I sometime need to share posts with selected readers only, for review or private discussion.

This is precisely the objective of the Hugo theme ‘Off The Record’::

“publish a post and invite chosen readers with a private link – while keeping this post hidden from other visitors”.

A demo is available, and the source code is public.

Installation

Note that Hugo extended > 0.82 is required (Posts are not properly hidden with previous Hugo versions).

Download:

git clone --recurse-submodules https://github.com/RoneoOrg/hugo-offtherecord-demo.git

Run:

cd hugo-offtherecord-demo

hugo serve

How to use

Set offTheRecord to true in the Front Matter of the posts you want to hide.

That’s all!

Example

---
title: "Pending article, for review"
date: 2021-11-22T00:00:03+00:00
offTheRecord: true
---

Update

To get the last theme updates, run the following command at the root of your project:

git submodule update --init --recursive --remote

Technical details

In greater detail, private posts are hidden from:

  • the homepage
  • the search results
  • the RSS feeds
  • the archive page
  • the sitemap

Search engines are also told not to index these posts.

Update June, 28:

External links are now automatically opened in new tabs with ‘rel noreferrer’, to hide the Referer header and leak no referrer information

See the changelog for a commented code tour.

Additional features

This theme is based on Papermod, which provides numerous other features:

See the Papermod Documentation for more info

Caveats

This solution should not be considered secured before checking your threat model with these caveats in mind:

  • someone could guess the URL of your private posts.
  • someone could automatically scan your website to discover these secret URL.
  • an attacker could access your Git repo and read the private post directly from the source file. You should use a private repo.

The way you share the link matters too. See

In addition, Internet actors on the way (hosts, internet and DNS providers) will handle parts / references of your page.

Roadmap

What’s left to do:

  • Check Hugo “Build Options” for relevant features
  • Verify the content of schema.json
  • Hide private posts from the tags pages and from Hugo series (disabled by default).

References