Writing rules

The three kinds of rule, and the one decision that causes most bad experiences with a filter: whether a rule contributes evidence or carries its own action.

Wardnox ships knowing what a phishing link looks like. It does not ship knowing what your community talks about, and that is the part only you can supply.

Your rules are how you say it. Three kinds, all written in the dashboard, all scoped as narrowly as you like.

Contributory or explicit: the decision that matters most

Every rule you write is one of two things, and choosing wrong is the cause of most bad experiences with a filter.

A contributory rule adds evidence. On its own it may do nothing at all. It combines with everything else the engine noticed, and the message is judged on the whole picture. Use it when the pattern is suspicious.

An explicit rule carries its own action. It does not wait to be outvoted: if it matches, that action happens. Use it when the pattern is unacceptable.

Most of your rules should be contributory. An explicit action is a promise that the pattern has no innocent use in your server, and very few patterns clear that bar. free nitro does not: it appears in jokes, in complaints, and in people warning each other about the scam. send me your seed phrase does.

When two explicit rules both match, their actions are combined rather than ranked, so a rule that bans is never quietly downgraded by one that only deletes. If one asks for a delete and the other for a timeout, the member gets both, which is what configuring both plainly meant.

The three kinds

Word rules match text. They are the ones you will write most, and the match type matters more than the words: a rule that matches anywhere inside a word will find your term inside longer, innocent ones.

Pattern rules match a regular expression, for when a word list cannot express the shape of the thing. They are checked for dangerous constructions before they save, and you can test one against sample text before it goes anywhere near your members.

Domain rules allow or block a destination. Allowing is the important half: a domain on your allowlist is removed from the message before anything scores it, so a link you have approved cannot be flagged by some other rule that happens to match part of it.

Profanity, which is none of the three

Profanity filtering is separate from the rules you write, and off until you turn it on. It ships as three lists rather than one: slurs, explicit language, and ordinary swearing. Each has its own severity, its own weight and its own action.

They are separate because they are separate decisions. A server that wants slurs removed on sight very often does not want ordinary swearing touched at all, and a single switch cannot express that.

You can add your own words, which are matched as ordinary swearing.

The allow list is the one to learn first. Word lists produce false positives that no amount of curation removes: place names and surnames that contain a slur, reclaimed words used by the people they refer to, and perfectly ordinary words in other languages. Your allow list is checked before everything else and wins over everything else, including your own additions. That is what lets you keep a category switched on rather than switching it off over one word.

Two matching options, with different answers. Folding look-alike characters back is on by default, because writing it with a Cyrillic character was deliberate. Matching across removed spaces is off by default and should usually stay that way: removing spaces destroys word boundaries, and word boundaries are the only thing keeping "Scunthorpe" and "assassin" from matching. It trades a rare evasion for a common false positive.

Scope before strength

Before making a rule weaker, consider making it narrower. Every rule can be limited to particular channels or particular roles, and a rule that is right in #support and wrong in #off-topic is not a rule that needs softening. It is a rule that needs a channel list.

The same applies to who it watches. Staff are exempt from scanning by default, and you can turn that off if you would rather see everything.

Say why it exists

Every rule has a notes field. Use it. Rules outlive the person who wrote them, and the moderator who inherits an unexplained pattern has only two options: leave it alone forever, or delete it and find out what breaks.

Before you save a new rule

• Does this need its own action, or should it contribute evidence? Usually the latter.
• Is the match type right? Will it hit the term inside longer words?
• Have you tested it, including against text that should not match?
• Should it be limited to particular channels or roles?
• Is the server still in monitor mode, so you can watch it before it acts?
• Have you written down why it exists?

Next

Tuning your rules is the part people skip and then regret. It is worth reading before you write your tenth rule, not after.