---
title: Message boards security
related:
  - https://docs.kentico.com/k8/securing-websites.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## Message board

Based on the **Access** and **Message board owner** properties of the **Message board** web part, you can determine who will be allowed to add new messages to the board.

> **Note:** **Changing the values**
>
> Remember that once the message board is created (after inserting first message or subscribing), you cannot make changes to these settings in the **New board settings** section of web part properties. You can only modify values of the **Access** property on the **Security** tab when editing the corresponding message board in the **Message boards** application.

The following table explains **who can add messages to the board** under particular configurations. The difference between **User** and **Public boards** is that **Public boards** are always related to a document, while **User boards** are always related to a document and a user.

**Public boards** are typically used when you want multiple users to post messages to it. **User boards** are typically used on user profiles, as you can see on the **Community starter site** sample website, on the **Members -> Profile** page.

| **Message board owner** | **Access**              | **Anonymous user** | **Authenticated user** | **Authorized role** | **Owner** | **Owner in authorized role** |
| ----------------------- | ----------------------- | ------------------ | ---------------------- | ------------------- | --------- | ---------------------------- |
| **Public board**        | **All users**           | Yes                | Yes                    | Yes                 | Yes       | Yes                          |
| **Public board**        | **Authenticated users** |                    | Yes                    | Yes                 | Yes       | Yes                          |
| **Public board**        | **Authorized roles**    |                    |                        | Yes                 |           | Yes                          |
| **Public board**        | **Owner**               |                    |                        |                     | Yes       | Yes                          |
| **User**                | **All users**           | Yes                | Yes                    | Yes                 | Yes       | Yes                          |
| **User**                | **Authenticated users** |                    | Yes                    | Yes                 | Yes       | Yes                          |
| **User**                | **Authorized roles**    |                    |                        | Yes                 |           | Yes                          |
| **User**                | **Owner**               |                    |                        |                     | Yes       | Yes                          |

When a board is in the **User x Owner** configuration, the following conditions need to be met in order for the current user to be able to post messages:

- the page must be accessed with _userid_ or _username_ parameter in querystring
- the current user must be the same as the one whose _userid_ or _username_ is passed in querystring
- the current user must not be hidden (configured by the _Is hidden_ option when editing the user)

This can be typically used on user profiles, where messages to such board can be posted only by the owner of the profile, while other users can only read these messages. An example of such board is the **MessageBoardAnnouncements** board on the **/Members/Profile** page of the sample Community Site.

## Group message board

The Group message board is always related to some group, hence only the **Access** property can be set. You can see a typical usage of this web part on the **Community starter site** sample website, on the **Groups -> Profile** page.

| **Access**              | **Anonymous user** | **Authenticated user** | **Authorized role** | **Group member** | **Group member in authorized role** | **Group admin** |
| ----------------------- | ------------------ | ---------------------- | ------------------- | ---------------- | ----------------------------------- | --------------- |
| **All users**           | Yes                | Yes                    | Yes                 | Yes              | Yes                                 | Yes             |
| **Authenticated users** |                    | Yes                    | Yes                 | Yes              | Yes                                 | Yes             |
| **Authorized roles**    |                    |                        | Yes                 |                  | Yes                                 | Yes             |
| **Group members**       |                    |                        |                     | Yes              | Yes                                 | Yes             |
| **Group admin**         |                    |                        |                     |                  |                                     | Yes             |

When the **Group members** option is set, the following conditions need to be met in order for the current user to be able to post messages:

- the page must be accessed with _groupid_ parameter in querystring
- the current user must be member of the group whose _groupid_ is in the querystring
- the current user must not be hidden (configured by the _Is hidden_ option when editing the user)

This can be typically used on group profiles, where messages to such board can be posted only by members of the group, while other users can only read these messages. An example of such board is the **GroupMessageBoard** board on the **/Group-pages/** page of the sample Community Site.

## Permissions

Permissions for access to **Message boards** administration interface can be set in the **Permissions** application. You have to select the **Modules -> Message boards** permission matrix.

- **Modify** - members of the roles are allowed to edit message board settings, delete the boards and manage message board posts
- **Read** - selected role members are allowed to read the records and configuration of particular message boards, but are not allowed to modify them