Private Lists and Permissions

This page collects who can see and do what. The same rules apply to the buttons on the page and to the requests behind them, so a control that is hidden is also refused by the server.

Who can open a list

List	Who can open it
Public	Anyone, including visitors who are not logged in.
Private	The owner, the people on the list and administrators.

Everyone else sees the Message on a private list text set under Visibility. Followers of a private list cannot open it.

For a private list that someone cannot open:

• The browser tab does not show the list name.
• The sidebar widgets show nothing.
• The list is left out of the Lists tab, My Followed Lists and the number beside each tab.
• The list’s people are not shown. They are only ever read for someone who may open the list.

What happens when a list becomes private

When a public list is changed to private, everyone who followed it while it was public stops following it. They no longer see it under My Followed Lists. Making it public again does not bring the followers back.

A private list cannot be followed. Following a list that does not exist is also refused.

Who can do what

Action	Who
Create a list	Administrators, plus the roles ticked under General, minus any blocked member types.
Add or remove people, edit name, description and privacy	Administrators always. Others as set by Adding members: only the person who made the list (default), the owner and their friends, or administrators only. With administrators only, the owner cannot change their own list.
Change the cover and icon	The owner or an administrator.
Delete a list	The owner or an administrator.
Follow a list	Any logged-in member who may open it.
Search for people to add	Any logged-in member. A search that names a list is allowed only for people who can manage that list.

Every action that changes data needs a logged-in member. Visitors who are not logged in can only read public lists.

Search

Search finds people by display name and nicename only. Email addresses and login names are not searched. It needs a login, shows at most 10 results, and leaves out people already on the list. Which people it can find follows Suggest from under Visibility.

Images

Cover images and icons must be JPG, PNG or GIF files. BuddyLists checks what the file really is, not what the browser says it is. The size limit is 5 MB, or the server’s upload limit if that is lower. Each list’s images are stored in wp-content/uploads/buddylists/<list ID>/, outside the Media Library. Deleting a list removes that folder.

Limits

Action	Limit
Create or update a list	10 a minute
Add or remove people	60 a minute, shared between adding and removing
Search for people	60 a minute
Follow or unfollow	30 a minute
List name	190 characters
Lists per member	Set under General, default 10, 0 for no limit
People per list	Set under General, default 10, 0 for no limit

The per-minute limits apply to each member. A member who goes over is asked to wait a moment.