We have a Wordpress site that is intended for direct traffic only - it has no main page or category pages etc., just individual pages that people are linked to directly. They're not password-protected, but the site is set not to be indexed by search engines. Recently a competitor gloated that he had been able to access metadata, including a list of all pages on the site and the site authors. I just went through and did an audit of the site. I've verified that the search query is deactivated and that none of the pages are showing up on Google. How else might the competitor be getting access to our metadata? Any and all help is appreciated.
Well we found one reason anyway - it looks like you can bring up a list of authors using ?author=1 query, which I hadn't even known existed. Here's an article that explains how and how to fix it: