RSS Feed Security

Further testing also shows that while the text content of posts for private categories are hidden on normal web pages, the post titles and images included are shown. So the plugin is not hiding private categories from public view.

I thought the same but have now verified this on two completely separate sites. Protecting a category from general view does not prevent the RSS feed from showing the content.
While Firefox does not actually render the XML content it does download it like a file, while Chrome actually renders it.
So “private” posts appear still available to the public in terms of their title and images with the full content also available via the XML.

Thanks for your help on this. I have read through your documentation again and it is as I thought it was supposed to operate. So my two sites should be okay, though I do think that the titles of private posts should not be shown because these might give something away – a private post should be entirely private!

I have now created a test site with your plugin and another which I feared might clash and it does operate correctly (though the private post titles do appear) so there is something strange about the other sites. I will have to look through their setup again carefully. Have you any suggestions as to why posts might be private within pages but not within feeds?