Spam Protection

SupDesk protects public feedback with layered bot detection, spam scoring, and a review queue. The core protection and queue are available on every plan; paid plans add controls for tuning and automation.

How moderation works

A public submission is assessed before it can appear on the feedback board. It receives one of three states:

Quarantine happens at submission time. SupDesk never automatically hides or deletes content that was already published. Moderation marks are retained so your team can understand what happened, and retention rules eventually remove quarantined rows according to the plan.

Enable bot protection

Turnstile is the browser-level bot check for portal forms. It runs without asking real users to solve an image puzzle.

1. Open the project in the console.
2. Go to Project Settings and open the domain settings section.
3. In Turnstile, enter the public site key and the secret key from Cloudflare.
4. Enable the protection and save.

The secret key is write-only and stored encrypted. Never put it in client-side code, documentation examples, or source control. Turnstile is available with the project domain capability; see Pricing & Plans.

Turnstile is one layer, not the entire system. The queue and server-side assessment still protect submissions that reach the application through other public entry points — including posts created through the REST API and the MCP server. Turnstile itself is a browser check, so it does not apply to server-to-server calls.

Review the queue

Open Project → Spam & moderation to review held submissions. The queue is available on every plan because a project must always be able to recover legitimate feedback that was held.

Each row can show the title, a shortened body, author email, moderation status, score, and machine-readable reason. Select one or more rows and choose:

• Approve — publish the selected submissions to the feedback board. Approved end-user submissions also contribute to the author’s accepted-post reputation where that capability is enabled.
• Mark as spam — move the selected submissions to the spam state. This marks them for retention cleanup; it does not silently delete published content.

If a legitimate submission is held, approve it instead of asking the customer to submit again. If the queue is empty, the console reports that there is nothing waiting for review.

Custom rules

Custom rules are available on Pro and higher. Open Project → Spam & moderation, then use the Rules section. Owners and admins can add or remove rules; other members can review the queue.

A rule has a match type, a value, and an action:

Available actions are:

• Hold for review — send the match to the queue.
• Mark as spam — keep the match out of the public board as spam.
• Allow — explicitly let the match through. An allow rule takes precedence over discretionary blocking or quarantine rules.

Values are normalized to lower case and limited to 200 characters. Duplicate rules for the same project, match type, and value are rejected.

Automatic signals

The server-side assessment uses inexpensive signals first and only calls AI for ambiguous cases on eligible plans. Signals include:

• Honeypot fields, impossible submission timing, and disposable email domains
• Repeated bodies, link-heavy submissions, and unusually large numbers of links
• Excessive capitalization, unverified email, and a first post containing links
• Project rules and explicit allow rules
• Optional holds for unverified authors, linked submissions, or an author’s first post

These signals are deliberately conservative. When the system cannot confidently decide, it can place the submission in Pending for a human review rather than silently discarding genuine feedback.

AI scoring and trusted authors

AI spam scoring is available on Team and Business. It runs only in the ambiguous band left by the heuristic assessment, and it is platform defense rather than a charge against the project’s ordinary AI task allowance. The project threshold determines when an AI score is treated as spam.

Trusted authors are also available on Team and Business. A team can explicitly trust an author, and accepted legitimate posts build reputation over time. Trusted authors bypass discretionary heuristics, while explicit project rules still take precedence.

Retention and plan limits

The spam feature is designed so that protection is not removed from lower plans:

The queue is the source of truth for held content. Retention cleanup applies to quarantined rows; it does not remove published posts, comments, or conversations.

Troubleshooting

A real submission is pending

Open Spam & moderation, inspect the reason and score, then approve the submission. If the same sender is repeatedly held and your plan supports trusted authors, trust the author after confirming the activity is legitimate.

The Rules section is unavailable

Custom rules require Pro or higher. The review queue remains available on Free, so you can still approve or mark held submissions without upgrading.

Turnstile will not save

Check that the project has the required domain capability, the site key belongs to the site where the portal is served, and the secret key was copied from Cloudflare without extra whitespace. The secret is never displayed after saving; enter it again only when you intend to replace it.

A published post disappeared

Spam moderation does not automatically hide published content. Check the post’s ordinary visibility and deletion history, and contact support if the content is not present. A submission held before publication is different from an existing published post.