Security and spam

Quipthread applies several layers of protection before a comment is stored. This page describes what is built in and how to handle threats that are better addressed at the infrastructure level.

Built-in protections

Rate limiting

Comment submissions are rate-limited per IP address. The default is 5 submissions per 10 minutes. Self-hosters can adjust this via the RATE_LIMIT_COMMENTS environment variable (format: count/duration, e.g. 10/5m).

Heuristic spam detection

Every comment passes through a heuristic check before being stored. Comments are auto-rejected if they:

Contain fewer than 2 characters of plain text
Exceed 10,000 bytes of submitted content
Contain dangerous HTML (<script>, <iframe>, javascript:, etc.)
Exceed the configured link density threshold (SPAM_MAX_LINKS)
Contain a run of 10 or more identical characters

Auto-rejected comments are saved with rejected status so you have an audit trail. The author sees “awaiting approval” rather than an error.

Blocked terms

The Mod Rules tab lets you maintain a list of blocked terms. Any comment containing a blocked term is auto-rejected on submission. See Moderation for details.

Cloudflare Turnstile

Turnstile adds a bot challenge before the comment form is submitted. Configure your site key and secret key in the dashboard under Account → Security. The widget obtains a challenge token in the browser, and the backend verifies it before accepting the comment.

User banning and shadow banning

Individual users can be banned (hard block) or shadow banned (they see their own comments, other users do not) from the Users tab. Shadow banning is effective against persistent bad actors who would simply create a new account after a hard ban.

IP-level blocking

Quipthread does not maintain an in-app IP blocklist. IP blocking is deliberately handled at the infrastructure layer, where it is more effective (blocked requests never reach the application) and more powerful.

Cloud (managed)

For infrastructure-level abuse affecting your cloud instance, contact support. Use the dashboard to ban individual commenters. Blocking a visitor on your own website does not necessarily block direct requests to the comment service.

Self-hosted

Block IPs at your reverse proxy or firewall before traffic reaches the Quipthread container.

Caddy

@blocked {
    remote_ip 203.0.113.42 198.51.100.0/24
}
respond @blocked 403

nginx

deny 203.0.113.42;
deny 198.51.100.0/24;

Cloudflare (in front of self-hosted)

If you proxy your self-hosted instance through Cloudflare, you can use Cloudflare Firewall Rules or WAF Custom Rules to block by IP, country, ASN, or threat score — without touching your server configuration.