--- title: So Reddit has decided that plain HTML is unsafe | daily.dev description: Reddit has required login to access old.reddit.com, citing security concerns. The author argues this is misleading PR framing — the real reason is to make... canonical: https://daily.dev/posts/so-reddit-has-decided-that-plain-html-is-unsafe-odwl3aqzg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: So Reddit has decided that plain HTML is unsafe | daily.dev og:description: Reddit has required login to access old.reddit.com, citing security concerns. The author argues this is misleading PR framing — the real reason is to make... og:url: https://daily.dev/posts/so-reddit-has-decided-that-plain-html-is-unsafe-odwl3aqzg og:image: https://api.daily.dev/og/posts/odWL3AqzG.png og:image:alt: So Reddit has decided that plain HTML is unsafe og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # So Reddit has decided that plain HTML is unsafe **[Hacker News](https://daily.dev/sources/hn)** · 9 min read · 81 upvotes · 12 comments ## Summary Reddit has required login to access old.reddit.com, citing security concerns. The author argues this is misleading PR framing — the real reason is to make scraping harder by forcing users through a heavier JavaScript-dependent frontend. Old Reddit serves plain HTML efficiently, while New Reddit loads 5x more data and tracks user behavior via heartbeat events. The author contends that calling plain HTML 'unsafe' is disingenuous, and that Reddit's actual goal is protecting its LLM-training data from scrapers, at the expense of power users who prefer the leaner old interface. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 2 discussions and 637 comments across lobsters, hackernews (as of 2026-07-23). **TL;DR:** Both communities are largely critical of Reddit's decision to require login for old.reddit.com, viewing it as another step in Reddit's enshittification — driven by anti-scraping/business motives rather than genuine security — and many users say they'll leave when old Reddit is finally shut down. **Sentiment:** 5% positive · 20% mixed · 75% skeptical **The case for** - Old Reddit is praised for being fast, functional, and low-noise compared to the new site. - RedReader is highlighted as a viable accessibility-exempted third-party mobile client that Reddit cannot easily kill. - Some commenters acknowledge that bot/scraping mitigation is a legitimate concern for any web host. **The pushback** - Requiring login for old.reddit.com is seen as a disingenuous 'security' justification that really means protecting Reddit's business model and AI data deals. - New Reddit is widely criticized as slow, noisy, and harder to use than the old interface, including on mobile. - Reddit's quality has declined sharply due to bots, spam, shallow political discourse, and the removal of third-party clients. - Many long-time users and moderators say they will leave Reddit entirely when old Reddit is shut down, with little faith that alternatives like Lemmy will absorb them. - The 'for security' framing is seen as corporate doublespeak, with commenters noting it really means 'for our business security.' **Hottest debate:** Whether the login requirement for old.reddit.com is genuinely about security/scraping or purely a business move to force users onto the more monetizable new Reddit. **Open questions** - Will Reddit actually shut down old.reddit.com entirely, and if so, when? - Why can't Reddit add a CAPTCHA to old Reddit instead of requiring login, if scraping is the real concern? - Where will displaced old-Reddit communities go, given that Lemmy and other alternatives have failed to gain traction? - How long will RedReader's special accessibility exemption from Reddit last? **Highlights** > One cannot find a better example of enshittification of social media than the switch from old to new Reddit. Sure the old one is a little ancient, but it's just so *functional,* for lack of a better term. It loads fast, it's no-nonsense, you can load dozens of replies without the browser breaking a sweat, and if you really hate some part of it, there's a wide variety of pre-tools (RES, Toolbox, etc.) to make your experience better. I give the new site a shot every couple of months, but I just cannot vibe with it, despite having joined the site nearly 15 years ago. It's just... noisy, I guess. There's two huge sidebars taking space, opening threads is slow and disorienting, loading comment chains is finicky and sometimes causes a page reload, meaning you lose context. There are good features, sure. Having built in image posting is nice. Polls are nice. Heck, the new mod tools are decent too. But despite all of these I still default to the old version and I don't see it in the company to ever start catering to user friendliness again. Which is a dreadful prospect, when they just [softened their stance](https://reddit.com/r/modnews/comments/1ujtebf/logging_in_to_use_old_reddit/ouqb094/) from supporting the old site indefinitely to "not right now". > — [nemin on lobsters · 123 points, 5 comments](https://lobste.rs/s/gqdvdt/so_reddit_has_decided_plain_html_is_unsafe#c_fqaaqf) > I think the main complaint here is that the PR text said "for security" but it should have said "to reduce scraping load on our servers". People who host a web site will know that this is a very legitimate concern these days. All the other text in the rant is the author being annoyed, for good reasons, but ultimately reasons that are kind of tangential to the problem at hand. :P EDIT: I have my own example of "for security" pissing me off. I have some Philips Hue lights (or had, until a move recently), and the smartphone app for controlling them has had a banner for years now that they're going to disallow you to control your lights without a Philips account **for security**. Security is not phoning home, is keeping all communication within my network! Security is not getting external servers with an external authentication mechanism involved in controlling a device in my home network. Fortunately it seems they kept it at the warning as it still works fine without an account. > — [tomsmeding on lobsters · 25 points, 4 comments](https://lobste.rs/s/gqdvdt/so_reddit_has_decided_plain_html_is_unsafe#c_chtiwg) > I have started reading "for * security" as "for our business security". > — [Hales on lobsters · 22 points, 1 comments](https://lobste.rs/s/gqdvdt/so_reddit_has_decided_plain_html_is_unsafe#c_yohgv8) > > At present, I think there would be just a little too much uproar for their liking if they shuttered Old Reddit. But I don’t think it’ll be much longer before they decide it’s worth it. That's likely why old reddit is still here. When I was still active on reddit as a mod (before the API debacle) I remember some communications from them that, when reading between the lines, boiled down to a large part of moderators (if not a majority) still using old reddit. Basically "*please mods, we have all these things on new reddit!*" where most mods went "*lol, nope so much stuff is still missing there or just not as good*". After I left I did keep an eye on announcement and it became clear they had started investing heavily in more mod tooling. More than you'd expect given their track record, not just feature parity but new stuff and a bunch of third party tooling as native tooling. I firmly believe that part of that investment is because they realized that they wouldn't be able to shutter old reddit if most mods were still using it. The API debacle made a lot of people who truly cared finally pack up and leave (me included) and from what I have heard a lot of mods slowly and reluctantly have started using new reddit since it now actually offers more tooling and insights. So yeah, long winded way to say that I agree and think this is the first sign that they feel like they can start shutting down old reddit without too much opposition. > — [creesch on lobsters · 1 points, 1 comments](https://lobste.rs/s/gqdvdt/so_reddit_has_decided_plain_html_is_unsafe#c_goe3tq) > I find it amazing how they killed off 3rd party clients many years ago, yet their first party mobile client is still garbage. It is nowhere near as good as the third party apps that were made by a single individual developer. It goes to show how a presumably large budget and sizable team is outdone by a single talented individual outside of the constraints of an enterprise environment. Or maybe Reddit is particularly incompetent. I occasionally use their website on mobile, and if anything it has been getting worse. That Reddit sells our content and does a terrible job at moderation, which they largely outsource to us as unpaid labor, is just the cherry on top. > — [user43928 on hackernews · 1 comments](https://news.ycombinator.com/item?id=49018786) **Source threads** - [lobsters](https://lobste.rs/s/gqdvdt/so_reddit_has_decided_plain_html_is_unsafe) · 107 points · 66 comments - [hackernews](https://news.ycombinator.com/item?id=49005747) · 434 points · 571 comments ## Community discussion Top comments from developers on daily.dev. **@ksolomon** · 21 upvotes > Of course it's unsafe...unsafe to their bottom line. **@andradei** · 7 upvotes > _HTML is unsafe... let us make you safe in the echo chamber we control._ **@anmolbaranwal** · 2 upvotes > you can use this to fetch or scrape posts - [https://github.com/mvanhorn/last30days-skill](https://github.com/mvanhorn/last30days-skill) **@ryntab** · 1 upvotes > Yeah, seems like suspicious timing. As they had just last month ( maybe the month before ) enhanced bot protection for their .json post / feed pages. > > They are locking things down. **@jenueldev** · 1 upvotes > The sharper distinction is between transport format and access policy: HTML is not the security boundary; authentication, rate limits, and abuse controls are. Requiring login may reduce anonymous scraping, but wrapping the same content in five times the client-side work mostly shifts the cost to legitimate readers unless Reddit can show that the heavier path materially improves enforcement. ## Similar posts on daily.dev - [You're using a too-old browser](https://daily.dev/posts/you-re-using-a-too-old-browser-lr27apfs9) · Planet Golang · 0 upvotes · 0 comments - [The 49MB Web Page](https://daily.dev/posts/the-49mb-web-page-c2modzgaa) · Hacker News · 16 upvotes · 2 comments - [Scraping Facebook in 2026: Why Traditional HTTP Requests Fail and What Works Instead](https://daily.dev/posts/scraping-facebook-in-2026-why-traditional-http-requests-fail-and-what-works-instead-u7jh6lq3c) · Medium · 0 upvotes · 0 comments --- Tags: [#javascript](https://daily.dev/tags/javascript), [#html](https://daily.dev/tags/html), [#crawling](https://daily.dev/tags/crawling) [View this post on daily.dev](https://daily.dev/posts/so-reddit-has-decided-that-plain-html-is-unsafe-odwl3aqzg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"So Reddit has decided that plain HTML is unsafe","url":"https://daily.dev/posts/so-reddit-has-decided-that-plain-html-is-unsafe-odwl3aqzg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/so-reddit-has-decided-that-plain-html-is-unsafe-odwl3aqzg"},"datePublished":"2026-07-22T13:35:53.383Z","dateModified":"2026-07-23T13:39:25.903Z","description":"Reddit has required login to access old.reddit.com, citing security concerns. The author argues this is misleading PR framing — the real reason is to make...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b6672808764dc7c6ec27e614640aee33?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b6672808764dc7c6ec27e614640aee33?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":12,"discussionUrl":"https://daily.dev/posts/so-reddit-has-decided-that-plain-html-is-unsafe-odwl3aqzg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":81},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":12}],"keywords":"javascript,html,crawling","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"So Reddit has decided that plain HTML is unsafe"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/so-reddit-has-decided-that-plain-html-is-unsafe-odwl3aqzg","comment":[{"@type":"Comment","text":"Of course it’s unsafe…unsafe to their bottom line.","datePublished":"2026-07-22T14:04:08.566Z","url":"https://daily.dev/posts/odWL3AqzG#c-hH2RnjQBN","author":{"@type":"Person","name":"Keith Solomon","url":"https://daily.dev/ksolomon","image":"https://avatars.githubusercontent.com/u/251996?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":21}},{"@type":"Comment","text":"HTML is unsafe… let us make you safe in the echo chamber we control.","datePublished":"2026-07-22T15:57:50.690Z","url":"https://daily.dev/posts/odWL3AqzG#c-5j6pfxuh1","author":{"@type":"Person","name":"Isaac de Andrade","url":"https://daily.dev/andradei","image":"https://avatars.githubusercontent.com/u/2653546?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7}},{"@type":"Comment","text":"you can use this to fetch or scrape posts - https://github.com/mvanhorn/last30days-skill","datePublished":"2026-07-23T09:31:52.089Z","url":"https://daily.dev/posts/odWL3AqzG#c-zWNkRqqzQ","author":{"@type":"Person","name":"Anmol Baranwal","url":"https://daily.dev/anmolbaranwal","image":"https://avatars.githubusercontent.com/u/74038190?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"Yeah, seems like suspicious timing. As they had just last month ( maybe the month before ) enhanced bot protection for their .json post / feed pages.\nThey are locking things down.","datePublished":"2026-07-22T14:07:47.727Z","url":"https://daily.dev/posts/odWL3AqzG#c-2S6AonRAv","author":{"@type":"Person","name":"Ryan Taber","url":"https://daily.dev/ryntab","image":"https://avatars.githubusercontent.com/u/57367794?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"The sharper distinction is between transport format and access policy: HTML is not the security boundary; authentication, rate limits, and abuse controls are. Requiring login may reduce anonymous scraping, but wrapping the same content in five times the client-side work mostly shifts the cost to legitimate readers unless Reddit can show that the heavier path materially improves enforcement.","datePublished":"2026-07-23T04:41:05.761Z","url":"https://daily.dev/posts/odWL3AqzG#c-mJCtkCHFj","author":{"@type":"Person","name":"Jenuel Oras Ganawed","url":"https://daily.dev/jenueldev","image":"https://media.daily.dev/image/upload/s--BadmiNyj--/f_auto/v1787625077/avatars/avatar_JJtZr4Sjm?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} ```