Security of documents on a password-protected page

  • 2
  • Question
  • Updated 2 years ago
  • Answered
I have password-protected the members-only section of my website, but .pdf attachments I include on these pages are still findable and openable via Google and so are not secure even though access to the members section is.

Is it possible to protect these and if so how?
Photo of David Friery

David Friery

  • 3 Posts
  • 0 Reply Likes

Posted 7 years ago

  • 2
Photo of Gop

Gop

  • 7473 Posts
  • 2115 Reply Likes
David you could store these documents on a secure server such as Google Docs. The document is probably secure there if you set the proper security level. The issue is access through your yola site.

The robots generally won't access your docs on Google docs through your protected pages. If you simply store your files on your site in the site file manager area it is accessible for the robots to inspect by simply searching through your "resources" files even if they are only normally accessible through a protected page. If they already have then it will have been indexed.

The best advice and it's a well known bit of info, is that if you absolutely don't want people to have access to this information then don't put it on a web-site or rather on a low level security site.
Photo of Sanja

Sanja, Official Rep

  • 10698 Posts
  • 495 Reply Likes
Hi David,

I believe I have sent you an email in response to this issue. I really like Gop's suggestion and hope you might be able to use this. Please let us if you still have concerns with this.
Photo of peter g

peter g

  • 4 Posts
  • 1 Reply Like
I think Yola offers a generally excellent service but the security weakness described by David that started this thread is a something that Yola should make crystal clear in their instructions when setting up a password-protected pages. I was blissfully unaware of the fact that pdf documents on password-protected pages could be seen on web search engines when I accidentally came across one of my confidential documents on Google.
Surely Yola should develop a more secure system by, for example, providing a separate secure storage vault within the Site Builder and which cannot be accessed except via the password login page ?
Photo of Rob White

Rob White

  • 16 Posts
  • 2 Reply Likes
Are there any recent development on this since the original question was raised 4 years ago? I also have recently discovered that .pdf files on a password protect page are discoverable by Google. The proposed work-around of using Google docs is not very satisfactory and surely shouldn't be necessary. Come on Yola, p;ease provide us with an easy solution.
Photo of Stefan

Stefan, Official Rep

  • 4448 Posts
  • 190 Reply Likes
Hello Rob

I'm afraid that there is no easy solution for this. What you require here is basically a membership login that provides a secure private account which then couldn't be crawled by search engines. We currently have no plans to implement this any time soon. The password-protection offerred by Yola is a simple tool to allow viewing a page by anyone that knows the password protection login information. Any file that you upload to your website will be stored in your Yola File Manager, and therefore, after republishing your site, be accessible via a direct URL. This makes your file(s) accessible for search engines. That's why we can't recommend to upload any confidential documents to Yola if you publish the website to which you've uploaded those documents. The only thing you can hide from search engines or visitors not knowing the login info of a password-protected page is any content that doesn't include files uploaded to the website, such as text without images. I'm sorry that I don't have better news for you at this stage.
Photo of peter g

peter g

  • 4 Posts
  • 1 Reply Like
I'm afraid Yola continue to mislead their clients on this subject.  The following is the info currently published on Yola's 'Help' pages regarding setting-up 'Password-protected pages' :
'Yola allows you to create a private website, or make part of your site private, by password protecting certain pages on your site.'
Nowhere does Yola's website indicate or make clear that search engines can and do access documents on 'Password-protected pages'.  Yola's admission in this message chain that this is indeed the case clearly contradicts and makes a nonsense of their above statement to their clients about the privacy of such documents.
Even if Yola continues to refuse to properly make secure and private all documents posted on 'Password-protected' pages when are they going to correct the above misleading 'Help' pages statement ?
Over 4 years have passed since this subjected was first raised and still Yola are only interested in sloping their shoulders in this message chain and haven't even addressed the important issue of the misinformation referenced above published on their own website !
Photo of Stefan

Stefan, Official Rep

  • 4448 Posts
  • 190 Reply Likes
Hello Peter

Thank you for your feedback. I'm sorry that you feel that information about the password protection feature is missing in our tutorial. I've discussed this within our Support team, and we're considering both adding a disclaimer for files added to password protected pages and finding out if including files in password protection would be something doable for our developers to add in future.
Photo of peter g

peter g

  • 4 Posts
  • 1 Reply Like
Hi Stefan,

Thanks for your prompt reply and I look forward to a resolution satisfactory to both Yola and your clients.

I'd like to raise a further query on this general subject.  Currently your Sitebuilder software has provision for a single 'login' and 'password' for all 'password-protected' pages on a single website.  I'd like to have two or three 'Password-protected pages on one of my Yola websites with each page having different logins and passwords.  This is so that I can make available to different categories of users content of interest that is unique to them.  Can/will Yola make this provision ?
Photo of Stefan

Stefan, Official Rep

  • 4448 Posts
  • 190 Reply Likes
Hello Peter

To give you an honest answer, I don't think that we'll be able to provide this further request you added. The password protection was designed as a very basic feature to prevent the public from accessing particular pages of a website. It's not a login feature. The more options you'd like to have with it, the more we're looking at a proper membership login feature for your visitors to sign up and log in. This would require a lot of developmental work, and I'm afraid it is not on our agenda right now.

If you still want to give different visitors different access to your website, you should consider adding a membership login feature which can be embedded by using third-party providers' services. For more information please have a look at our forum thread Add a membership login feature to your website.