# One of my users just group messaged 100 other user with a spam offer **URL:** \ **Category:** Support\ **Created:** [2017年七月4日 22:19 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612 "2017-07-04T22:19:49Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Olivier\_Lambert](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/olivier_lambert/32/74807_2.png) [@Olivier\_Lambert](https://meta.discourse.org/u/Olivier_Lambert)\ **Post date:** [2017年七月4日 22:19 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/1 "2017-07-04T22:19:49Z")
So, as written in the title, one of my users just group messaged 100 other user with a spam offer. Is there a way to limit the number of users that can be added to a private conversation? ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2017年七月4日 22:29 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/2 "2017-07-04T22:29:28Z")
That is the limit, 100, even lower for new users. Check your site settings to make it more strict. (Also 100 does seem high as a default for this, @techapj can you change this to 30 as I think that is a safer default anyways.) ---
**Author:** ![Olivier\_Lambert](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/olivier_lambert/32/74807_2.png) [@Olivier\_Lambert](https://meta.discourse.org/u/Olivier_Lambert)\ **Post date:** [2017年七月4日 22:41 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/3 "2017-07-04T22:41:01Z")
Just to be sure, is this the setting you’re reffering to? ![](https://global.discourse-cdn.com/meta/original/3X/9/0/9001fbff8a694b0df7c63eec1a91eb1e2c8177fd.png) ---
**Author:** ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)\ **Post date:** [2017年七月4日 22:53 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/4 "2017-07-04T22:53:13Z")
Was it a group PM? So this spam account got to trust level 2 somehow? How old is the account? ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2017年七月4日 22:59 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/5 "2017-07-04T22:59:02Z")
Hmm yeah maybe it wasn’t regular public mentions. We should still cap how many recipients can be in a group PM, in addition to the stricter public mention limit. ---
**Author:** ![Olivier\_Lambert](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/olivier_lambert/32/74807_2.png) [@Olivier\_Lambert](https://meta.discourse.org/u/Olivier_Lambert)\ **Post date:** [2017年七月4日 23:09 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/6 "2017-07-04T23:09:55Z")
I’ve put my DM to lvl 1 instead of lvl 2. He posted a couple of times, and when he got to lvl 1 he started sending direct messages to other users. It was not automated spam. Just a user trying to promote unwanted product through my platform 😕 ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2017年七月4日 23:44 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/7 "2017-07-04T23:44:05Z")
Trust level 1 is not a safe setting to allow group PMs. Regardless I support a lower cap on public mentions and group PM recipients. @techapj can you check, I don’t see a site setting for max PM recipients, other than max notifications which is 100. If we are missing a limit setting here we need one. ---
**Author:** ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)\ **Post date:** [2017年七月6日 06:00 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/8 "2017-07-06T06:00:32Z")
> [@codinghorror](#): > > If we are missing a limit setting here we need one. Okay, I just created a PR to add new setting `max_allowed_message_recipients` with default value of `30`. Some highlights: - A (non-staff) user can send a message to maximum 30 recipients by default. - If user adds a group as message recipient and if that group has more than 30 members, then this setting will come into action and an error will be generated. - This setting will _not_ come into action if a message was sent to a group [via email](https://meta.discourse.org/t/configuring-reply-via-email-e-mail/42026). [https://github.com/discourse/discourse/pull/4956](https://github.com/discourse/discourse/pull/4956) ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2017年七月6日 15:40 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/9 "2017-07-06T15:40:33Z")
> [@techAPJ](#): > > If user adds a group as message recipient and if that group has more than 30 members, then this setting will come into action and an error will be generated. I don’t think this is a goal here; if the group owner allows a group to be message-able then that is how it is. What we mainly want to prevent with this setting is actually entering 50+ recipients manually. ---
**Author:** ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)\ **Post date:** [2017年七月6日 17:27 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/10 "2017-07-06T17:27:52Z")
Okay, I removed the check on group message recipients. Now only user recipients will be checked and default limit of “max 30 recipients” will be applied. PR has been merged. ---
**Author:** ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)\ **Post date:** [2019年六月26日 08:33 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/11 "2019-06-26T08:33:09Z")
---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2019年六月26日 09:19 UTC](https://meta.discourse.org/t/one-of-my-users-just-group-messaged-100-other-user-with-a-spam-offer/65612/12 "2019-06-26T09:19:11Z")