Disclaimer:
All tips and suggestions here are provided without any liability/warranty and are not legal advice.
For legal advice contact a lawyer.
This guide contains suggestions of actions and practises that may help when dealing with abuse.
Immediate actions
Notify server and room admins
Try contacting the administrators of the spamming account's homeserver
The most effective way to stop spam is to have the account of the spamming user deactivated. Try to contact the server administrator via contact information from MSC1929.
Contact the administrators and moderators of the room that gets spammed
This can be very tedious especially if the spammer moves on to another room after being banned. This also won't scale and is therefore not a viable option for larger homeservers with many users in many rooms.
Clean-up the spam
Delete remote media
Synapse
Use the "Purge remote Media" admin API to delete all media from remote servers.
💡 This is not as destructive as it sounds; media like avatars or other images in chats will be re-downloaded from the original server as soon as a client requests it again. You're only deleting your server's local cache
Example cURL command
curl -X POST 'https://your-homeserver-url/_synapse/admin/v1/purge_media_cache?before_ts=1800000000000' \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
Conduwuit / Continuwuity
Use the media admin command in your admin room to delete all media from one specific remote server.
!admin media delete-all-from-server <server name>
Use the media admin command in your admin room to delete all media from all remote servers.
!admin media delete-past-remote-media --after 8h
The above command will delete all remote media from the past 8 hours.
💡 This is not as destructive as it sounds; media like avatars or other images in chats will be re-downloaded from the original server as soon as a client requests it again. You're only deleting your server's local cache
Conduit
Conduit currently has no way of deleting media
Precautions
Media handling
Synapse
Set up remote media retention
Use the "media_retention" config options and configure the remote media lifetime.
Exclude remote media from your backups
In the directory that is configure in "media_store_path" there is a sub-directory named "remote_content". You should exclude this from your backups to prevent possibly illegal material from making its way into your backups (if you restore from backup, you will have to use the "Purge remote Media" admin API" to tell Synapse that the media is gone - otherwise your remote media will be broken).
Conduwuit
Placeholder
Conduit
Placeholder
Check what's happening on your server
Synapse
Check the rooms
Most of the time the illegal content is unwanted but some of your users might intentionally participate in rooms with the sole purpose of distributing illegal content. In that case the best way to prevent illegal content on your server is to deactivate those user accounts and blocking the questionable rooms to prevent your users from joining them in the first place.
List rooms via the "list_rooms" API, block rooms via the "block-room" API and deactivate accounts with the "Deactivate account" admin API.
Alternatively use Synapse Admin for all of these tasks.
Conduwuit
Placeholder
Conduit
Placeholder
Block invites from abusers serverwide
Synapse
Block invites with Draupnir
Spammers will often try to invite users to rooms with horrific room names and room avatars to shock and / or insult your users.
By installing Draupnir and also setting up the Synapse http antispam module you can block invites based on policy lists for all users on your server.
For detailed instructions visit the Draupnir documentation.
Conduwuit
Placeholder
Conduit
Placeholder
I need help with all of this!
Don't worry, it can be a bit overwhelming in the beginning, but luckily most of the tools/projects which are covered in this guide have support rooms on Matrix or other documentation online.
Synapse administration
Online documentation:
The online documentation for Synapse can be found here: Docs
Support rooms on matrix:
There is Synapse Admins (Community Edition) which is run and managed by the community itself.
There is Synapse Admins which is run and managed by matrix.org.
Conduit administration
Online documentation:
The online documentation for conduit can be found here: Docs
Support rooms on matrix:
There is Conduit Matrix Server.
Continuwuity / Conduwuit administration
Conduwuit is dead, you may wish to take a look at Continuwuity
Online documentation:
The online documentation for Continuwuity can be found here: Docs
Support rooms on matrix:
There is Continuwuity.
Moderation Bots
Draupnir
Online documentation: Docs
Support room on matrix: #draupnir:matrix.org
Meowlnir
Online documentation: Docs
Support room on matrix: #meowlnir:maunium.net
Mjolnir
Online documentation: Docs
Support room on matrix: #mjolnir:matrix.org
Webinterfaces
Synapse Admins Webapp
Online documentation: Docs
Support room on matrix: #synapse-admin:etke.cc