WordPress.org

Ready to get started?Download WordPress

Forums

Jetpack by WordPress.com
[resolved] Block Stats Access To Subscribers (15 posts)

  1. erwpacc
    Member
    Posted 1 year ago #

    Is there a way to block access to my site stats?
    I just noticed that anyone who subscribes to my website can link to wordpress.com and see my website stats (using their account on wordpress.com).

    http://wordpress.org/extend/plugins/jetpack/

  2. Jeremy Herve
    Happiness Engineer
    Plugin Author

    Posted 1 year ago #

    Rest assured, your subscribers cannot access your Site Stats unless you allow them to do so.

    While they can access the Jetpack menu in your dashboard, and connect to their WordPress.com account from there, they cannot actually access your Site Stats.

    You can double check this setting by going to the Jetpack menu in your dashboard, and clicking on "Configure" under the Stats module.

    You will then be able to see who can access your Stats:
    http://i.wpne.ws/LvFf

  3. erwpacc
    Member
    Posted 1 year ago #

    Hi Jeremy,

    You are correct that the stats do not show up in the Site Stats section when the user logs into my website. However, if the user goes directly to wordpress.com to log into their personal blog, they can see both their blog stats as well as the stats to my website. Also, I double checked the stats setting at the time and it was configured to only allow admin access.

    Unfortunately I have deleted Jetpack, so I don't have a screenshot to show, but I can reinstall it and send you a link to my site if this will help you.

  4. Jeremy Herve
    Happiness Engineer
    Plugin Author

    Posted 1 year ago #

    It would be great if you could reinstall it, indeed, so I can investigate further.

    Could you activate Jetpack again, connect it to your WordPress.com account, and let me know your site URL?

  5. erwpacc
    Member
    Posted 1 year ago #

    I sent you a message through your website with the site URL, reinstalled jetpack, tested to make sure the problem still exists and grabbed some screenshots.

    Let me know if you need anything else.

    Thanks!

  6. Jeremy Herve
    Happiness Engineer
    Plugin Author

    Posted 1 year ago #

    Received your screenshots. You seem to refer to Stats subscribers; however, these are different from your site's registered subscribers.

    Could you go to Users > Add New in your dashboard, and create a new test user with a Subscriber role? This user should not be added to the list of Stats subscribers, and will not see your Site Stats, either in your dashboard or on WordPress.com.

    You can also remove existing Stats subscribers by clicking on "Remove" at the bottom of the Stats page on WordPress.com.

  7. erwpacc
    Member
    Posted 1 year ago #

    My apologies for the ambiguity. If random users can subscribe to my stats without registering with my site I would like to know how to disable that as well, if possible.

    So I created a new test user from my dashboard with a subscriber role and created a new account on wordpress.com for the new test user and got the same result. (I sent another set of screenshots through your website)

    Feel free to try it for yourself. You can register with our site by creating an account or using the federated login.(although registering through our site makes you a contributor instead of a subscriber) After you do so, you should be able to login to wordpress.com and see the site stats.

    If I remove stats subscribers manually, what prevents them from coming back? I guess the goal would be to block all stats subscribers rather than trying to remove them after they have seen the stats.

  8. Jeremy Herve
    Happiness Engineer
    Plugin Author

    Posted 1 year ago #

    Thanks for the extra details. I understand the problem now. That is indeed a problem with Jetpack. I have warned our developers about this problem, and we'll fix it as soon as possible.

  9. yoakleypr
    Member
    Posted 1 year ago #

    Hi Jeremy -- Would it also be possible to make specializations to the Site Stats view so that users in specific user roles can only see the stats info for a post published by them or some such?

    I don't want to share all of my site stats with guest bloggers, but allowing them to see the performance of their posts would be beneficial.

  10. erwpacc
    Member
    Posted 1 year ago #

    Thanks for your help Jeremy. Do you still need me to keep jetpack installed to debug the issue? If not, I will remove jetpack from my site for the time being.

    Also, the capability that yaokleypr mentioned is exactly what I was looking for when I stumbled upon this problem. Possibly a great candidate for future capability?

  11. Jeremy Herve
    Happiness Engineer
    Plugin Author

    Posted 1 year ago #

    We don't have any plans for such feature yet, but I have noted down the idea, thanks for the feedback!

    @erwpacc You can uninstall Jetpack now if you wish, thank you.

  12. Jeremy Herve
    Happiness Engineer
    Plugin Author

    Posted 1 year ago #

    We have now fixed the issue. The fix will be available in the next Jetpack release.

  13. erwpacc
    Member
    Posted 1 year ago #

    thanks jeremy!

  14. yoakleypr
    Member
    Posted 1 year ago #

    Lovely! Will we be able to restrict what blog performance statistics different user roles will be able to view as well?

  15. Jeremy Herve
    Happiness Engineer
    Plugin Author

    Posted 1 year ago #

    @yoakleypr While you can already restrict access to the stats based on User Roles (click on "Configure" under the Stats module to access the configuration screen), we didn't develop any functionality allowing you to restrict access to a specific post, or to the posts published by a specific author. But I didn't forget your suggestion!

Topic Closed

This topic has been closed to new replies.

About this Plugin

About this Topic

Tags

No tags yet.