Personal message (PM/"DM") permissions

While personal messaging is an important part of many communities, it can also be a very personal avenue to interact with others. We have seen from many of the larger social networks that having granular permissions surrounding personal messages (sometimes referred to as “DMs”) has been key to reducing targeted harassment and bullying.

That being said, in many of these same social networks, the permissions are extremely coarse or reactive, and this applies to Discourse as well. You can choose to disable the receipt of all personal messages, or, if you do not wish to speak with someone, place them on ignore to prevent further PMs from that user. The first option basically means you can no longer be messaged by anyone, and the second only helps after you have been contacted.

For vulnerable segments of the population, having a user contact you cold can often feel like an incursion into your personal/safe space. This is especially true for users that choose to take disagreements private to continue them, and I often see these sorts of engagements flagged, even though moving such a discussion private isn’t against any sort of rule or policy.

So, it’s become clear to me that regardless of intention, the effect of open PMs can very much affect the feeling of safety and security in a community.

As an administrator, I have few options to combat this. I can disable PMs for TL1/2s and restricted it to trusted members of the community, but at the price that I have effectively removed PMs from the majority of the userbase altogether (and when I say “remove” I mean it - Discourse literally hides the Personal message section altogether!). I can try and craft some sort of policy around PM etiquette but as this isn’t at all a norm in other online communities, it’s very likely this will only be read after one’s first infraction, which doesn’t resolve the problem and remains a reactive solution.

Other social networks have responded to this in various ways - only those you friend/put on an allowlist can message you, for example - but I think most of these are also insufficient, because they force someone wishing to make a new connections to publicly request it first.

Instead, I’d like to propose a setup like the following:

  • either a sitewide or per-user option to require approval for all first-time PMs by user. Staff PMs would obviously be exempt, and an optional list of “always allowed” groups could be included as a config option as well.
  • with this feature enabled, any new PM you receive would show a message indicating what user has sent a PM, and possibly the subject of said PM. The user can choose to accept or deny the request.
  • If the request is accepted, the PM becomes available, and the user is added to the allowlist for future messages, and conversation continues as normal
  • If the request is denied, nothing happens, the notification is removed, the PM is not shown to the recipient, and crucially the requestor is not told their message was rejected. This is to avoid retaliation by the requestor.
  • Optionally a checkbox could be added to the rejection option to also add the user to your ignore list to prevent future PM requests, which would cause this user to get a message that “The user you are messaging is not accepting PMs” going forward.
  • The allowlist and ignorelist would, of course, be editable by users to change these permissions at any time.

I think this proposal solves the problem of having to ask permission to message publicly before doing so, while also ensuring that abuse/bullying/harassment potential is greatly reduced (as the body of the PM is not visible unless accepted), and avoids letting requestors be aware that they are being muted/ignored/etc. as well.


Most of what you’re requesting can already be achieved on the /my/preferences/users page.

If someone doesn’t want people to be able to send the DMs, they can:


Disable the allow other users to send personal messages and chat direct messages setting or create an allow list by enabling only allow specific users to send me personal messages or chat direct messages

FWIW, that page has other useful options so it is a good idea to direct your community to the users tab on their profile to personalize it per their preference.

1 Like

As I mentioned above, these remedies are insufficient:

The first option you pointed out uses a sledgehammer that says “no one can message me ever, not even my friends”, and the second option is reactive, and the allowlist has no means to be added other than asking someone in a public message to allow them to message you, and even that is difficult because the message you get is “soandso is not accepting messages”, not “soandso has to allow you to send them messages” (and to be clear, the latter is probably unwise anyway, because it allows a user to “test” if they are allowed or not.)

It’s very important to view these controls from the perspective of a vulnerable community member who wishes to proactively control access to their personal, one-on-one communications while maintaining some sort of avenue for new members to reach out. We don’t try to console victims of abuse by telling them to not leave their homes or go online, and that’s what the “don’t allow PMs from anyone ever” option essentially does.


I’m generally supportive of this kind of refinement to how personal messages and chat direct messages work.

We’ve discussed similar ideas in the past, but they haven’t quite made it to the top of our list.

There are a number of design details to work out and I think your proposal does address many of them, but each one deserves attention and they all have to work together, which has made it difficult to define something of smaller scope.