I sometime need to share posts with selected readers only, for review or private discussion.
This is precisely the objective of the Hugo theme ‘Off The Record’::
“publish a post and invite chosen readers with a private link – while keeping this post hidden from other visitors”.
Note that Hugo extended > 0.82 is required (Posts are not properly hidden with previous Hugo versions).
git clone --recurse-submodules https://github.com/RoneoOrg/hugo-offtherecord-demo.git
cd hugo-offtherecord-demo hugo serve
How to use
true in the Front Matter of the posts you want to hide.
--- title: "Pending article, for review" date: 2021-11-22T00:00:03+00:00 offTheRecord: true ---
To get the last theme updates, run the following command at the root of your project:
git submodule update --init --recursive --remote
In greater detail, private posts are hidden from:
- the homepage
- the search results
- the RSS feeds
- the archive page
- the sitemap
Search engines are also told not to index these posts.
Update June, 28:
External links are now automatically opened in new tabs with ‘rel noreferrer’, to hide the Referer header and leak no referrer information
See the changelog for a commented code tour.
This theme is based on Papermod, which provides numerous other features:
- 3 different Homepage layouts
- Multilingual support.
- Multiple Author support.
- Light / Dark theme.
- Search page.
- Carefully optimized code.
See the Papermod Documentation for more info
This solution should not be considered secured before checking your threat model with these caveats in mind:
- someone could guess the URL of your private posts.
- someone could automatically scan your website to discover these secret URL.
- an attacker could access your Git repo and read the private post directly from the source file. You should use a private repo.
The way you share the link matters too. See
- “Gmail is opening and caching URLs within emails without user intervention”.
- “Outlook scans emails arriving in your inbox and sends all found URLs to Bing”
In addition, Internet actors on the way (hosts, internet and DNS providers) will handle parts / references of your page.
What’s left to do:
- Check Hugo “Build Options” for relevant features
- Verify the content of
- Hide private posts from the
tagspages and from Hugo
series(disabled by default).