Rules

Below is a list of supported Ivory rules.

Message Content Filter (message_content)

Works on: Reports, Pending Accounts

Filter moderation items based on messages.

For reports, this reads the content of the posts attached to the report.

For pending accounts, this reads the request blurb, i.e. the "why do you want to join?" message the user must type in approval-only registrations.

Fields

blocked (Array): A list of regular expressions to test messages against.

Example Configuration

This configuration disables login for users with any mention of "badword" in reported messages and pending account blurbs, and any mention of "slur", but not "slurp" (using regular expressions).

{
  "name": "No bad words",
  "type": "message_content",
  "severity": 1,
  "blocked": ["badword", "slur[^p]"],
  "punishment": {
    "type": "disable"
  }

}

Username Content Filter (username_content)

Works on: Reports, Pending Accounts

Filter moderation items based on the offending user's username.

Fields

blocked (Array): A list of regular expressions to test usernames against.

Example Configuration

This configuration suspends users with any mention of "badword" in reported users and pending accounts, and any mention of "slur", but not "slurp" (using regular expressions).

{
  "name": "No bad words",
  "type": "username_content",
  "severity": 1,
  "blocked": ["badword", "slur[^p]"],
  "punishment": {
    "type": "suspend"
  }
}

Link Content Filter (link_content)

Works on: Reports, Pending Accounts

Filter moderation items based on the text of URLs in messages.

For reports, this scans the content of the posts attached to the report for links.

For pending accounts, this reads the request blurb, i.e. the "why do you want to join?" message the user must type in approval-only registrations.

Note: This only works on clickable links, i.e. those properly surrounded in <a> tags. Almost every instance has these, but in case they don't, you may want to add a similar message_content rule that catches these out as well.

Fields

blocked (Array): A list of regular expressions to test links against.

Example Configuration

This configuration disables login for users that link to evil.website.local. Note the need for double forward slashes here - this is because the regex actually needs a literal backslash there. If you're unsure, test your regexes on regex101.

{
  "name": "No bad links",
  "type": "link_content",
  "severity": 1,
  "blocked": ["evil\\.website\\.local"],
  "punishment": {
    "type": "disable"
  }
}

Bio Content Filter (bio_content)

Works on: Reports

Filter reports based on the content of the user's bio. This also checks through fields, so you can also catch out spam phrases and links there as well.

Fields

blocked (Array): A list of regular expressions to test profile bios against.

Example Configuration

This configuration silences users with any mention of "badword" in reported users and pending accounts, and any mention of "slur", but not "slurp" (using regular expressions).

{
  "name": "No bad words",
  "type": "bio_content",
  "severity": 1,
  "blocked": ["badword", "slur[^p]"],
  "punishment": {
    "type": "silence"
  }
}

Link Resolver Filter (link_resolver)

Works on: Reports, Pending Accounts

Filter moderation items based on the resolved URLs in messages. This is different from link_content in that it tries to follow shortened links. If you encounter spammers using link shorteners, this is a good way to smoke them out.

For reports, this scans the content of the posts attached to the report for links.

For pending accounts, this reads the request blurb, i.e. the "why do you want to join?" message the user must type in approval-only registrations.

Note: This only works on clickable links, i.e. those properly surrounded in <a> tags. Almost every instance has these, but in case they don't, you may want to add a similar message_content rule that catches these out as well.

Fields

blocked (Array): A list of regular expressions to test links against.

Example Configuration

This configuration disables login for users that link to evil.website.local OR a URL shortener that links to evil.website.local. Note the need for double forward slashes here - this is because the regex actually needs a literal backslash there to say "yes, we mean an actual period, not 'any character' as it usually means in regex".

{
  "name": "No bad links",
  "type": "link_resolver",
  "severity": 1,
  "blocked": ["evil\\.website\\.local"],
  "punishment": {
    "type": "disable"
  }
}

StopForumSpam.com Checker (stopforumspam)

Works on: Pending Accounts

Check pending accounts' IPs and email addresses against the StopForumSpam.com database, and let Ivory handle them if their calculated spam confidence is above a certain threshold. This is a good way to magically catch out certain spammers, even if their overall information looks legit.

Note: If the API returns IP spam confidence and e-mail spam confidence, it compares the average of the two confidence levels against the threshold.

Fields

threshold (Number, 0-100): Threshold at which Ivory should take action. I recommend setting this somewhere above 90 to avoid false positives, but if you want to be better safe than sorry, then a lower confidence level of 80 or so might be okay.

Example Configuration

This configuration rejects any pending accounts which StopForumSpam reports a 90% or above spam confidence level for.

{
  "name": "No spam accounts",
  "type": "stopforumspam",
  "severity": 1,
  "threshold": 90,
  "punishment": {
    "type": "reject"
  }
}