I made my admin account, but I can still accept /setup which looks like it will allow any random user to make an admin account as well.

How do I fix this?

Edit: It turns out that creating the admin account doesn't work, even though the page is still there.

Lemmy, PieFed, Mastodon?

This is for Lemmy.

I don't see any guide talking about that. I would try some kind of Htaccess to prevent people from using /setup.

It feels like a bandaid, but on the other hand I have never seen a "server application" where URLs like /setup can selfdestruct after one use.

You might try PieFed's setup process also - its reputedly very streamlined.

Does it actually work?

I don't think it does anything once the first admin account is created

even lemmy.ml operated by its devs have /setup exposed and not working, i think its fine

if it bothers you block or redirect the url on your web server's config

Thanks. I just tried it out and it actually doesn't work. The page is still there which is annoying, but at least it can't be exploited to give random people admin accounts.