Art Menagerie has a few privacy, anti-scraping, and anti-AI features.
The best defense is a layered defense, but no defense can be 100% unless you do not wish to have a publish website.
Random IDs
Each item (post, feed, image, media, etc.) has its own randomly assigned ID.
You may notice that the default URL path of a post is something like /-/EDB2WMY34ASNLN3
The ID (EDB2WMY34ASNLN3 in this example) is actually a 15-character long Base32 representation of 75 random bits.
This means the chance of guessing an ID is so small it is not worth attempting. This protects you from people and bots discovering pages and media unless you link to them directly.
Default Robots.txt blocks Known AI bots
The default /robots.txt file uses a list provided by the ai.robots.txt to block known AI bots and scrapers. This only works for well-behaved bots and scrapes that follow instructions in this file. If you serve your own website you can also look at adding other countermeasures on your website to block known AI bots and scrapers by configuring your web server with a configuration from the ai.robots.txt project.
Currently, when you start Art Menagerie and it detects you do not have a /robots.txt file, it will create a default one. A robots.txt provides instructions for (well-behaved) bots scanning your website. Usually this is used tell search engine crawlers what you want indexed and available in search engine results.
Remove Metadata from Media (Images, Audio, Videos)
When you add any media (images, audio, or videos) in Art Menagerie, the metadata is removed to protect your privacy.
Image metadata is often stored as EXIF information and often contains identifying information such as your camera's serial number, the location you took the photo, time the image was taken, and more. Video and audio also contain similar information in metadata tags, but in a different format.
The metadata is usually invisible to you, but can be scanned very easily and used to break your privacy. This is why Art Menagerie always cleans this metadata for you to protect your privacy. If you upload images from Art Menagerie to other social media, you can rest assured that the images do not contain any sensitive metadata.
Beyond Art Menagerie
This section is a list of suggestions or ideas you can use to make your website even more protected that are beyond the scope of what Art Menagerie can provide.
Most (but not all) of these suggestions require that you have full access to the server hosting your website.
Block all Bots
Simply changes your /robots.txt files to this:
User-agent: *
Disallow: /
This will prevent your website from showing in search results and make it harder for AI scrapers to discover.
However, this will make your website harder to find and require viewers to remember the URL to your website.
Block Known Bad IP Addresses
This requires you have access to a firewall and for you to write a little script.
Spamhaus, FireHOL, and other projects publish lists of IP addresses and ranges of known bad actors on the internet. You can usually find a tutorial for your specific firewall that periodically downloads these lists and adds them to the firewall to block them.
Note that there is no guarantee that these block lists are comprehensive and attackers look for new IP addresses not in these lists constantly, but this is still a good defense.
Block Known AI HTTP User-Agent
This requires you have access to the webserver configuration.
Essentially you can configure your webserver to drop the connection if a client identifies itself with a User-Agent that is a known AI scraper. The ai.robots.txt project has configuration for multiple webservers to do this.
This is like the /robots.txt file, except it is enforced by your webserver, instead of relying on AI scrapers to play nice and obey the /robots.txt file.
Note that AI scrapers can be extra bad and send a User-Agent that mimics a human using a browser, so while this option is better than just a /robots.txt file, it can still be circumvented.
Anubis
This requires you to setup Anubis and your webserver.
Anubis essentially works by sending the client a cryptography (math) problem to solve before accessing the content of your website. This either stops or slows down AI scrapers as they have to be able to solve this as well. The idea is that the math problem does not take long to solve for an individual person viewing the website, but takes significant resources to at the scale scrapers scan websites.
There are some significant downsides to using this. It has been known to disrupt or make your website unusable with screen readers (e.g. for visually impaired users). Users on older machines have to wait a long time for their mobile phone or computer to solve the problem. Mobile phones use up battery faster. Plus you also have to maintain running and configuring an extra server in addition to your webserver.
Note that scrapers can be designed to solve the challenge Anubis gives and still access your website. This makes it harder for scrapers and serves as a deterrent, but does not block all scrapers.