# Tips for Preventing Spam
**URL:** https://meta.discourse.org/t/tips-for-preventing-spam/264020
**Category:** Site Management
**Tags:** moderation, explanation, spam
**Created:** [May 5, 2023, 9:38pm UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020 "2023-05-05T21:38:05Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@Discourse](https://meta.discourse.org/u/Discourse)
#### Post date: [May 5, 2023, 9:38pm UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/1 "2023-05-05T21:38:05Z")
> đ This documentation provides a comprehensive guide on preventing spam in Discourse forums, and includes information about various settings and tools designed to help maintain a spam-free community environment.
>
> đ Required user level: Administrator
On most forums spam is rare. However, if youâre having problems with spam on your site, Discourse comes with numerous tools to help you automatically prevent spam.
The following guide offers some recommendations on how you can help prevent spam, while still maintaining a positive and welcoming environment for your community.
# Spam Detection with Discourse AI
[AI Spam Detection](https://meta.discourse.org/t/discourse-ai-spam-detection/343541) is one of the best Discourse features for automated spam detection. Unlike other tools, it can **automatically block users and posts** based on preconfigured rules. AI Spam Detection is available to **all users** on Discourse hosting, and on self-hosted sites with an LLM configured.
**Benefits of AI Spam Detection include:**
- **Automation** : No manual intervention is needed to block obvious spam.
- **Customizability** : You can tailor it to your communityâs unique requirements.
- **Scalability** : Works well even when communities are under heavy spam attacks.
- **Broad compatibility** : Free (on Discourse hosting) and budget-friendly LLMs like GPT-4, Claude 3.5, and Gemini Flash can handle spam detection effectively.
## Setting up AI spam detection
> đŁ This is now default turned on for [Starter and Standard customers](https://meta.discourse.org/t/discourse-ai-spam-detection-replaces-akismet-plugin/354602)
Simply turn it on in Admin settings â plugins â AI â Spam Handling ([details here](https://meta.discourse.org/t/ai-powered-spam-detection/343543)).
By default it uses a prompt that Discourse has tailored for our sites, but you may add custom instructions specific to your site.
> **Example tailored prompt**
>
> > [@](#):
> >
> > Be extra careful about posts that are not in English.
> âš With [Discourse AI](https://meta.discourse.org/t/discourse-ai/259214) you can also use the creative AI bot **to generate tailored prompts** that are specific to your siteâs needs.
# Default Trust Levels
The default trust level for new users on your site can be adjusted on the `.../admin/site_settings/category/trust` page, however, we recommend keeping the `default trust level` set to 0.
If youâve modified the value of this setting, we **strongly** recommend changing it back to `0: new user`, as changing this setting can put your site at serious risk for spam, due to the way that trust levels interact with Discourseâs spam related settings.
# Spam Related Site Settings
> â Unless you are specifically having trouble with spam, we recommend keeping the following settings at their default values.
Discourse has several spam related site settings that you can access on your siteâs `.../admin/config/spam` page.
These settings can be adjusted to increase or decrease the sensitivity of spam detection, and the strictness of the consequences associated with posting spam.
The following are some of the more commonly adjusted spam related settings that have a notable impact on how spam is handled on a site.
The default values for all settings are shown below.
## Hiding Posts
The `hide post sensitivity` and `cooldown minutes after hiding posts` settings control the likelihood that a [flagged post](https://meta.discourse.org/t/discourse-moderation-guide/63116#flags-13) will be automatically hidden by Discourse, and how long a user must wait before they can edit a flagged and hidden post.
## Silencing New Users
Discourse has a `num users to silence new user` site setting, which will automatically silence a new user if their posts are flagged as spam by a certain number of unique users.
By default this is set to 3, so you may want to consider lowering this if youâre consistently having problems with spam coming from the same user(s).
## Limiting Links
Discourse limits the number of posts a new user can make that contain links to an outside domain with the `newuser spam host threshold` setting. If new users on your site are frequently spamming links to the same domain, you may want to consider lowering the value of this setting.
## Limiting IP Addresses
Discourse limits the number of new accounts a user can make from any given IP address. If youâre finding that problematic users on your site are repeatedly creating accounts to spam your site, you could consider lowering this from the default value.
Thereâs also a `flag sockpuppets` checkbox that you can enable to prevent users from creating multiple accounts and then commenting on the same topic:
Additionally, you can manually look up the IP addresses of problematic users on their admin page under the `Last IP Address` and `Registration IP Address` fields, and delete other accounts associated with the same IP address.
Or consider blocking IP addresses that spammers are using on the âLogs â Screened IPsâ page (`.../admin/logs/screened_ip_addresses`):
## Adjusting Flag Requirements
By default, a topic needs to be flagged by 5 unique users before Discourse will automatically suspend posting to that topic.
You can adjust the `num flaggers to close topic` site setting to raise or lower the number of flaggers required to suspend posting on a topic, and adjust the `auto close topic sensitivity` setting to change the likelihood that the topic in question will get automatically closed instead.
# Watched Words
[Watched Words](https://meta.discourse.org/t/watched-words-reference-guide/241735) are another great feature for helping block or limit posts that contain words, phrases, or URL links that spammers might be repeatedly using.
Considering adding some âBlockedâ or âSilenceâ Words to your site if youâre finding that spammers are frequently using the same types of text in their posts.
For a more advanced use of Watched Words, you could also consider [Using Regex with Watched Words](https://meta.discourse.org/t/using-regex-with-watched-words/241861).
# Increase Trust Level Requirements
If youâre finding that spam is coming mainly from TL0 users, you may also want to adjust some of the trust level settings to make it harder to get to TL1:
# hCaptcha Plugin
The [Discourse hCaptcha](https://meta.discourse.org/t/discourse-hcaptcha/291383) plugin aims to enhance security and bot protection by integrating hCaptcha into the local sign-up form.
> ⨠On all Discourse hosted sites, this plugin is automatically included.
# Additional Steps
Understanding why users are spamming your site is important. Are they bored, malicious, or looking to promote themselves?
> [@Why do new users need to click an extra button to Activate their account?](https://meta.discourse.org/t/why-do-new-users-need-to-click-an-extra-button-to-activate-their-account/33175/2):
>
> Reminder, most spammers are 100% human these days
Suggestions for dealing with [the difficult user](https://meta.discourse.org/t/discourse-moderation-guide/63116#the-difficult-user-22), along with a variety of other moderation topics can be found in the [Discourse moderation guide](https://meta.discourse.org/t/discourse-moderation-guide/63116), so you may want to read through this guide for some additional ideas regarding moderating your site.
Outside of the above, ramping up your moderation team for the short term, so that you have full coverage is another good approach to combating spam. The key is to wear the problem users down so they get bored and move on.
If youâre continually having problems with spam after going through this guide, you could also consider placing all or some posts from new users into the [review queue](https://meta.discourse.org/t/discourse-moderation-guide/63116#the-review-queue-14) with the `approve post count`, `approve unless allowed groups`, or `approve new topics unless allowed groups` settings:
The `approve unless allowed groups` setting requires posts created by users not in the specified groups to be approved. Posts created by admins and moderators are always approved.
The `approve new topics unless allowed groups` setting requires new topics created by users not in the specified groups to be approved. Topics created by admins and moderators are always approved.
However, itâs important to make sure you have enough moderators at hand to handle this, as this can potentially make it difficult for new users to start interacting with the site if posts go unapproved.
> Last edited by @SaraDev 2025-12-01T22:12:26Z
>
> > **Check document**
> >
> > Perform check on document:
---
### Author:  [@not-ethan](https://meta.discourse.org/u/not-ethan)
#### Post date: [May 5, 2023, 9:42pm UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/2 "2023-05-05T21:42:36Z")
> [@SaraDev](#):
>
> On most forums spam is rare.
I cant speak for all forums but I forum I used to be on as TL3 there was at least one spam post still up when I logged on for the first time for the day in my watched categories. And the one Iâm currently a mod on we get an average of 2 or so spam posts a day. So I think it is some what common on a lot of forums based on that
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [May 16, 2024, 11:06am UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/3 "2024-05-16T11:06:07Z")
> [@SaraDev](#):
>
> [Watched Words](https://meta.discourse.org/t/watched-words-reference-guide/241735) are another great feature for helping block or limit posts that contain words, phrases, or URL links that spammers might be repeatedly using.
One very useful regular expression is `\d{3}-\d{4}|[\w+\-.]+@[a-z\d\-]+(\.[a-z\d\-]+)*\.[a-z]+` which blocks email addresses and phone numbers. Donât forget to enable settings - posting - âwatched words regular expressionsâ.
---
### Author:  [@Danny\_Dainton](https://meta.discourse.org/u/Danny_Dainton)
#### Post date: [July 5, 2024, 6:23pm UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/4 "2024-07-05T18:23:24Z")
Hey đ
Iâve been making great use of these tips on my forum soâŚthank you! â¤
Is there a setting that can be enabled that sends only new users signing up from say a `gmail.com` domain, to the review queue?
Currently, I have all new users sent to the queue for review but Iâve found the majority of the spam users are ones that are created using a gmail email. Sending only those to the review queue would reduce to load and the review time, for me at least đ
---
### Author:  [@Gbadebo\_Bello](https://meta.discourse.org/u/Gbadebo_Bello)
#### Post date: [August 27, 2024, 8:54am UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/5 "2024-08-27T08:54:54Z")
@SaraDev Do you know if this is possible? Iâll love to know too as it would be very helpful to block not just IPs but specific domains!
---
### Author:  [@SaraDev](https://meta.discourse.org/u/SaraDev)
#### Post date: [August 28, 2024, 11:03pm UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/6 "2024-08-28T23:03:01Z")
There is no core Discourse feature to send posts only from users on a specific domain (e.g., `gmail.com`) to the review queue.
The closest related feature is the **auto approve email domains** site setting, which allows certain email domains to bypass the manual user approval process by automatically approving users from those domains.
There are also settings for `blocked email domains` and `allowed email domains` that provide a way to restrict or control who can register on your site based on their email domains:
However, these settings would all require the `must approve users` setting to be enabled, and only impact users initially registering on a site, and not the interaction between creating posts and the review queue.
As a workaround, you could use `Groups` to accomplish a similar functionality though. For example, you could create a custom group and automatically add users who register with a specific email address to the group, and then add this group to the `approve unless allowed groups` and `approve new topics unless allowed groups` setting.
With this type of setup, you could effectively bypass the review queue for users with a specific domain, while still sending other posts to the review queue if desired.
---
### Author:  [@dirkdaems](https://meta.discourse.org/u/dirkdaems)
#### Post date: [December 9, 2024, 8:04am UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/7 "2024-12-09T08:04:26Z")
Hi, I was wondering whether it is possible to force a captcha on topic and/or post creation?
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [December 9, 2024, 8:54am UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/8 "2024-12-09T08:54:14Z")
I donât know, but what it helps if a bot can bypass captcha when login? Then it can do same when publishing,
---
### Author:  [@dirkdaems](https://meta.discourse.org/u/dirkdaems)
#### Post date: [December 9, 2024, 3:15pm UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/9 "2024-12-09T15:15:46Z")
True, but there seems to be captcha support for registration, so I was wondering whether the same exists for topic/post creation.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [January 18, 2025, 11:30am UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/13 "2025-01-18T11:30:45Z")
Weâve seen a number of clients hit by large spam attacks lately, and what they all had in common is that they opened up one or more categories to `everyone` - `create`, bypassing all trust level restrictions.
For seasoned Discourse admins itâs obvious that this is a bad idea, but for less experienced people itâs not. So it might be a good idea to state the (for us) obvious and add this to the start post of the topic.
---
### Author:  [@Overgrow](https://meta.discourse.org/u/Overgrow)
#### Post date: [September 10, 2025, 11:44am UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/14 "2025-09-10T11:44:18Z")
Lately, weâve been dealing with spammers who use automatic registration and then try creating new topics with AI-generated content that looks like genuine requests for advice, but includes Amazon affiliate links. They usually mask those links with various URL shortener engines. They are able to respond to replies and even can chat in PM in a funny way. Has anyone experienced this? I wonder if, since these attempts seem to be fully automated, there would be plenty of other targeted Discourse forums. Do you have any advice on a strategy for cutting them loose?
---
### Author:  [@SaraDev](https://meta.discourse.org/u/SaraDev)
#### Post date: [September 16, 2025, 7:59pm UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/15 "2025-09-16T19:59:47Z")
Hi @Overgrow,
> [@Overgrow](#):
>
> weâve been dealing with spammers who use automatic registration and then try creating new topics with AI-generated content that looks like genuine requests for advice, but includes Amazon affiliate links. They usually mask those links with various URL shortener engines.
A few ideas you could try here to prevent this:
- Use [Discourse AI - AI triage](https://meta.discourse.org/t/discourse-ai-ai-triage/281227) to [Set up spam detection in your community](https://meta.discourse.org/t/setting-up-spam-detection-in-your-community/300427) to detect this type of content
- Add URL shorteners and Amazon affiliate link patterns to your blocked [watched words](https://meta.discourse.org/t/watched-words-reference-guide/241735) list
- Lower the `newuser spam host threshold` and increase requirements for TL1
- Reduce `max new accounts per registration IP` and enable `flag sockpuppets`
- Use the [Discourse hCaptcha](https://meta.discourse.org/t/discourse-hcaptcha/291383) plugin to help prevent automated spam/AI registrations on your site.
- Consider placing all new user content in the review queue until the attack subsides by adjusting:
- `approve post count`
- `approve unless trust level`
- `approve new topics unless trust level`
The approach here will be similar to preventing spam in general, with more of a focus specifically on the shortened URLs, and AI generated content.
For your case here, you could try using an AI prompt for specifically detecting AI content like the following:
```plaintext
You are a spam detection system. Analyze the following content and context.
Notes:
- Replies must remain relevant to the discussion thread.
- Mark as SPAM if the content is irrelevant, promotional, or automated.
- Consider new user posts with links as potential SPAM unless explicitly relevant to the topic.
Watch for content that appears authentic but has unnatural patterns.
Look for text with peculiar phrasing, excessive formality mixed with
casual language, or generic advice that doesn't quite fit the context.
Flag content containing hidden affiliate links, especially when the post
seems designed to naturally lead to product recommendations.
Pay special attention to these red flags:
1. Content that poses as genuine advice requests but contains promotional elements
2. Posts that introduce a problem and then suggest specific products as solutions
3. The presence of URL shorteners (bit.ly, tinyurl, t.co, goo.gl, etc.) which may disguise affiliate links
4. Amazon product links or references, especially with affiliate parameters (tag=, ref=, affiliate=)
5. Content that seems to ask for recommendations but subtly steers toward specific products
6. Artificial quality text - overly formal language mixed with casual expressions or awkward structure
7. New accounts posting content with any of the above patterns
Respond only with "SPAM" or "NOT SPAM".
```
---
### Author:  [@manton](https://meta.discourse.org/u/manton)
#### Post date: [October 12, 2025, 7:57am UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/16 "2025-10-12T07:57:54Z")
Having a lot of trouble with bot accounts lately. Ive had to disable new user registrations for the second time. Yesterday had to delete 50 odd bot accounts with roughly 30 spam posts. Have already enabled hcaptcha with a difficult puzzle but hasnât stopped them. Was on 3.5.0 but just updated to 3.6.0 just after the attack. We already donât allow links at trust level 0 and require 30 posts before allowing links, but these posts are just walls of text about travel agents and other random nonsense. Had also had AI accounts and posts that refer to actual forum content but donât quite make sense. Those are somewhat entertaining for our user base, but anyway, I didnât want to enable AI on the forum but i feel i have exhausted all other options. However, i get this message:
But I donât see anywhere to add said configuration?
Above all, while the AI might help with the spam, I donât think that enabling this will help with the bot accounts being created in the first place or am I wrong?
---
### Author:  [@haydenjames](https://meta.discourse.org/u/haydenjames)
#### Post date: [November 11, 2025, 11:48am UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/17 "2025-11-11T11:48:42Z")
If `approve post count` is set to `1`. Then is modifying these still needed?
> [@](#):
>
> - `approve unless trust level`
> - `approve new topics unless trust level`
I honestly donât know the answer to that question.
---
### Author:  [@SaraDev](https://meta.discourse.org/u/SaraDev)
#### Post date: [December 1, 2025, 11:32pm UTC](https://meta.discourse.org/t/tips-for-preventing-spam/264020/18 "2025-12-01T23:32:06Z")
> [@haydenjames](#):
>
> If `approve post count` is set to `1`. Then is modifying these still needed?
>
> > [@](#):
> >
> > - `approve unless trust level`
> > - `approve new topics unless trust level`
Yes, if `approve_post_count` is set to 1, you should still review those other settings.
**How these settings interact:**
**`approve_post_count`** (set to 1):
- Affects users with **trust level 0 and 1**
- Requires their first post to be approved
- After 1 approved post, they can post freely (assuming theyâre still TL0 or TL1)
**`approve_unless_allowed_groups`** (formerly `approve_unless_trust_level`):
- Affects **everyone** not in the specified groups
- Requires **all posts** (not just the first one) to be approved
**`approve_new_topics_unless_allowed_groups`** (formerly `approve_new_topics_unless_trust_level`):
- Affects **everyone** not in the specified groups
- Requires approval only for **new topics** (not replies)
**The key difference:**
- `approve_post_count` is temporary - once users hit the count threshold, they can post freely
- The âunless allowed groupsâ settings are **ongoing** - they apply to ALL posts/topics from users not in the specified groups, regardless of how many posts theyâve made
You could also combine settings for better control over posting on your site, for example:
- Use `approve_post_count: 1` to review initial posts from new users (TL0/TL1)
- Use `approve_unless_allowed_groups` settings for ongoing moderation of everyone except specific groups (e.g., TL2+ members)
This creates an approach where new users are moderated initially, and you could also control who gets ongoing freedom to post without approval.