Achim Wagenknecht You have to continue to lock it down. You need to go to the Developer module and Menus and lock down the View Persons submenu so that doesn't show up either on page/profile?id=#

There is much to lock down. Everything is set to anyone by default. It will take you a while to get everything locked down and completely secure. I know Alex T⚜️ mentioned to set the permissions to OFF for Unathenticated users, but you still have unconfirmed, pending, and suspended users you should adjust permissions of accordingly also. Setting permissions alone isn't enough. Each individual aspect of your site has to be set.