search box until they log in, but any anonymous user who clicks on existing links to a search result will get the JSON.

They hit the forum with tens of thousands of requests today before I stopped it.

Edit: Claude suggested a Cloudflare security rule to redirect anonymous users who hit search URLs to the signup page. That isn’t ideal, but it will at least take care of it for tonight.

In case anyone wants to try it, here’s the Cloudflare Redirect Rule expression in Rules → Redirect Rules → create rule:

starts_with(http.request.uri.path, "/search") and not http.cookie contains "_t="

Type: Dynamic off / Static URL redirect → https://forum.your_domain.com/signup, status 302, don’t preserve query string.

1 Like
5

It’s probably going to reach 100,000 bot hits today. :weary_face:

Check your own forums for this kind of traffic, because it looks like the kind of thing where they would be scraping a lot of forums for some kind of “people search” data, linking forum usernames and content to real identities.

1 Like