To enable memberlist or not?

  • Was wondering if most of you keep memberlist enabled or disabled? And reasons for doing either choice?

    Cons:
    - Spam, bots, etc gathering your information.
    - Bad members chasing after other members, stalking, etc. Can search it quickly, to find their target.
    - Resource heavy, forum load time decrease along with memberlist load time decrease, especially if having thousands of members on forum.
    - Guests, along with spammers, bots and etc, can sit and just browse the memberlist all day long, using resources, memory, stalking your members, gather information and etc. Which penalizes you and your hosting account for their actions, when they are not even a member on your forum.

    Pros:
    - Can find your friends faster by searching for the first letter of their most used usernames.

    Personally, I've been considering disabling the memberlist all together for guests and normal users, because they really don't need to view the memberlist anyway. In most cases, the normal users already know if their friends have joined the forums or not, either by word of mouth or invitation of some kind. Guests just do not need access to it period. The only ones that really might need access to memberlist is staff and staff alone. To track down harassers, track down those in need of help, or issue warnings, bans, infractions, etc in timely manner. I honestly don't see the need for it to be enabled to others except just staff.

    What's your thoughts, suggestions, opinions...?

  • Yes, it's all about what kind of forum you run. In your case, Smooey, based on the reasons you mentioned above, which are real case-scenarios that might as well happen in your board, I believe it would be safer to disable it.

  • I have it disabled for guests. But enabled for registered users. In my community it's essential for some users to see who has been registered already. For my case a no go to disable it.

    Thanks for your reply, and thoughts on it. :) I'm kind of up in the air about it for registered users, mainly because of the worst case scenarios with it enabled. I suppose allowing them to view it when first starting out wouldn't be so bad. As you said, it's interesting to see who joined the forums. I suppose like anything else, there will always be pros and cons with it, it's just a matter of which outweighs the other lol.

    I guess it depends on the type of forum you run too. If it's mainly a male focused forum like tech support, web development, biking, hiking, weight lifting, etc. It wouldn't be too bad. But if it's a forum mixed with males and females, and it's adult related forum, it would be asking for trouble, harassment, sexual remarks, sexual harassment, stalking, etc.

    My forum will be a mix of males and females but not adult related of course, so I think disabling for everyone except staff will be the better route to take. Because of the ratio expected to be within the forums 50/50 or 60/40 or whatever.

  • Yes, it's all about what kind of forum you run. In your case, Smooey, based on the reasons you mentioned above, which are real case-scenarios that might as well happen in your board, I believe it would be safer to disable it.


    Yes, exactly! :) ;)

  • Sure it always depends on the forum you use. I don't have this kind of content,even though it's mixed gender . but I do have celebrities registered and more to come soon. Those are obviously an attraction for the non celebrities to join and contribute as well. So for my case i need it :D

    Celebrities? Interesting! Must have a LOT of activity going on at your site! Lol! :D

  • Our board has been running for more than 10 years with "who is online list" always visible to everyone.
    We keep "member list" closed to guests (non registered users), privacy first :)

  • Our board has been running for more than 10 years with "who is online list" always visible to everyone.

    Oh, have you noticed much resource usages by doing that? I usually turn off Who Is Online to guests too. Because "Who is online", "memberlist", "Who is reading a thread" type features need to query from the database, which means it's using a lot of resources, especially if your board/forum is busy.

    Like if you have 300 to 1000 users online at once, and guests are there refreshing "Who is online", that's a lot of work your database is doing by having to query and pull all that information to display it/who is actually online. Your resource usage will most likely spike up high. I usually don't allow "Who Is Online" to guests either. There isn't a reason or need for guests to see where users are at, what my users are doing within forums, don't need to know my users locations, etc.

    I consider "Who is online" a feature for members only lol. :)


    We keep "member list" closed to guests (non registered users), privacy first :)

    Yes, exactly! :) The privacy factor is the other main reason why I didn't want memberlist to display to even our own members though. Plus the resource usage factor, the stalking factor, the general abuse factor, etc etc. Memberlist, like "Who is online", the database has to PULL and query all that information just to display it.

    It has to go find and get all the usernames, join dates, ranks or titles, their other information in order to display / show it in "Who is Online" or "Memberlist", which is a lot of work on the database / hosting resources. If the host has resource limits set in place, and you go over the resource limit, you'll get white page with error or warning messages about maxing out your memory / resource limit. Which is annoying lol. Plus, you might notice a decrease in page loading times, might load slower than normal, even if on fast DSL / Highspeed connections. :(

    If you have couple hundred members, it's not too bad. But once you reach 1,000's of members, it can be nightmare lol. I'm still up in the air about enabling "memberlist" for my members. I'm currently 50/50 about it, and still thinking of what's best to do. :)

    Einmal editiert, zuletzt von Smooey (13. Januar 2014 um 23:23)

    • Offizieller Beitrag

    Oh, have you noticed much resource usages by doing that? I usually turn off Who Is Online to guests too. Because "Who is online", "memberlist", "Who is reading a thread" type features need to query from the database, which means it's using a lot of resources, especially if your board/forum is busy.


    The performance gain by disabling it actually pretty low since data is fetched with a small amount of queries (all of them hitting the database's primary indices [=lightning fast]) and processed at once. For example fetching the users active within a specific forum uses a single database query no matter how many users are actually browsing it. But yeah, I have seen other forum softwares which use database queries within the loop, increasing the query amount with each active user, which is the dumbest thing you could ever do …

    We simply recommend turning the "who is online" feature for busy boards since it tends to be pointless or is someone really interested in the names of all those other 200 members within a specific forum? I seriously doubt that.

    Alexander Ebert
    Senior Developer WoltLab® GmbH

  • The performance gain by disabling it actually pretty low since data is fetched with a small amount of queries (all of them hitting the database's primary indices [=lightning fast]) and processed at once. For example fetching the users active within a specific forum uses a single database query no matter how many users are actually browsing it.

    Oh that's nice then, I was going under assumption that it's a performance issue for all forum software no matter what. Mainly because that's the negative outcome I experienced with them before. So WBB doesn't have this issue, and this is another reason to love WBB, right on! :) ;) :thumbup:

    But yeah, I have seen other forum softwares which use database queries within the loop, increasing the query amount with each active user, which is the dumbest thing you could ever do …

    Like, phpBB, vBulletin 5.0, or something? Lol!

    We simply recommend turning the "who is online" feature for busy boards since it tends to be pointless or is someone really interested in the names of all those other 200 members within a specific forum? I seriously doubt that.

    Well, I mainly disable the features for "guests" though, which is usually "Spammers", "Bots", and etc. They tend to sit and tally up all
    your users, usernames, email addresses attached to their accounts, if you have newly registered users and if they're online currently or not
    and then target their profiles for their information, and etc. I don't really think real life human guests will sit and constantly refresh "Who
    is online" though, because it's pointless to them to do that.

    They don't really benefit from it. But the bots, spammers, etc are the main ones that are concern to me. It's bad enough just being online is a
    privacy loss in itself, with CIA, FBI, NSA and etc spying on everyone, but then to have to battle to keep your privacy from bots, spammers, and
    etc, it's even more of a chore. ||

    Einmal editiert, zuletzt von Smooey (14. Januar 2014 um 07:35)

  • I've got it disabled for security reasons, I take extra precautions when securing my sites :)


    What security reasons would that be?

    I get privacy concerns and maybe even performance concerns, but security reasons? Can you elaborate on that?

    "A life is like a garden. Perfect moments can be had, but not preserved, except in memory. LLAP" — Leonard Nimoy


  • What security reasons would that be?

    I get privacy concerns and maybe even performance concerns, but security reasons? Can you elaborate on that?

    It may not be such an issue with this specific forum script, but I used to use MyBB, where people would use the memberlist to quickly find specific types of users from specific groups, such as Administrators, then attempt to brute-force, by disabling that, it made their job harder.

  • Like in most forum software these days, there's a staff listing page too. So not only can staff be found via memberlist itself, but also sub menu item for Staff listing page. Which is a lot easier for hackers or whatever to locate and find out who's staff member, gain access to their account and do as they wish. You would have to disable Memberlist menu item, and it's sub menu items, and disable Memberlist viewing via User Group permissions, and general settings as well. Also add to robots.txt file to DENY for crawlers to crawl certain areas too.

Jetzt mitmachen!

Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!