# User summary - guessable URL **URL:** \ **Category:** Self-hosting\ **Created:** [July 30, 2024, 3:39am UTC](https://meta.discourse.org/t/user-summary-guessable-url/319157 "2024-07-30T03:39:30Z")\ **Posts on this page:** 1\ **Showing post:** 1
**Author:** ![tkforbes](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tkforbes](https://meta.discourse.org/u/tkforbes)\ **Post date:** [July 30, 2024, 3:39am UTC](https://meta.discourse.org/t/user-summary-guessable-url/319157/1 "2024-07-30T03:39:30Z")
I’ve just installed a new Discourse and imported a history of interactions from another forum type. I’m executing some tests so that I can better learn about Discourse and so I can ensure it is locked up - the discussions are private. Okay, I set Login Required and it works. Great. As admin, I created a new post with an @username referencing my own personal account. An email arrived in my inbox with a copy of the post and a link for the @username. That link opens my Discourse on a URL like [https://discourse.mydomain.com/u/username/summary](https://discourse.mydomain.com/u/username/summary) which gives lots of helpful information. I updated the address in my browser, replacing my username with another member’s username and then was able to see a summary for the second user. Anyway, this URL can be guessed and my ‘private’ discourse becomes public. I must be missing some other setting that hides my site. --- _[View the full topic](https://meta.discourse.org/t/user-summary-guessable-url/319157)._