How SupDesk keeps spam off your feedback board
Public feedback works only when real customers can reach the board without sorting through promotional posts, link drops, and automated submissions. SupDesk Spam Protection checks new submissions before publication, gives your team a review queue, and lets you add stronger controls as your project grows.
Protection before publication
Every submission receives a moderation verdict: published, pending, or spam. Published content appears on the board. Pending content waits for a team member. Spam stays out of the public board.
The system uses several signals before it asks for human attention:
- Honeypot fields and impossible submission timing
- Disposable email domains and repeated bodies
- Link-heavy submissions and excessive capitalization
- Your project rules and hold policies
- Optional AI scoring for ambiguous cases on Team and Business
This order keeps ordinary feedback moving while sending uncertain cases to review. A submission that was already published is never automatically hidden or deleted by spam moderation.
Review the queue instead of guessing
Open Project → Spam & moderation to see held submissions. The queue shows the title, a body preview, the author address, the moderation reason, and the score when one exists.
Select one or more rows, then choose Approve or Mark as spam. Approving publishes legitimate feedback. Marking a submission as spam keeps it out of the board and starts its quarantine retention window. The queue is available on every plan because every project needs a way to recover a legitimate submission.
Rules that match your project
Pro and higher plans can add rules for words or phrases, sender domains, linked domains, and privacy-preserving visitor identifiers. Each rule can hold a match for review, mark it as spam, or allow it through. Allow rules take precedence over discretionary blocking and quarantine rules.
You do not need to start with a blank form. Spam Protection includes ten starter templates for common promotional language, prize scams, short links, disposable email, adult-product promotion, casino promotion, guest-post pitches, fast-money pitches, off-platform messaging, and TinyURL links. Templates create ordinary project rules, so you can remove or adjust them at any time.
Pro includes 25 rules per project. Team includes 250, and Business has no configured limit.
Turnstile for custom domains
Cloudflare Turnstile adds a browser-level bot check to portal forms without asking real visitors to solve an image puzzle. Configure it in the project domain settings with the site key and secret key from Cloudflare.
Turnstile is available when the project has a custom domain, including a domain that is still waiting for DNS or SSL verification. SupDesk stores the secret key encrypted and never reads it back into the browser. Turnstile is one layer of protection; server-side assessment and the review queue still handle submissions that reach other public entry points.
Trusted authors and retention
Team and Business plans can trust legitimate authors. A verified author with an accepted-post history can bypass discretionary heuristics, while explicit project rules still apply. This keeps repeat contributors from entering the queue every time they submit feedback.
Quarantined content stays available for a plan-specific audit window: 30 days on Free, 90 days on Pro, 365 days on Team, and indefinitely on Business. Retention cleanup applies to quarantined rows only. Published posts are not part of this cleanup.
Get started
- Open Project → Spam & moderation and review the queue.
- On Pro or higher, add rules or choose starter templates.
- If the project has a custom domain, open its domain settings and configure Turnstile.
- On Team or Business, trust repeat contributors after you confirm their activity is legitimate.
Read the Spam Protection documentation, explore the feature, or get started at supdesk.app.