I am setting up a WordPress with a user system. User information (names, profile picture) of all users should be private, and only accessable when logged in.
The "Ultimate Member" plugin provides a shortcode, which then displays information about a user:
To hide this information from non logged in users, they propose to wrap it as follows:
Now the user information is only visible when logged in.
But, am I mistaken, or would any direct request to the user data (e.g. what is under the hood of the first shortcode) base still return private information?
For example, when you have the URL, the profile picture could still be accessed at
From what I understand, the only type of real security here is security through obscurity, which is no security at all. I must be mistaken; how does this work?
I have since restricted access to uploads in the
/ultimatemember/ directory to logged in users only using an Apache (
.htaccess) Access Rule. However, this is not possible for the user database, since it need to be checked for non-logged in users in the log in process. To be clear, this question is on restricting access to user data base content, not user uploads (that I've fixed).