# Notify Feature can be easily abused
**URL:** https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497
**Category:** Feature
**Created:** [February 27, 2022, 3:11pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497 "2022-02-27T15:11:12Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Noah](https://meta.discourse.org/u/Noah)
#### Post date: [February 27, 2022, 3:11pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/1 "2022-02-27T15:11:12Z")
As you all know there is now a feature to notify people about a certain topic/post.
This is all well and good.
HOWEVER, there is no cooldown/ protection against this feature being abused.
During testing, I managed to spam notify people, by using the notify feature, It seems I can notify as many people as I want, as on many topics/replies as I want.
The only way to punish a user for abusing this feature, is by having someone report the spammer to a moderator, who will have to **suspend** the account, **silencing** the account will not prevent this feature from being abused.
**My Idea:**
For each trust level, they should be limited to how any many people they can notify daily, this will help keep this feature in use & and will also prevent people being spammed by this feature.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [February 27, 2022, 3:19pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/2 "2022-02-27T15:19:29Z")
Adding a ‘minimum trust to notify’ could be useful too.
---
### Author:  [@Noah](https://meta.discourse.org/u/Noah)
#### Post date: [February 27, 2022, 3:20pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/3 "2022-02-27T15:20:32Z")
Agreed, it can be abused heavily:
Dedicated trolls can really do stuff with this.
Imagine a **macro** or something like that being used.
---
### Author:  [@Tris20](https://meta.discourse.org/u/Tris20)
#### Post date: [February 27, 2022, 5:00pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/4 "2022-02-27T17:00:48Z")
> [@JammyDodger](#):
>
> Adding a ‘minimum trust to notify’ could be useful too.
I would even consider the benefits of going one further, and have a whitelist feature in the user preferences. This would allow you to recieve notifications from personally trusted users/Groups, which is particularly useful if the community is \> 1000 members.
---
### Author:  [@Noah](https://meta.discourse.org/u/Noah)
#### Post date: [February 27, 2022, 5:51pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/6 "2022-02-27T17:51:18Z")
Yeh, I see were your coming from.
---
### Author:  [@Benjamin\_D](https://meta.discourse.org/u/Benjamin_D)
#### Post date: [February 27, 2022, 6:07pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/7 "2022-02-27T18:07:51Z")
Or maybe somehow expand the `notification consolidation threshold` scope to notifications about topics?
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [February 27, 2022, 6:46pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/8 "2022-02-27T18:46:28Z")
I think a lot would depend on how much the notify feature is getting hammered? I’m afraid it’s not a popular feature on the sites I’m on, so I can’t quite envisage those being useful to me personally - but now we can point to posts as well as topics, I think it could be more so in the future?
For an occasional over-excited user (/troll 🙂) a daily base limit, trust level multiplier, and min trust level, similar to some of the other TL restricted features, may be enough peace of mind for me.
Though, as @Tris20 said, if you have a big membership and the notify feature is very popular, then giving it something like the PM whitelist may be beneficial too. And if you’re getting lots of notify notifications, consolidating them into a page like the consolidated Likes could also be good to bundle some noise into something more useful. 👍
* * *
Is the ‘notify about this post’ only for Desktop? When I click the 🔗 icon in the post menu my phone opens up its own pop-up rather than the Discourse one, and the notify option doesn’t seem to be available by pressing on the timestamp? Is there another way?
---
### Author:  [@Noah](https://meta.discourse.org/u/Noah)
#### Post date: [February 27, 2022, 7:08pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/9 "2022-02-27T19:08:20Z")
It’s working on my browser, on my phone it doesn’t, however I think this is intentional, but a strange way of doing it, kinda defuses the point of implementing the feature.
---
### Author:  [@Noah](https://meta.discourse.org/u/Noah)
#### Post date: [February 27, 2022, 8:15pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/10 "2022-02-27T20:15:11Z")
Are there any DIY ways to fix this?
Because I am concerned this could become a bigger issues if I don’t try to resolve it as soon as possible, at the moment nobody from my community has discovered this, but it just takes one troll to make this such a massive issue.
---
### Author:  [@Benjamin\_D](https://meta.discourse.org/u/Benjamin_D)
#### Post date: [February 27, 2022, 8:31pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/11 "2022-02-27T20:31:11Z")
If I’m not mistaken you could remove the share button from the post menu parameter (or at least hide it) `https://your.domain/admin/site_settings/category/all_results?filter=share`
---
### Author:  [@Noah](https://meta.discourse.org/u/Noah)
#### Post date: [February 27, 2022, 8:37pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/12 "2022-02-27T20:37:37Z")
Hmmm, I don’t want to hide the entire thing, just the **notify** button.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [February 27, 2022, 8:42pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/13 "2022-02-27T20:42:56Z")
You could use a little CSS. Something like:
```plaintext
.btn-default.notify.btn {
display: none;
}
```
(Though that will hide the share topic one too. You should be able to make it more specific if you need it)
---
### Author:  [@Noah](https://meta.discourse.org/u/Noah)
#### Post date: [February 27, 2022, 8:45pm UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/14 "2022-02-27T20:45:01Z")
Yeh, I guess this could be a temp fix, it’s a useful feature, so loosing it wouldn’t be fun.
---
### Author:  [@Decorbuz](https://meta.discourse.org/u/Decorbuz)
#### Post date: [February 28, 2022, 12:32am UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/17 "2022-02-28T00:32:35Z")
> [@Noah](#):
>
> As you all know there is now a feature to notify people about a certain topic/post.
For topics, that has always existed at the bottom of the page. It’s not a new feature and has mostly gone unused since its inception (until now).
All of this might by my fault though. I recently endorsed (and bumped) a topic requesting that the “Notify” feature be expanded to replies too.
> [@Replies should be able to utilize "Notify"](https://meta.discourse.org/t/replies-should-be-able-to-utilize-notify/206294):
>
> Continuing the discussion from [Notify group using share\>notify feature](https://meta.discourse.org/t/notify-group-using-share-notify-feature/194674): “Notify” is such an underrated feature. Why does it only work with topics? I think it should work with replies too. I’ve participated in many Discourse communities over the past five years or so. In that span of time, I’ve only ever seen “Notify” be used a few times. It’s often neglected and most users don’t seem to know that it even exists. When it does actually happen to be used by a user, it usually results in a lot of …
> [@Replies should be able to utilize "Notify"](https://meta.discourse.org/t/replies-should-be-able-to-utilize-notify/206294/10):
>
> You can count me in. Even as a Discourse enthusiast, I had no clue that such a feature existed. From what I can tell, it’s severely underutilized.
Oops? 😅
* * *
Regardless, I agree that site admins should have more control over it. I’m just worried that it could seriously impact the ability to notify multiple users in one batch.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [February 28, 2022, 12:33am UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/18 "2022-02-28T00:33:53Z")
> [@Noah](#):
>
> For each trust level, they should be limited to how any many people they can notify daily, this will help keep this feature in use & and will also prevent people being spammed by this feature.
I do support this, @codinghorror how do these numbers sound for defaults:
TL0: zero
TL1: 6 notifications max 2 notifications per user
TL2: double
TL3: double again
---
### Author:  [@Decorbuz](https://meta.discourse.org/u/Decorbuz)
#### Post date: [February 28, 2022, 12:37am UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/19 "2022-02-28T00:37:58Z")
> [@sam](#):
>
> TL0: zero
> TL1: 6 notifications max 2 notification per user
> TL2: double
> TL3: double again
It’s also worth mentioning that you can still notify users when logged out.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [February 28, 2022, 12:40am UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/20 "2022-02-28T00:40:43Z")
> [@Decorbuz](#):
>
> It’s also worth mentioning that you can still notify users when logged out.
Yikes… that should certainly be disabled.
It is an error now:
Should be removed from the UI.
---
### Author:  [@Decorbuz](https://meta.discourse.org/u/Decorbuz)
#### Post date: [February 28, 2022, 12:41am UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/21 "2022-02-28T00:41:37Z")
> [@sam](#):
>
> Yikes…
Well, it was sort of a false alarm. It just spits out an error.
Edit: Yup, you beat me to it. Regardless, the button should definitely be removed. There’s still _a lot_ of work that needs to be done with the unified share dialog.
> [@Replies should be able to utilize "Notify"](https://meta.discourse.org/t/replies-should-be-able-to-utilize-notify/206294/11):
>
> Well, it looks like this is working now! The wording should probably be changed, but otherwise, it functions well. I did prefer the old style though… thinking
---
### Author:  [@not-ethan](https://meta.discourse.org/u/not-ethan)
#### Post date: [February 28, 2022, 2:04am UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/22 "2022-02-28T02:04:57Z")
> [@sam](#):
>
> > [@Decorbuz](#):
> >
> > It’s also worth mentioning that you can still notify users when logged out.
>
> Yikes… that should certainly be disabled.
I disagree. On a forum where I am TL3 if we find a user saying that they are under 13 (COPPA), we need to notify an admin so they can contact the user about it. And if no admins are online at that time there is less we can do about it.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 28, 2022, 2:45am UTC](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497/23 "2022-02-28T02:45:12Z")
Yep that sounds good, surprised we missed this thank you @JammyDodger for pointing it out! We should backport as well..
[Next page](https://meta.discourse.org/t/notify-feature-can-be-easily-abused/219497.md?page=2)