Comment by marcosscriven

I agree of course, but those things are all the more obvious ones you can start to attempt to prevent.

Stripping headers, not allowing other than GET requests. Only allows HTTPS etc, the list goes on.

My point was that even if you locked down an agent to only ever read a single forum, and only to be able to access other post URLs that are from that forum, and not allow any query parameters that aren’t necessary etc.

Even then you can be having the slightest public effect that can exfiltrate data - a read count on some old post. I know it’s wildly impractical, it’s more a thought experiment on how hard it it.