diff --git a/website/src/controllers/groups.js b/website/src/controllers/groups.js
index e515cd95a7..b352df6f7d 100644
--- a/website/src/controllers/groups.js
+++ b/website/src/controllers/groups.js
@@ -398,7 +398,8 @@ api.likeChatMessage = function(req, res, next) {
 
 api.join = function(req, res, next) {
   var user = res.locals.user,
-    group = res.locals.group;
+    group = res.locals.group,
+    isUserInvited = false;
 
   if (group.type == 'party' && group._id == (user.invitations && user.invitations.party && user.invitations.party.id)) {
     User.update({_id:user.invitations.party.inviter}, {$inc:{'items.quests.basilist':1}}).exec(); // Reward inviter
@@ -409,13 +410,19 @@ api.join = function(req, res, next) {
       group.quest.members[user._id] = undefined;
       group.markModified('quest.members');
     }
-  }
-  else if (group.type == 'guild' && user.invitations && user.invitations.guilds) {
+    isUserInvited = true;
+  } else if (group.type == 'guild' && user.invitations && user.invitations.guilds) {
     var i = _.findIndex(user.invitations.guilds, {id:group._id});
-    if (~i) user.invitations.guilds.splice(i,1);
-    user.save();
+    if (~i){
+      user.invitations.guilds.splice(i,1);
+      user.save();
+    }else{
+      isUserInvited = group.privacy === 'private' ? false : true;
+    }
   }
 
+  if(!isUserInvited) return res.json(401, {err: "Can't join a group you're not invited to."});
+
   if (!_.contains(group.members, user._id)){
     group.members.push(user._id);
     group.invites.splice(_.indexOf(group.invites, user._id), 1);