Privacy of directory profile images

@ Michael

You need to add rules to your robots.txt file to prevent Google and other search engines from crawling the ../wp-content/uploads/connections-images/ folder.

Here’s a very through tutorial/overview of the robots.txt file:

https://www.elegantthemes.com/blog/tips-tricks/how-to-create-and-configure-your-robots-txt-file

Additionally, you can add the no indexing rule to an .htaccess file. I use to do this automatically but unfortunately some hosts would return 404 errors for the images due to the way the server was configured.

That said, something like this should do the trick:

User-agent: *
Disallow: /wp-*

This should actually prevent all search engines from indexing all files and folders within any folder that begins with wp-. And the .htaccess go into your site’s root folder where the wp-config.php file is. You likely already have this file, so you would simply add this to the top of the file.

A more conservative `.htaccess rule would be:

User-agent: *
Disallow: /wp-content/uploads/connections-images/*
Options -Indexes

You would create a new .htaccess file and put it in the ../wp-content/uploads/connections-images/ folder.

After you make these changes… you need to remove the links from the Google index. You can do this by using the Google Webmaster Tools. You can opt not to do this and the images will eventually be removed by Google since they will no longer be indexable.

Hope that helps!

@ Michael

re: The robots.txt is just a standard to request search engines etc not to index certain directories, so google etc would comply but this doesn’t change anything in the way of actually accessing the file.

Correct.

re: The .htaccess entries basically prevent any files from being listed in the connections-images folder (and sub-folders I’m assuming?). So this is something enforced by the web server / host right?

Correct.

re: if someone already knew the full URL of the image file, that is not blocked right?

Correct, the URL needs to be publically available in order for it to be displayed by the browser.

re: if someone was determined enough and simply knew a persons firstname/lastname and the directory structure of the plugin they would be able to access the image file

They would also need to know the exact name of the image file. If you use the .htaccess to block directory listing, there would be now way for someone to see the file names so they would not be able to guess the file name unless you name them with names that are easily guessable, like first and last name.

re: Is there any further way around this to restrict these images to be provided to logged in members only or this is a bit difficult?

Upload your images with unguessable file names.

Hope that helps!

@ Michael

Thanks! If you have a moment, I would truly appreciate a review as they really do make a difference. Many thanks in advance!

https://wordpress.org/support/view/plugin-reviews/connections

Thanks!