# Spammers using uploaded images in spam e-mails. Any advice how to resolve?
**URL:** https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062
**Category:** Support
**Created:** [June 14, 2024, 8:16am UTC](https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062 "2024-06-14T08:16:03Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@fifafu](https://meta.discourse.org/u/fifafu)
#### Post date: [June 14, 2024, 8:16am UTC](https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062/1 "2024-06-14T08:16:03Z")
I have a Discourse installation and am super happy with it. Recently spammers have found ways to workaround the built in spam-protection. The problem is, they post images in their posts and then immediately embed these images in spam e-mails they send to thousands of people. Even if I delete the posts, these images seem to stay available for at least quite some time.
This has lead to some spam abuse complaints from my hoster.
Currently I have disabled uploading images for new users, but as it’s a support forum this is not a very nice solution. People often need to add some screenshots etc. to their first posts.
Has anybody found a workable solution to this problem?
I have already tried to uncomment the valid\_referers command for ^/uploads, but it does not seem to do anything. The images can still be embedded:
```plaintext
location ~ ^/uploads/ {
# NOTE: it is really annoying that we can't just define headers
# at the top level and inherit.
#
# proxy_set_header DOES NOT inherit, by design, we must repeat it,
# otherwise headers are not set correctly
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Request-Start "t=${msec}";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $thescheme;
proxy_set_header X-Sendfile-Type X-Accel-Redirect;
proxy_set_header X-Accel-Mapping $public/=/downloads/;
expires 1y;
add_header Cache-Control public,immutable;
## optional upload anti-hotlinking rules
valid_referers folivora.ai *.folivora.ai *.llo.ai;
if ($invalid_referer) { return 403; }
# custom CSS
location ~ /stylesheet-cache/ {
add_header Access-Control-Allow-Origin *;
try_files $uri =404;
}
# this allows us to bypass rails
location ~* \.(gif|png|jpg|jpeg|bmp|tif|tiff|ico||avif)$ {
add_header Access-Control-Allow-Origin *;
try_files $uri =404;
}
# SVG needs an extra header attached
location ~* \.(svg)$ {
}
# thumbnails & optimized images
location ~ /_?optimized/ {
add_header Access-Control-Allow-Origin *;
try_files $uri =404;
}
proxy_pass http://discourse;
break;
}
```
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 14, 2024, 8:38am UTC](https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062/2 "2024-06-14T08:38:13Z")
Hmmm. That is a tricky one. 🤔
I think if you edit the post to remove the image so it’s not included in the latest version of a post (deleted or otherwise), and also set `clean orphan uploads grace period hours` to the minimum of 1 hour that may speed up the removal.
It’s not an ideal solution for this though, either for ease of use or immediacy.
---
### Author:  [@fifafu](https://meta.discourse.org/u/fifafu)
#### Post date: [June 14, 2024, 8:40am UTC](https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062/3 "2024-06-14T08:40:22Z")
I have already set it to one hour, but they are really quick to send out their spam e-mails…
Do you know whether using S3 instead of my own server for uploads would resolve the issue? Is there maybe some way to only allow viewing of uploaded images to logged in users?
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 14, 2024, 8:52am UTC](https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062/5 "2024-06-14T08:52:04Z")
> [@fifafu](#):
>
> Do you know whether using S3 instead of my own server for uploads would resolve the issue? Is there maybe some way to only allow viewing of uploaded images to logged in users?
There is the Secure Uploads feature that may be of some use:
[https://meta.discourse.org/t/secure-uploads/meta/140017](https://meta.discourse.org/t/secure-uploads/meta/140017)
Though it is an advanced setup, and not one I’m overly familiar with.
* * *
Actually, reading through it again, it may not be suitable for this after all:
> [@Secure Uploads](https://meta.discourse.org/t/secure-uploads/140017/1):
>
> Once you have enabled Secure Uploads, any file uploaded via the Composer will either be marked as secure or not secure based on the following criteria:
>
> - If you have the “login required” site setting enabled, _all uploads will be marked as secure_, and anonymous users will not be able to access it.
> - If you are uploading something within a Personal Message, it will be marked as secure.
> - If you are uploading something within a Topic that is inside a private Category, it will be marked as secure.
---
### Author:  [@fifafu](https://meta.discourse.org/u/fifafu)
#### Post date: [June 14, 2024, 9:23am UTC](https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062/6 "2024-06-14T09:23:35Z")
Maybe I should post this as a feature request then.
Basically I believe I would need two things
- ability to immediately remove images if a user is deleted (including profile pic)
- ability to immediately remove or secure images if a user is flagged for review
---
### Author:  [@Genisis](https://meta.discourse.org/u/Genisis)
#### Post date: [June 14, 2024, 10:38am UTC](https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062/7 "2024-06-14T10:38:23Z")
Use this, you can easily and quickly permanently delete images
> [@Enable setting to allow admins to permanently delete data](https://meta.discourse.org/t/enable-setting-to-allow-admins-to-permanently-delete-data/206678):
>
> bookmark This is a guide on how to enable the setting for administrators to permanently delete data on a Discourse instance. person_raising_hand Required user level: Admin As of [v2026.4.0 Changelog | Discourse Releases](https://releases.discourse.org/changelog/v2026.4.0/?filter=permanently_delete&tab=feature) the site setting to allow admins to permanently delete data is no longer a hidden site setting. To use this feature, enable the can permanently delete setting. However, please be aware of the risks involved with this feature — as the setting name suggests, if you permanen…
---
### Author:  [@fifafu](https://meta.discourse.org/u/fifafu)
#### Post date: [June 14, 2024, 10:51am UTC](https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062/8 "2024-06-14T10:51:29Z")
Thanks, I’ll try that. Are you sure it will also permanently delete images?
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 14, 2024, 11:00am UTC](https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062/9 "2024-06-14T11:00:07Z")
I _think_ it deletes the posts and the uploads are taken care of in a similar way to the method above using `clean orphan uploads grace period hours`.
There’s also an inbuilt delay of 5 minutes between soft deleting and permanently deleting by the same admin (though a second admin would not face the same wait).
Certainly worth a try though. 🤞
---
### Author:  [@Genisis](https://meta.discourse.org/u/Genisis)
#### Post date: [June 14, 2024, 3:01pm UTC](https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062/10 "2024-06-14T15:01:26Z")
Yes. And as the other guy above said. Gotta wait 5 mins. Just use another admin account to do it instantly. It’ll permanently delete the image.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [June 17, 2024, 8:47am UTC](https://meta.discourse.org/t/spammers-using-uploaded-images-in-spam-e-mails-any-advice-how-to-resolve/312062/12 "2024-06-17T08:47:19Z")
I _think_ something’s wrong with your NGINX configuration. When I try to open an image from your forum in a new tab, it loads just fine even though it shouldn’t since I haven’t passed any referer 🤔
If you get it to work, it will solve most of your spam issues as they won’t be able to hotlink to any of your forum’s images.