RSS Feed Security

Further testing also shows that while the text content of posts for private categories are hidden on normal web pages, the post titles and images included are shown. So the plugin is not hiding private categories from public view.

Hi, are you also protecting the content of the page or post? As far as I know when you enable content protection in posts it also protects the RSS feed. So when you go to yoursite.com/feed you will not see any blog posts displayed.

Kind regards.

I thought the same but have now verified this on two completely separate sites. Protecting a category from general view does not prevent the RSS feed from showing the content.
While Firefox does not actually render the XML content it does download it like a file, while Chrome actually renders it.
So “private” posts appear still available to the public in terms of their title and images with the full content also available via the XML.

Hi, I just completed a test in my dev site and it works for me. I was not able to see the content even when I type the following URL yoursite.com/feed/ on the browser. I can confirm this works for me.

You might like to check the following documentation.

https://mbrsolution.com/wordpress/simple-membership-plugin-category-protection.php

Let me know if the information above helps you.

Kind regards.

Thanks for your help on this. I have read through your documentation again and it is as I thought it was supposed to operate. So my two sites should be okay, though I do think that the titles of private posts should not be shown because these might give something away – a private post should be entirely private!

I have now created a test site with your plugin and another which I feared might clash and it does operate correctly (though the private post titles do appear) so there is something strange about the other sites. I will have to look through their setup again carefully. Have you any suggestions as to why posts might be private within pages but not within feeds?

Hi,

Have you any suggestions as to why posts might be private within pages but not within feeds?

This might have something to do with the theme you are using. Try testing one of WordPress default themes like Twenty Twenty.

Kind regards.