Documentation · SpamGuard
Setup
Pre-release: this documentation describes the current development state and may change before release.
All settings are in the ACP under Setup → Options → SpamGuard.
How SpamGuard checks content
SpamGuard plugs into XenForo’s built-in spam checkers. Every post and registration that XenForo has checked goes through these steps:
- Rules: every rule that matches adds points. Together they make up a score from 0 to 100.
- Decision by score: below the allow threshold the content is approved, from the spam threshold on it counts as spam, in between it is a borderline case.
- AI only for borderline cases (Pro): if the AI review is set up, it decides borderline cases. Without it, borderline cases go to moderation.
- Audit log: score, matched rules and decision are stored, never the content or the prompt. Entries are deleted automatically after 30 days.
Moderators see the score and the reasons in the queue, e.g. “SpamGuard (score 55): …”.
Errors never lead to unchecked publishing. On an internal error or an error from the AI provider, the content goes to the moderation queue. If StopForumSpam is unreachable, only that one rule does not match, the other rules keep checking.
Rules
| Rule | What it checks | Points | Edition |
|---|---|---|---|
| R01 Honeypot | A form field invisible to humans was filled in. | 100 | Lite |
| R02 Time trap | The form was submitted faster than a human could fill it in. | 60 | Lite |
| R03 StopForumSpam | IP, email address or username is listed at stopforumspam.com. | 30–90, depending on confidence | Lite |
| R04 Link limit | A new user posts more different links than allowed. | 40 | Lite |
| R05 Domains | Links to blocked domains, or a deduction if all links point to trusted domains. | 50 / −30 | Pro |
| R06 Keywords | Your own words, phrases or regular expressions. | per entry, default 30 | Pro |
| R07 Character tricks | Invisible characters or words mixing scripts. | 40 | Pro |
| R08 Duplicates | The same content was posted in the last 10 minutes, by anyone. | 50 | Pro |
| R09 Disposable email | Email address at a throwaway domain. | 40 | Pro |
| R10 Language | The post is clearly written in a language the forum does not allow. | 15 | Pro |
| R11 Velocity | Too many posts within one minute, per IP for guests. | 30 | Pro |
| R12 Profile fields | New users with links or keywords in profile fields. | 30 | Pro |
Users count as new while they have fewer messages than XenForo’s “Maximum messages to check for spam” setting (5 if it is not set).
Basic settings
| Option | Meaning |
|---|---|
| License key | Your Pro licence key. Leave empty for Lite. Only the key and the board URL are sent to Lemon Squeezy for the check. The current licence status is shown below the field. |
| Allow threshold | Content with a score below this value (0–100) is allowed. Default: 30. |
| Spam threshold | From this score on, content counts as spam. Default: 70. Must be higher than the allow threshold. Anything in between is a borderline case and is moderated. |
| Action for spam | What happens to spam: “Hold for moderation” (default) or “Reject”. Borderline cases are always moderated. |
| Check StopForumSpam | Looks up IP address, email address and username at stopforumspam.com. Default: on. |
| Links allowed for new users | How many different links a new user may post per message. Default: 2. |
Privacy: with “Check StopForumSpam”, IP address, email address and username are sent to a service outside your server. Mention this in your privacy policy or turn the option off.
Lists and keywords (Pro)
| Option | Meaning |
|---|---|
| Blocked domains | One domain per line, subdomains included. Lines starting with # are comments. |
| Trusted domains | One domain per line. If all links in a post point to these domains, 30 points are subtracted. |
| Keywords | One word or phrase per line, 30 points. Set your own points with phrase = 40, or use regular expressions like /casino\s*bonus/i = 45. Whole words are matched, case-insensitively. Also applied to new users’ profile fields. |
| Disposable email domains | One domain per line, subdomains included. |
| Forum languages | Language codes separated by commas, e.g. de, en. Empty = the forum’s default language. |
Example for Keywords:
# word with default points (30)
viagra
# phrase with custom points
cheap loans = 40
# regular expression
/casino\s*bonus/i = 45The ACP reports invalid lines when you save.
AI review of borderline cases (Pro)
| Option | Meaning |
|---|---|
| AI review of borderline cases (Pro) | “Off” (default) or “Mistral AI (EU)”. You use your own API key. |
| AI API key | The key is never shown again after saving, only its last characters. Leave the field empty to keep it, enter - to delete it. |
| AI model | Model name at Mistral. Default: mistral-small-latest. Advanced option. |
| Minimum AI confidence (%) | The AI verdict only counts from this confidence on (50–100), otherwise the content is moderated. Default: 80. Advanced option. |
| Daily limit for AI requests | Maximum number of AI requests per day. Default: 500. After that, borderline cases are moderated. 0 = AI off. |
The AI review only runs with a valid Pro licence, a selected provider, a stored key and a daily limit above 0. If any of these is missing, borderline cases are moderated. XenForo only shows “AI model” and “Minimum AI confidence” when advanced options are displayed.
Mistral AI (based in France) is currently the only provider. More providers with processing in the EU are planned.
What is sent to the AI provider
Before every request, SpamGuard replaces personal data in the text. This cannot be turned off.
| Data | Replaced with |
|---|---|
| Usernames | [USER_1], [USER_2], … |
| Email addresses | [EMAIL] |
| Phone numbers | [PHONE] |
| IP addresses | [IP] |
| URLs | The domain is kept, path and query are removed. |
| IBAN | [IBAN] |
| Card numbers | [CARD] |
Sign a data processing agreement with Mistral and mention the review in your privacy policy.