# Locking at Trust Level 0

**URL:** <https://meta.discourse.org/t/locking-at-trust-level-0/382894>\
**Category:** Product Support\
**Tags:** moderation, trust-levels\
**Created:** [September 17, 2025, 12:55am UTC](https://meta.discourse.org/t/locking-at-trust-level-0/382894 "2025-09-17T00:55:22Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![jenmck](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jenmck/32/332487_2.png) [@jenmck](https://meta.discourse.org/u/jenmck)\
**Post date:** [September 24, 2025, 9:53am UTC](https://meta.discourse.org/t/locking-at-trust-level-0/382894/4 "2025-09-24T09:53:24Z")

</div>

I ended up creating a workaround using a couple different tools (my coding is not strong enough to build a custom plugin!). It tested fine and works.

1. created a new group, `restricted-users`
2. created a custom wizard form, restricted to the moderators group
3. created a new category only viewable to mods, `restricted-users-admin` and replaced the composer with the custom wizard form.
4. when a user should have their posting ability limited, a mod fills out the custom wizard form. The form asks which user should be added to the group, and what date they should be removed.
5. submitting the form creates a new topic in `restricted-users-admin`
6. created a webhook for this category to send any new topic created.
7. when the webhook is received, first check if the user is already in the group, and create a post reply with that info if so. If the user is not in the group, add them to the group, then wait until the given end date/time, then remove them from the group.
8. created a webhook for any posts by users in the `restricted-users` group.
9. when the restricted user posts and the webhook is sent, make an api call to determine how many posts the user has made that day (used same day instead of a 24 hr period, figured it was just easier to match the date I guess). I filtered out PMs here.
10. if it’s the next to last post the user has available, the API sends the user a PM letting them know they’re approaching their limit and have one more post today. As a proof of concept I set the limit at 5 posts, so this sends a PM after the user’s 4th post.
11. if it’s their last post, the API silences the user for 24 hours.
12. When the user is removed from the `restricted-users` group, the API sends a post reply to the original topic in the `restricted-users-admin` category.

This is edge case territory for us - this is a “next-to-last resort” kind of thing, after a lot of communication and moderators working with the user. I don’t anticipate we will have the kind of traffic on this that it becomes burdensome, this is a teeny teeny tiny number of users. We are a membership organization and our Discourse forum serves as a repository for all kinds of resources, so members ought to be able to access it. Hence, we need to come up with different solutions rather than suspending.

---

_[View the full topic](https://meta.discourse.org/t/locking-at-trust-level-0/382894)._