Spam protection

Guest commenting only works if spam is handled well, and most solutions handle it by taxing the reader: CAPTCHAs, forced accounts, or sending every comment to a third-party classification service. Connect does neither. All filtering happens server-side, on our EU infrastructure, with no external spam service involved.

What runs on every submission

Several checks run on every comment before it is stored:

• Honeypot. The form contains a field invisible to humans. Bots that fill every field reveal themselves, and their submissions are discarded as spam.
• Timing. The widget receives a signed challenge when it loads, and a comment submitted suspiciously fast after that is rejected. Humans read before they reply; most bots do not.
• Rate limiting. Submissions are rate limited per IP address, with a short-window limit and a daily cap. The IP is hashed before use and never stored in clear, see Privacy and data.
• Link count. A comment containing more than two links is held for moderation regardless of your moderation mode. Link stuffing is the one constant of comment spam; legitimate readers rarely need three URLs to make a point.
• Blocked keywords. Your per-site keyword list, one word per line under Site settings. A comment containing any of them is marked as spam directly. This is your local knowledge encoded: the vocabulary that spam on your topic and in your language reliably uses.

Comments caught as spam do not generate a notification email, do not appear in the widget, and land in the Spam tab of the moderation queue, where you can review them and rescue false positives.

What this means in practice

• Readers never see a CAPTCHA, never create an account, and never wait for a third-party check.
• Auto-publish is never unfiltered. Even with moderation off, the checks above run first, and link-heavy comments still wait for you.
• Spam filtering is included on every plan, free included. A comment section overrun by spam is broken, and basic safety is not something we sell back to you.

When spam gets through

No heuristic catches everything. When something slips past:

1. Mark it as spam from the moderation queue (bulk selection works).
2. If the spam wave shares vocabulary, add the recurring terms to your blocked keywords.
3. If it keeps coming, switch to Moderate new authors only: it stops every new author at the door, while your regulars keep commenting freely.

The combination of blocked keywords and new-author moderation shuts down almost any sustained spam campaign at the cost of a few approval clicks.