Writing rules

The three kinds of rule, and the one decision that causes most bad experiences with a filter: whether a rule contributes evidence or carries its own action.

Wardnox ships knowing what a phishing link looks like. It does not ship knowing what your community talks about, and that is the part only you can supply.

Your rules are how you say it. Three kinds, all written in the dashboard, all scoped as narrowly as you like.

Contributory or explicit: the decision that matters most

Every rule you write is one of two things, and choosing wrong is the cause of most bad experiences with a filter.

A contributory rule adds evidence. On its own it may do nothing at all. It combines with everything else the engine noticed, and the message is judged on the whole picture. Use it when the pattern is suspicious.

An explicit rule carries its own action. It does not wait to be outvoted: if it matches, that action happens. Use it when the pattern is unacceptable.

Most of your rules should be contributory. An explicit action is a promise that the pattern has no innocent use in your server, and very few patterns clear that bar. free nitro does not: it appears in jokes, in complaints, and in people warning each other about the scam. send me your seed phrase does.

When two explicit rules both match, the stronger action wins, so a rule that bans is never quietly downgraded by one that only deletes.

The three kinds

Word rules match text. They are the ones you will write most, and the match type matters more than the words: a rule that matches anywhere inside a word will find your term inside longer, innocent ones.

Pattern rules match a regular expression, for when a word list cannot express the shape of the thing. They are checked for dangerous constructions before they save, and you can test one against sample text before it goes anywhere near your members.

Domain rules allow or block a destination. Allowing is the important half: a domain on your allowlist is removed from the message before anything scores it, so a link you have approved cannot be flagged by some other rule that happens to match part of it.

Scope before strength

Before making a rule weaker, consider making it narrower. Every rule can be limited to particular channels or particular roles, and a rule that is right in #support and wrong in #off-topic is not a rule that needs softening. It is a rule that needs a channel list.

The same applies to who it watches. Staff are exempt from scanning by default, and you can turn that off if you would rather see everything.

Say why it exists

Every rule has a notes field. Use it. Rules outlive the person who wrote them, and the moderator who inherits an unexplained pattern has only two options: leave it alone forever, or delete it and find out what breaks.

Before you save a new rule

• Does this need its own action, or should it contribute evidence? Usually the latter.
• Is the match type right? Will it hit the term inside longer words?
• Have you tested it, including against text that should not match?
• Should it be limited to particular channels or roles?
• Is the server still in monitor mode, so you can watch it before it acts?
• Have you written down why it exists?

Next

Tuning your rules is the part people skip and then regret. It is worth reading before you write your tenth rule, not after.