From da876d7e90bad6d92b8b6691797402a512988f4b Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Tue, 10 Feb 2026 16:33:18 +0100
Subject: [PATCH 01/16] feat: allow blocking users

---
 .../UserSpam/MarkSpamStatusButton.tsx         |  47 ++++++
 .../SuperAdminDashboard/UserSpam/UserSpam.tsx | 104 ++++++++++++
 .../UserSpam/UserSpamEntry.tsx                | 150 ++++++++++++++++++
 .../SuperAdminDashboard/UserSpam/filters.ts   |  45 ++++++
 .../SuperAdminDashboard/UserSpam/index.ts     |   1 +
 .../SuperAdminDashboard/UserSpam/types.ts     |   3 +
 .../UserSpam/useSpamUsers.ts                  |  59 +++++++
 .../UserSpam/userSpam.scss                    |  20 +++
 .../UserSpam/userSpamEntry.scss               |  53 +++++++
 .../containers/SuperAdminDashboard/tabs.tsx   |   5 +
 server/routes/superAdminDashboard.tsx         |  16 ++
 server/spamTag/api.ts                         | 115 ++++++++++++++
 server/spamTag/uploadScamKeywords.ts          |  19 +++
 server/spamTag/userQueries.ts                 |  86 ++++++++++
 server/spamTag/userScore.ts                   |  79 +++++++++
 server/spamTag/users.ts                       |  60 +++++++
 server/upload/api.ts                          |  27 +++-
 server/uploadPolicy/api.ts                    |  27 +++-
 server/uploadPolicy/queries.ts                |  11 +-
 server/user/model.ts                          |   8 +
 server/utils/email/index.ts                   |   1 +
 server/utils/email/spam.ts                    |  51 ++++++
 server/utils/session.ts                       |  18 +++
 server/utils/slack.ts                         |  32 ++++
 .../migrations/2026_02_10_addSpamTagToUser.js |  10 ++
 types/request.ts                              |   7 +
 types/spam.ts                                 |  18 +++
 types/user.ts                                 |   2 +
 utils/api/contract.ts                         |   5 +
 utils/api/contracts/auth.ts                   |   3 +
 utils/api/contracts/publicPermissions.ts      |  23 +++
 utils/api/contracts/upload.ts                 |   2 +
 utils/api/server.ts                           |   2 +
 utils/superAdmin.ts                           |   2 +-
 34 files changed, 1107 insertions(+), 4 deletions(-)
 create mode 100644 client/containers/SuperAdminDashboard/UserSpam/MarkSpamStatusButton.tsx
 create mode 100644 client/containers/SuperAdminDashboard/UserSpam/UserSpam.tsx
 create mode 100644 client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
 create mode 100644 client/containers/SuperAdminDashboard/UserSpam/filters.ts
 create mode 100644 client/containers/SuperAdminDashboard/UserSpam/index.ts
 create mode 100644 client/containers/SuperAdminDashboard/UserSpam/types.ts
 create mode 100644 client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts
 create mode 100644 client/containers/SuperAdminDashboard/UserSpam/userSpam.scss
 create mode 100644 client/containers/SuperAdminDashboard/UserSpam/userSpamEntry.scss
 create mode 100644 server/spamTag/uploadScamKeywords.ts
 create mode 100644 server/spamTag/userQueries.ts
 create mode 100644 server/spamTag/userScore.ts
 create mode 100644 server/spamTag/users.ts
 create mode 100644 server/utils/email/spam.ts
 create mode 100644 server/utils/session.ts
 create mode 100644 tools/migrations/2026_02_10_addSpamTagToUser.js
 create mode 100644 utils/api/contracts/publicPermissions.ts

diff --git a/client/containers/SuperAdminDashboard/UserSpam/MarkSpamStatusButton.tsx b/client/containers/SuperAdminDashboard/UserSpam/MarkSpamStatusButton.tsx
new file mode 100644
index 0000000000..150b5535f4
--- /dev/null
+++ b/client/containers/SuperAdminDashboard/UserSpam/MarkSpamStatusButton.tsx
@@ -0,0 +1,47 @@
+import type { SpamStatus } from 'types';
+
+import React, { useCallback, useState } from 'react';
+
+import { Button } from '@blueprintjs/core';
+
+import { apiFetch } from 'client/utils/apiFetch';
+
+type Props = {
+	userId: string;
+	status: SpamStatus;
+	onStatusChanged: (status: SpamStatus) => unknown;
+};
+
+const propsForStatuses: Record<SpamStatus, Partial<React.ComponentProps<typeof Button>>> = {
+	'confirmed-not-spam': {
+		icon: 'tick',
+		children: 'Not spam',
+	},
+	'confirmed-spam': {
+		icon: 'cross',
+		intent: 'danger',
+		children: 'Spam',
+	},
+	unreviewed: {
+		icon: 'undo',
+		children: 'Mark unreviewed',
+	},
+};
+
+const MarkSpamStatusButton = (props: Props) => {
+	const { status, userId, onStatusChanged } = props;
+	const [isLoading, setIsLoading] = useState(false);
+
+	const handleClick = useCallback(async () => {
+		setIsLoading(true);
+		await apiFetch.put('/api/spamTags/user', { status, userId });
+		setIsLoading(false);
+		onStatusChanged(status);
+	}, [status, userId, onStatusChanged]);
+
+	return (
+		<Button minimal loading={isLoading} onClick={handleClick} {...propsForStatuses[status]} />
+	);
+};
+
+export default MarkSpamStatusButton;
diff --git a/client/containers/SuperAdminDashboard/UserSpam/UserSpam.tsx b/client/containers/SuperAdminDashboard/UserSpam/UserSpam.tsx
new file mode 100644
index 0000000000..30813fabdc
--- /dev/null
+++ b/client/containers/SuperAdminDashboard/UserSpam/UserSpam.tsx
@@ -0,0 +1,104 @@
+import type { SpamUser } from './types';
+
+import React, { useCallback, useState } from 'react';
+
+import { Button, InputGroup, Spinner } from '@blueprintjs/core';
+import { useUpdateEffect } from 'react-use';
+
+import { apiFetch } from 'client/utils/apiFetch';
+import { OverviewSearchGroup } from 'client/containers/DashboardOverview/helpers';
+import { useInfiniteScroll } from 'client/utils/useInfiniteScroll';
+
+import { filters, filtersById } from './filters';
+import UserSpamEntry from './UserSpamEntry';
+import { useSpamUsers } from './useSpamUsers';
+
+import './userSpam.scss';
+
+type Props = {
+	users: SpamUser[];
+	searchTerm: null | string;
+};
+
+const UserSpam = (props: Props) => {
+	const { users: initialUsers, searchTerm: initialSearchTerm } = props;
+	const [filter, setFilter] = useState(filtersById[initialSearchTerm ? 'recent' : 'unreviewed']);
+	const [searchTerm, setSearchTerm] = useState(initialSearchTerm ?? '');
+	const [addIdentifier, setAddIdentifier] = useState('');
+	const [addError, setAddError] = useState<string | null>(null);
+	const [addLoading, setAddLoading] = useState(false);
+
+	const { users, isLoading, loadMoreUsers, mayLoadMoreUsers, prependUser } = useSpamUsers({
+		limit: 50,
+		searchTerm,
+		initialUsers,
+		filter,
+	});
+
+	useInfiniteScroll({
+		scrollTolerance: 0,
+		useDocumentElement: true,
+		onRequestMoreItems: loadMoreUsers,
+		enabled: mayLoadMoreUsers,
+	});
+
+	useUpdateEffect(() => {
+		const nextSearchPart = searchTerm ? `?q=${searchTerm}` : '';
+		window.history.replaceState({}, '', window.location.pathname + nextSearchPart);
+	}, [searchTerm]);
+
+	const handleAddUser = useCallback(async () => {
+		const trimmed = addIdentifier.trim();
+		if (!trimmed) return;
+		setAddError(null);
+		setAddLoading(true);
+		try {
+			const user = await apiFetch.post('/api/spamTags/addUser', { identifier: trimmed });
+			prependUser(user);
+			setAddIdentifier('');
+		} catch (err: any) {
+			const msg = err?.body?.error ?? err?.message ?? 'Failed to add user';
+			setAddError(msg);
+		} finally {
+			setAddLoading(false);
+		}
+	}, [addIdentifier, prependUser]);
+
+	return (
+		<div className="user-spam-component">
+			<OverviewSearchGroup
+				filters={filters}
+				placeholder="Search for users (name, email, slug)..."
+				onUpdateSearchTerm={(t) => t === '' && setSearchTerm(t)}
+				onCommitSearchTerm={setSearchTerm}
+				onChooseFilter={setFilter}
+				filter={filter}
+				initialSearchTerm={initialSearchTerm ?? undefined}
+				rightControls={isLoading && <Spinner size={20} />}
+			/>
+			<div className="add-user-row">
+				<InputGroup
+					placeholder="Add user by email, slug, or ID"
+					value={addIdentifier}
+					onChange={(e) => setAddIdentifier(e.target.value)}
+					onKeyDown={(e) => e.key === 'Enter' && handleAddUser()}
+					disabled={addLoading}
+				/>
+				<Button
+					text="Add user"
+					onClick={handleAddUser}
+					loading={addLoading}
+					disabled={!addIdentifier.trim()}
+				/>
+			</div>
+			{addError && <p className="add-user-error">{addError}</p>}
+			<div className="users">
+				{users.map((user) => (
+					<UserSpamEntry user={user} key={user.id} />
+				))}
+			</div>
+		</div>
+	);
+};
+
+export default UserSpam;
diff --git a/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx b/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
new file mode 100644
index 0000000000..4e33257f7f
--- /dev/null
+++ b/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
@@ -0,0 +1,150 @@
+import type { SpamStatus } from 'types';
+
+import React, { useMemo, useState } from 'react';
+
+import { ButtonGroup, type Intent, Tag } from '@blueprintjs/core';
+
+import { formatDate } from 'utils/dates';
+
+import MarkSpamStatusButton from './MarkSpamStatusButton';
+
+import './userSpamEntry.scss';
+
+import type { SpamUser } from './types';
+
+type Props = {
+	user: SpamUser;
+};
+
+const getIntentForSpamScore = (spamScore: number): Intent => {
+	if (spamScore > 3) {
+		return 'danger';
+	}
+	if (spamScore > 1) {
+		return 'warning';
+	}
+	return 'none';
+};
+
+const UserSpamEntry = (props: Props) => {
+	const { user } = props;
+	const { fullName, email, slug, createdAt, spamTag } = user;
+	const { spamScore, status: initialStatus, fields } = spamTag;
+	const [status, setUpdatedStatus] = useState<null | SpamStatus>(initialStatus);
+
+	const fieldsJsonString = useMemo(() => JSON.stringify(fields, null, 2), [fields]);
+
+	const renderFieldsReport = () => {
+		return (
+			<div className="fields-report">
+				<details>
+					<summary>Matched fields</summary>
+					<code>
+						<pre>{fieldsJsonString}</pre>
+					</code>
+				</details>
+			</div>
+		);
+	};
+
+	const renderStatusTag = () => {
+		if (status === 'unreviewed') {
+			return <Tag minimal>Unreviewed</Tag>;
+		}
+		if (status === 'confirmed-spam') {
+			return (
+				<Tag intent="danger" icon="cross">
+					Confirmed spam
+				</Tag>
+			);
+		}
+		return (
+			<Tag intent="success" icon="tick">
+				Confirmed not spam
+			</Tag>
+		);
+	};
+
+	const renderActions = () => {
+		if (status === 'unreviewed') {
+			return (
+				<ButtonGroup>
+					<MarkSpamStatusButton
+						userId={user.id}
+						status="confirmed-not-spam"
+						onStatusChanged={setUpdatedStatus}
+					/>
+					<MarkSpamStatusButton
+						userId={user.id}
+						status="confirmed-spam"
+						onStatusChanged={setUpdatedStatus}
+					/>
+				</ButtonGroup>
+			);
+		}
+		return (
+			<MarkSpamStatusButton
+				userId={user.id}
+				status="unreviewed"
+				onStatusChanged={setUpdatedStatus}
+			/>
+		);
+	};
+
+	const renderSuspiciousFiles = () => {
+		return (
+			<div className="suspicious-files">
+				<h3>Suspicious files</h3>
+				<ul>
+					{fields.suspiciousFiles.map((file) => (
+						<li key={file}>
+							<a
+								href={`https://pubpub.org/uploads/${file}`}
+								target="_blank"
+								rel="noopener noreferrer"
+							>
+								{file}
+							</a>
+						</li>
+					))}
+				</ul>
+			</div>
+		);
+	};
+
+	const renderSuspiciousComments = () => {
+		return (
+			<div className="suspicious-comments">
+				<h3>Suspicious comments</h3>
+				<ul>
+					{fields.suspiciousComments.map((comment) => (
+						<li key={comment}>{comment}</li>
+					))}
+				</ul>
+			</div>
+		);
+	};
+
+	return (
+		<div className="user-spam-entry-component">
+			<div className="title">
+				<span className="name">{fullName}</span>
+				{email && <span className="email">{email}</span>}
+				{slug && <span className="slug">@{slug}</span>}
+			</div>
+			{Object.keys(fields).length > 0 && renderFieldsReport()}
+			{fields?.suspiciousFiles?.length > 0 && renderSuspiciousFiles()}
+			{fields?.suspiciousComments?.length > 0 && renderSuspiciousComments()}
+			<div className="details">
+				<div className="tags">
+					{renderStatusTag()}
+					<Tag intent={getIntentForSpamScore(spamScore)}>Spam score: {spamScore}</Tag>
+					<Tag minimal>Created: {formatDate(createdAt)}</Tag>
+				</div>
+				<div className="actions">{renderActions()}</div>
+			</div>
+		</div>
+	);
+};
+
+export default UserSpamEntry;
diff --git a/client/containers/SuperAdminDashboard/UserSpam/filters.ts b/client/containers/SuperAdminDashboard/UserSpam/filters.ts
new file mode 100644
index 0000000000..76610fa888
--- /dev/null
+++ b/client/containers/SuperAdminDashboard/UserSpam/filters.ts
@@ -0,0 +1,45 @@
+import type { OverviewSearchFilter } from 'client/containers/DashboardOverview/helpers/filters';
+import type { SpamUserQuery } from 'types';
+
+import { indexById } from 'utils/arrays';
+
+export type SpamUsersFilter = OverviewSearchFilter<
+	Pick<SpamUserQuery, 'status' | 'ordering'>
+>;
+
+export const filters: SpamUsersFilter[] = [
+	{
+		title: 'Unreviewed',
+		id: 'unreviewed',
+		query: {
+			ordering: { field: 'spam-score', direction: 'DESC' },
+			status: ['unreviewed'],
+		},
+	},
+	{
+		title: 'Recently created',
+		id: 'recent',
+		query: {
+			ordering: { field: 'user-created-at', direction: 'DESC' },
+			status: ['unreviewed', 'confirmed-not-spam', 'confirmed-spam'],
+		},
+	},
+	{
+		title: 'Confirmed spam',
+		id: 'spam',
+		query: {
+			ordering: { field: 'spam-status-updated-at', direction: 'DESC' },
+			status: ['confirmed-spam'],
+		},
+	},
+	{
+		title: 'Confirmed not spam',
+		id: 'not-spam',
+		query: {
+			ordering: { field: 'spam-status-updated-at', direction: 'DESC' },
+			status: ['confirmed-not-spam'],
+		},
+	},
+];
+
+export const filtersById = indexById(filters);
diff --git a/client/containers/SuperAdminDashboard/UserSpam/index.ts b/client/containers/SuperAdminDashboard/UserSpam/index.ts
new file mode 100644
index 0000000000..da97cf010b
--- /dev/null
+++ b/client/containers/SuperAdminDashboard/UserSpam/index.ts
@@ -0,0 +1 @@
+export { default } from './UserSpam';
diff --git a/client/containers/SuperAdminDashboard/UserSpam/types.ts b/client/containers/SuperAdminDashboard/UserSpam/types.ts
new file mode 100644
index 0000000000..fa388c1eff
--- /dev/null
+++ b/client/containers/SuperAdminDashboard/UserSpam/types.ts
@@ -0,0 +1,3 @@
+import type { DefinitelyHas, UserWithPrivateFields } from 'types';
+
+export type SpamUser = DefinitelyHas<UserWithPrivateFields, 'spamTag'>;
diff --git a/client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts b/client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts
new file mode 100644
index 0000000000..0ca2aad21e
--- /dev/null
+++ b/client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts
@@ -0,0 +1,59 @@
+import type { SpamUsersFilter } from './filters';
+import type { SpamUser } from './types';
+
+import { useCallback, useState } from 'react';
+
+import { useUpdateEffect } from 'react-use';
+import useStateRef from 'react-usestateref';
+
+import { apiFetch } from 'client/utils/apiFetch';
+import { unique } from 'utils/arrays';
+
+type UseSpamUsersOptions = {
+	filter: SpamUsersFilter;
+	searchTerm: string;
+	initialUsers: SpamUser[];
+	limit: number;
+};
+
+export const useSpamUsers = (options: UseSpamUsersOptions) => {
+	const { searchTerm, filter, limit, initialUsers } = options;
+	const [_, setOffset, offsetRef] = useStateRef(initialUsers.length);
+	const [isLoading, setIsLoading] = useState(false);
+	const [mayLoadMoreUsers, setMayLoadMoreUsers] = useState(true);
+	const [users, setUsers] = useState(initialUsers);
+
+	const loadMoreUsers = useCallback(async () => {
+		const currentOffset = offsetRef.current;
+		setIsLoading(true);
+		setMayLoadMoreUsers(false);
+		setOffset((offset) => offset + limit);
+		const { status, ordering } = filter.query!;
+		const nextUsers = await apiFetch.post('/api/spamTags/queryUsersForSpam', {
+			limit,
+			searchTerm,
+			offset: currentOffset,
+			status,
+			ordering,
+		});
+		setIsLoading(false);
+		setTimeout(() => setMayLoadMoreUsers(nextUsers.length === limit), 0);
+		setUsers((currentUsers) => unique([...currentUsers, ...nextUsers], (u) => u.id));
+	}, [filter.query, limit, searchTerm, offsetRef, setOffset]);
+
+	useUpdateEffect(() => {
+		setOffset(0);
+		setUsers([]);
+		loadMoreUsers();
+	}, [setOffset, loadMoreUsers, filter]);
+
+	const prependUser = useCallback((user: SpamUser) => {
+		setUsers((current) => {
+			const seen = new Set(current.map((u) => u.id));
+			if (seen.has(user.id)) return current;
+			return [user, ...current];
+		});
+	}, []);
+
+	return { users, isLoading, loadMoreUsers, mayLoadMoreUsers, prependUser };
+};
diff --git a/client/containers/SuperAdminDashboard/UserSpam/userSpam.scss b/client/containers/SuperAdminDashboard/UserSpam/userSpam.scss
new file mode 100644
index 0000000000..20d76c25b3
--- /dev/null
+++ b/client/containers/SuperAdminDashboard/UserSpam/userSpam.scss
@@ -0,0 +1,20 @@
+.user-spam-component {
+	.add-user-row {
+		display: flex;
+		gap: 8px;
+		align-items: center;
+		margin-top: 10px;
+		width: 100%;
+		max-width: 400px;
+	}
+	.add-user-error {
+		margin-top: 6px;
+		color: var(--pt-intent-danger);
+	}
+	.users {
+		margin-top: 10px;
+		> :not(:last-child) {
+			margin-bottom: 5px;
+		}
+	}
+}
diff --git a/client/containers/SuperAdminDashboard/UserSpam/userSpamEntry.scss b/client/containers/SuperAdminDashboard/UserSpam/userSpamEntry.scss
new file mode 100644
index 0000000000..484fe86058
--- /dev/null
+++ b/client/containers/SuperAdminDashboard/UserSpam/userSpamEntry.scss
@@ -0,0 +1,53 @@
+.user-spam-entry-component {
+	border-radius: 2px;
+	border: 1px solid #eee;
+	padding: 10px;
+
+	& > *:not(:last-child) {
+		margin-bottom: 6px;
+	}
+
+	.title {
+		font-size: 16px;
+		font-weight: 500;
+		display: flex;
+		flex-wrap: wrap;
+		gap: 8px;
+		align-items: baseline;
+
+		.name {
+			font-weight: 600;
+		}
+		.email {
+			color: #666;
+			font-size: 14px;
+		}
+		.slug {
+			color: #888;
+			font-size: 14px;
+		}
+	}
+
+	.fields-report {
+		details > summary {
+			user-select: none;
+		}
+		pre {
+			background: #eee;
+			padding: 5px;
+		}
+	}
+
+	.details {
+		display: flex;
+		justify-content: space-between;
+		align-items: end;
+		> .tags {
+			display: flex;
+			flex-wrap: wrap;
+			& > *:not(:last-child) {
+				margin-right: 4px;
+			}
+		}
+	}
+}
diff --git a/client/containers/SuperAdminDashboard/tabs.tsx b/client/containers/SuperAdminDashboard/tabs.tsx
index 746b544c31..8189500d6f 100644
--- a/client/containers/SuperAdminDashboard/tabs.tsx
+++ b/client/containers/SuperAdminDashboard/tabs.tsx
@@ -4,6 +4,7 @@ import React from 'react';
 
 import CommunitySpam from './CommunitySpam';
 import LandingPageFeatures from './LandingPageFeatures';
+import UserSpam from './UserSpam';
 
 type SuperAdminTab = {
 	title: string;
@@ -19,4 +20,8 @@ export const superAdminTabs: Record<SuperAdminTabKind, SuperAdminTab> = {
 		title: 'Spam Communities',
 		component: CommunitySpam,
 	},
+	spamUsers: {
+		title: 'Spam Users',
+		component: UserSpam,
+	},
 };
diff --git a/server/routes/superAdminDashboard.tsx b/server/routes/superAdminDashboard.tsx
index fe6cc1c5c7..6c916ed996 100644
--- a/server/routes/superAdminDashboard.tsx
+++ b/server/routes/superAdminDashboard.tsx
@@ -5,9 +5,11 @@ import React from 'react';
 import { Router } from 'express';
 
 import { filtersById as spamFiltersById } from 'client/containers/SuperAdminDashboard/CommunitySpam/filters';
+import { filtersById as spamUsersFiltersById } from 'client/containers/SuperAdminDashboard/UserSpam/filters';
 import Html from 'server/Html';
 import { getLandingPageFeatures } from 'server/landingPageFeature/queries';
 import { queryCommunitiesForSpamManagement } from 'server/spamTag/communities';
+import { queryUsersForSpamManagement } from 'server/spamTag/users';
 import { ForbiddenError, handleErrors, NotFoundError } from 'server/utils/errors';
 import { getInitialData } from 'server/utils/initData';
 import { generateMetaComponents, renderToNodeStream } from 'server/utils/ssr';
@@ -36,6 +38,20 @@ const getTabProps = async (tabKind: SuperAdminTabKind, locationData: types.Locat
 			}),
 		};
 	}
+	if (tabKind === 'spamUsers') {
+		const searchTerm = locationData.query.q ?? null;
+		const { query } = spamUsersFiltersById[searchTerm ? 'recent' : 'unreviewed'];
+		const users = await queryUsersForSpamManagement({
+			limit: 50,
+			searchTerm,
+			...query!,
+		});
+		console.log('users', users);
+		return {
+			searchTerm,
+			users,
+		};
+	}
 	return {};
 };
 
diff --git a/server/spamTag/api.ts b/server/spamTag/api.ts
index b59df086b0..f18814fd7c 100644
--- a/server/spamTag/api.ts
+++ b/server/spamTag/api.ts
@@ -1,12 +1,17 @@
 import { Router } from 'express';
 
+import { SpamTag, User } from 'server/models';
+import { sendSpamBanEmail, sendSpamLiftedEmail } from 'server/utils/email';
 import { ForbiddenError } from 'server/utils/errors';
+import { deleteSessionsForUser } from 'server/utils/session';
 import { wrap } from 'server/wrap';
 import { expect } from 'utils/assert';
 
 import { queryCommunitiesForSpamManagement } from './communities';
 import { canManipulateSpamTags } from './permissions';
 import { updateSpamTagForCommunity } from './queries';
+import { addSpamTagToUser, getSpamTagForUser, updateSpamTagForUser } from './userQueries';
+import { queryUsersForSpamManagement } from './users';
 
 export const router = Router();
 
@@ -23,6 +28,51 @@ router.put(
 	}),
 );
 
+router.put(
+	'/api/spamTags/user',
+	wrap(async (req, res) => {
+		const { userId, status } = req.body;
+		const canUpdate = await canManipulateSpamTags({ userId: req.user?.id });
+		if (!canUpdate) {
+			throw new ForbiddenError();
+		}
+		const existingTag = await getSpamTagForUser(userId);
+		if (!existingTag) {
+			await addSpamTagToUser(userId);
+		}
+		await updateSpamTagForUser({ userId, status });
+		const user = await User.findOne({
+			where: { id: userId },
+			attributes: ['email', 'fullName'],
+		});
+
+		if (user?.email) {
+			try {
+				if (status === 'confirmed-spam') {
+					try {
+						await deleteSessionsForUser(user?.email ?? '');
+					} catch (err) {
+						console.error('Failed to delete sessions for banned user', userId, err);
+					}
+
+					await sendSpamBanEmail({
+						toEmail: user.email,
+						userName: user.fullName ?? '',
+					});
+				} else if (status === 'confirmed-not-spam') {
+					await sendSpamLiftedEmail({
+						toEmail: user.email,
+						userName: user.fullName ?? '',
+					});
+				}
+			} catch (err) {
+				console.error('Failed to send spam status email', err);
+			}
+		}
+		return res.status(200).send({});
+	}),
+);
+
 router.post('/api/spamTags/queryCommunitiesForSpam', async (req, res) => {
 	const { offset, limit, searchTerm, status, ordering } = req.body;
 	const canQuery = await canManipulateSpamTags({
@@ -40,3 +90,68 @@ router.post('/api/spamTags/queryCommunitiesForSpam', async (req, res) => {
 	});
 	return res.status(200).send(queryResult);
 });
+
+router.post(
+	'/api/spamTags/addUser',
+	wrap(async (req, res) => {
+		const canAdd = await canManipulateSpamTags({ userId: req.user?.id });
+		if (!canAdd) {
+			throw new ForbiddenError();
+		}
+		const { identifier } = req.body;
+		if (!identifier || typeof identifier !== 'string') {
+			return res.status(400).send({ error: 'identifier required' });
+		}
+		const trimmed = identifier.trim();
+		const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
+			trimmed,
+		);
+		let user: User | null = null;
+		if (isUuid) {
+			user = await User.findOne({
+				where: { id: trimmed },
+				include: [{ model: SpamTag, as: 'spamTag' }],
+			});
+		}
+		if (!user && trimmed.includes('@')) {
+			user = await User.findOne({
+				where: { email: trimmed },
+				include: [{ model: SpamTag, as: 'spamTag' }],
+			});
+		}
+		if (!user) {
+			user = await User.findOne({
+				where: { slug: trimmed },
+				include: [{ model: SpamTag, as: 'spamTag' }],
+			});
+		}
+		if (!user) {
+			return res.status(404).send({ error: 'User not found' });
+		}
+		await addSpamTagToUser(user.id);
+		const withTag = await User.findOne({
+			where: { id: user.id },
+			attributes: ['id', 'fullName', 'email', 'slug', 'createdAt'],
+			include: [{ model: SpamTag, as: 'spamTag', required: true }],
+		});
+		return res.status(200).send(withTag);
+	}),
+);
+
+router.post('/api/spamTags/queryUsersForSpam', async (req, res) => {
+	const { offset, limit, searchTerm, status, ordering } = req.body;
+	const canQuery = await canManipulateSpamTags({
+		userId: expect(req.user).id,
+	});
+	if (!canQuery) {
+		throw new ForbiddenError();
+	}
+	const queryResult = await queryUsersForSpamManagement({
+		offset: offset && parseInt(offset, 10),
+		limit: limit && parseInt(limit, 10),
+		ordering,
+		searchTerm,
+		status,
+	});
+	return res.status(200).send(queryResult);
+});
diff --git a/server/spamTag/uploadScamKeywords.ts b/server/spamTag/uploadScamKeywords.ts
new file mode 100644
index 0000000000..321e22a53a
--- /dev/null
+++ b/server/spamTag/uploadScamKeywords.ts
@@ -0,0 +1,19 @@
+export const uploadScamKeywords = [
+	'robux',
+	'roblox',
+	'insta-likes',
+	'instagram-likes',
+	'free-followers',
+	'v-bucks',
+	'vbucks',
+	'fortnite-hack',
+	'free-robux',
+	'tiktok-followers',
+	'hack-generator',
+] as const;
+
+export const isSuspiciousUploadKey = (keyOrFilename: string): boolean => {
+	console.log('keyOrFilename', keyOrFilename);
+	const lower = keyOrFilename.toLowerCase();
+	return uploadScamKeywords.some((kw) => lower.includes(kw));
+};
diff --git a/server/spamTag/userQueries.ts b/server/spamTag/userQueries.ts
new file mode 100644
index 0000000000..8021ba84ed
--- /dev/null
+++ b/server/spamTag/userQueries.ts
@@ -0,0 +1,86 @@
+import type * as types from 'types';
+import type { SpamStatus } from 'types';
+
+import mergeWith from 'lodash.mergewith';
+
+import { SpamTag, User } from 'server/models';
+import { expect } from 'utils/assert';
+
+import { getSuspectedUserSpamVerdict } from './userScore';
+
+type SpamTagFields = {
+	suspiciousFiles?: string[];
+	suspiciousComments?: string[];
+};
+
+const mergeSpamTagFields = (spamTag: Pick<SpamTag, 'fields'>, fields?: SpamTagFields) => {
+	if (!fields) {
+		return spamTag;
+	}
+	if (!spamTag.fields) {
+		return { ...spamTag, fields };
+	}
+
+	return {
+		...spamTag,
+		fields: mergeWith(spamTag.fields, fields, (a, b) => {
+			if (Array.isArray(a) && Array.isArray(b)) {
+				return a.concat(b);
+			}
+			return b ?? a;
+		}),
+	};
+};
+
+export const addSpamTagToUser = async (userId: string, fields?: SpamTagFields) => {
+	const user = expect(
+		await User.findOne({
+			where: { id: userId },
+			include: [{ model: SpamTag, as: 'spamTag' }],
+		}),
+	) as types.DefinitelyHas<User, 'spamTag'>;
+	const verdict = getSuspectedUserSpamVerdict(user);
+	const { spamTag } = user;
+	if (spamTag) {
+		const mergedSpamTag = mergeSpamTagFields(verdict, fields);
+
+		await spamTag.update(mergedSpamTag as types.SpamVerdict<SpamTag>);
+		return spamTag;
+	}
+	const newMergedSpamTag = mergeSpamTagFields(verdict, fields);
+	const newSpamTag = await SpamTag.create(newMergedSpamTag as types.SpamVerdict<SpamTag>);
+	await User.update(
+		{ spamTagId: newSpamTag.id },
+		{
+			where: { id: userId },
+			limit: 1,
+			individualHooks: false,
+		},
+	);
+	return newSpamTag;
+};
+
+type UpdateSpamTagForUserOptions = {
+	userId: string;
+	status: SpamStatus;
+};
+
+export const getSpamTagForUser = async (userId: string) => {
+	const user = await User.findOne({
+		where: { id: userId },
+		include: [{ model: SpamTag, as: 'spamTag' }],
+	});
+	if (!user) return null;
+	const u = user as types.DefinitelyHas<User, 'spamTag'>;
+	return u.spamTag ?? null;
+};
+
+export const updateSpamTagForUser = async (options: UpdateSpamTagForUserOptions) => {
+	const { userId, status } = options;
+	const spamTag = await getSpamTagForUser(userId);
+	if (spamTag) {
+		await spamTag.update({ status, statusUpdatedAt: new Date() });
+	} else {
+		throw new Error('User is missing a SpamTag');
+	}
+};
diff --git a/server/spamTag/userScore.ts b/server/spamTag/userScore.ts
new file mode 100644
index 0000000000..175fa55781
--- /dev/null
+++ b/server/spamTag/userScore.ts
@@ -0,0 +1,79 @@
+import type { User, SpamTag } from 'server/models';
+import type * as types from 'types';
+
+import { communitySpamPhrases } from './phrases';
+
+type SpamField<T> = {
+	extract: (value: T) => types.Maybe<string>;
+	isProse: boolean;
+	weight: number;
+};
+
+const CURRENT_SPAM_SCORE_VERSION = 1;
+
+const userSpamFields: Record<string, SpamField<User>> = {
+	fullName: {
+		extract: (u) => u.fullName,
+		isProse: true,
+		weight: 1,
+	},
+	title: {
+		extract: (u) => u.title,
+		isProse: true,
+		weight: 1,
+	},
+	bio: {
+		extract: (u) => u.bio,
+		isProse: true,
+		weight: 1,
+	},
+};
+
+const getMatchingSpamPhrases = (text: string, isProse: boolean): string[] => {
+	if (text) {
+		return communitySpamPhrases.filter((phrase) => {
+			const lowercaseText = text.toLowerCase();
+			const lowercasePhrase = phrase.toLowerCase();
+			if (isProse) {
+				return (
+					lowercaseText.includes(' ' + lowercasePhrase) ||
+					lowercaseText.includes(lowercasePhrase + ' ')
+				);
+			}
+			return lowercaseText.includes(lowercasePhrase);
+		});
+	}
+	return [];
+};
+
+const getUserSpamScoreReport = (user: User) => {
+	return Object.keys(userSpamFields).reduce(
+		(report, key) => {
+			const { extract, weight, isProse } = userSpamFields[key];
+			const text = extract(user);
+			if (text) {
+				const matchingPhrases = getMatchingSpamPhrases(text, isProse);
+				if (matchingPhrases.length) {
+					return {
+						score: report.score + weight * matchingPhrases.length,
+						fields: { ...report.fields, [key]: matchingPhrases },
+					};
+				}
+			}
+			return report;
+		},
+		{ score: 0, fields: {} as Record<string, string[]> },
+	);
+};
+
+export const getSuspectedUserSpamVerdict = (
+	user: User,
+): types.SpamVerdict<SpamTag> => {
+	const { score, fields } = getUserSpamScoreReport(user);
+	return {
+		fields,
+		spamScore: score,
+		spamScoreVersion: CURRENT_SPAM_SCORE_VERSION,
+		spamScoreComputedAt: new Date(),
+	};
+};
diff --git a/server/spamTag/users.ts b/server/spamTag/users.ts
new file mode 100644
index 0000000000..5b0b8021c1
--- /dev/null
+++ b/server/spamTag/users.ts
@@ -0,0 +1,60 @@
+import type * as types from 'types';
+
+import { Op } from 'sequelize';
+
+import { SpamTag, User } from 'server/models';
+
+const orderableFields = {
+	'user-created-at': ['createdAt'],
+	'spam-status-updated-at': [{ model: SpamTag, as: 'spamTag' }, 'statusUpdatedAt'],
+	'spam-score': [{ model: SpamTag, as: 'spamTag' }, 'spamScore'],
+} as const;
+
+const getUserWhereQuery = (searchTerm?: string | null) => {
+	console.log('searchTerm', searchTerm);
+	if (searchTerm) {
+		const normalizedQuery = `%${searchTerm.trim()}%`;
+		return {
+			where: {
+				[Op.or]: [
+					{ fullName: { [Op.iLike]: normalizedQuery } },
+					{ email: { [Op.iLike]: normalizedQuery } },
+					{ slug: { [Op.iLike]: normalizedQuery } },
+				],
+			},
+		};
+	}
+	return {};
+};
+
+const getSpamTagStatusWhereQuery = (status: undefined | types.SpamStatus[]) => {
+	if (status) {
+		return { where: { status: { [Op.in]: status } } };
+	}
+	return {};
+};
+
+type OrderFields = (typeof orderableFields)[keyof typeof orderableFields];
+const getQueryOrdering = (ordering: types.SpamUserQueryOrdering) => {
+	const { field, direction } = ordering;
+	return [[...orderableFields[field], direction]] as [OrderFields[number], 'ASC' | 'DESC'][];
+};
+
+export const queryUsersForSpamManagement = (query: types.SpamUserQuery) => {
+	const { limit, offset, ordering, status, searchTerm } = query;
+	return User.findAll({
+		...getUserWhereQuery(searchTerm),
+		attributes: ['id', 'fullName', 'email', 'slug', 'createdAt'],
+		limit,
+		offset,
+		order: getQueryOrdering(ordering),
+		include: [
+			{
+				model: SpamTag,
+				as: 'spamTag',
+				required: true,
+				...getSpamTagStatusWhereQuery(status),
+			},
+		],
+	}) as Promise<types.DefinitelyHas<User, 'spamTag'>[]>;
+};
diff --git a/server/upload/api.ts b/server/upload/api.ts
index c53cdf20cc..60075dd38b 100644
--- a/server/upload/api.ts
+++ b/server/upload/api.ts
@@ -6,8 +6,11 @@ import bb from 'busboy';
 import mime from 'mime-types';
 import uuid from 'uuid';
 
+import { isSuspiciousUploadKey } from 'server/spamTag/uploadScamKeywords';
+import { addSpamTagToUser } from 'server/spamTag/userQueries';
 import { BadRequestError } from 'server/utils/errors';
 import { createPubPubS3Client } from 'server/utils/s3';
+import { postToSlackAboutSuspiciousUpload } from 'server/utils/slack';
 import { mimeTypeSchema } from 'utils/api/schemas/upload';
 import { ensureUserIsCommunityAdmin } from 'utils/ensureUserIsCommunityAdmin';
 import { generateHash } from 'utils/hashes';
@@ -135,6 +138,29 @@ export const uploadRouteImplementation: AppRouteOptions<typeof contract.upload.f
 							},
 						});
 
+						const user = req.user as
+							| { id: string; email?: string; fullName?: string }
+							| undefined;
+						console.log('possiblyDerivedFilename', possiblyDerivedFilename);
+						if (
+							user &&
+							(isSuspiciousUploadKey(possiblyDerivedFilename) ||
+								isSuspiciousUploadKey(key))
+						) {
+							addSpamTagToUser(user.id)
+								.then(() =>
+									postToSlackAboutSuspiciousUpload(
+										user.id,
+										user.email ?? '',
+										user.fullName ?? 'Unknown',
+										key,
+									),
+								)
+								.catch(() => {
+									// do not fail the upload if spam tagging or slack fails
+								});
+						}
+
 						resolve({ url: `https://assets.pubpub.org/${key}`, size, key });
 					} catch (err: any) {
 						reject(err);
@@ -146,7 +172,6 @@ export const uploadRouteImplementation: AppRouteOptions<typeof contract.upload.f
 		req.pipe(busboy);
 		try {
 			const bod = await result;
-
 			return {
 				status: 201,
 				body: bod,
diff --git a/server/uploadPolicy/api.ts b/server/uploadPolicy/api.ts
index 4e139f054e..bbd7e04253 100644
--- a/server/uploadPolicy/api.ts
+++ b/server/uploadPolicy/api.ts
@@ -2,12 +2,37 @@ import type { AppRouteImplementation } from '@ts-rest/express';
 
 import type { contract } from 'utils/api/contract';
 
+import { isSuspiciousUploadKey } from 'server/spamTag/uploadScamKeywords';
+import { addSpamTagToUser } from 'server/spamTag/userQueries';
+import { postToSlackAboutSuspiciousUpload } from 'server/utils/slack';
+
 import { getUploadPolicy } from './queries';
 
 export const uploadPolicyRouteImplementation: AppRouteImplementation<
 	typeof contract.upload.policy
-> = async ({ query }) => {
+> = async ({ query, req }) => {
 	const uploadPolicy = getUploadPolicy(query);
+	const user = req.user as { id: string; email?: string; fullName?: string } | undefined;
+	if (user && (query.filename || query.key)) {
+		const keyOrName = query.key ?? query.filename ?? '';
+		if (isSuspiciousUploadKey(keyOrName)) {
+			console.log('SUS', keyOrName);
+			await addSpamTagToUser(user.id, {
+				suspiciousFiles: [`https://assets.pubpub.org/${keyOrName}`],
+			})
+				.then(() =>
+					postToSlackAboutSuspiciousUpload(
+						user.id,
+						user.email ?? '',
+						user.fullName ?? 'Unknown',
+						keyOrName,
+					),
+				)
+				.catch(() => {
+					// do not block policy response if spam tagging or slack fails
+				});
+		}
+	}
 	return {
 		status: 200,
 		body: uploadPolicy,
diff --git a/server/uploadPolicy/queries.ts b/server/uploadPolicy/queries.ts
index e3b0e9cf1e..9cd22aaca9 100644
--- a/server/uploadPolicy/queries.ts
+++ b/server/uploadPolicy/queries.ts
@@ -2,7 +2,13 @@ import crypto from 'crypto';
 
 import { expect } from 'utils/assert';
 
-export const getUploadPolicy = ({ contentType }: { contentType: string }) => {
+type GetUploadPolicyParams = {
+	contentType: string;
+	filename?: string;
+	key?: string;
+};
+
+export const getUploadPolicy = ({ contentType }: GetUploadPolicyParams) => {
 	const acl = 'public-read';
 	const bucket = 'assets.pubpub.org';
 	const awsAccessKeyId = expect(process.env.AWS_ACCESS_KEY_ID);
@@ -17,6 +23,9 @@ export const getUploadPolicy = ({ contentType }: { contentType: string }) => {
 			{ acl },
 			{ success_action_status: '200' },
 			['starts-with', '$Content-Type', contentType],
+			...(contentType === 'text/html'
+				? [['starts-with', '$Content-Disposition', 'attachment; filename="']]
+				: []),
 		],
 	};
 
diff --git a/server/user/model.ts b/server/user/model.ts
index f9e3fb7f6d..0950968daa 100644
--- a/server/user/model.ts
+++ b/server/user/model.ts
@@ -11,6 +11,7 @@ import type { SerializedModel } from 'types';
 
 import {
 	AllowNull,
+	BelongsTo,
 	Column,
 	DataType,
 	Default,
@@ -29,6 +30,7 @@ import {
 import {
 	Discussion,
 	PubAttribution,
+	SpamTag,
 	UserNotificationPreferences,
 	ZoteroIntegration,
 } from '../models';
@@ -236,6 +238,12 @@ export class User extends ModelWithPassport<InferAttributes<User>, InferCreation
 	@Column(DataType.BOOLEAN)
 	declare isSuperAdmin: CreationOptional<boolean>;
 
+	@Column(DataType.UUID)
+	declare spamTagId: string | null;
+
+	@BelongsTo(() => SpamTag, { as: 'spamTag', foreignKey: 'spamTagId' })
+	declare spamTag?: SpamTag;
+
 	@HasMany(() => PubAttribution, {
 		onDelete: 'CASCADE',
 		as: 'attributions',
diff --git a/server/utils/email/index.ts b/server/utils/email/index.ts
index 251c83fce6..46f72bda69 100644
--- a/server/utils/email/index.ts
+++ b/server/utils/email/index.ts
@@ -1,3 +1,4 @@
 export * from './digest';
 export * from './reset';
 export * from './signup';
+export * from './spam';
diff --git a/server/utils/email/spam.ts b/server/utils/email/spam.ts
new file mode 100644
index 0000000000..31636e22a7
--- /dev/null
+++ b/server/utils/email/spam.ts
@@ -0,0 +1,51 @@
+import stripIndent from 'strip-indent';
+
+import { sendEmail } from './reset';
+
+const CC_DEV = ['dev@pubpub.org'];
+
+export const sendSpamBanEmail = ({
+	toEmail,
+	userName,
+}: {
+	toEmail: string;
+	userName: string;
+}) => {
+	return sendEmail({
+		to: [toEmail],
+		cc: CC_DEV,
+		subject: 'PubPub account restriction',
+		text: stripIndent(`
+			Hello${userName ? ` ${userName}` : ''},
+
+			Your activity on PubPub has been flagged as spam. Your account has been restricted.
+
+			If you believe this is an error, please contact us at hello@pubpub.org.
+
+			Sincerely,
+			PubPub Team
+		`),
+	});
+};
+
+export const sendSpamLiftedEmail = ({
+	toEmail,
+	userName,
+}: {
+	toEmail: string;
+	userName: string;
+}) => {
+	return sendEmail({
+		to: [toEmail],
+		cc: CC_DEV,
+		subject: 'PubPub account restriction lifted',
+		text: stripIndent(`
+			Hello${userName ? ` ${userName}` : ''},
+
+			The restriction on your PubPub account has been lifted. You can log in and use the platform as usual.
+
+			Sincerely,
+			PubPub Team
+		`),
+	});
+};
diff --git a/server/utils/session.ts b/server/utils/session.ts
new file mode 100644
index 0000000000..c266c683d9
--- /dev/null
+++ b/server/utils/session.ts
@@ -0,0 +1,18 @@
+import { sequelize } from 'server/sequelize';
+
+/**
+ * Deletes all non-expired sessions for a user from the Sessions table.
+ * Session data stores passport user id at data.passport.user (serialized by passport).
+ * Only unexpired sessions are deleted; expired ones are left for the store's cleanup.
+ */
+export const deleteSessionsForUser = async (email: string): Promise<void> => {
+	const result = await sequelize.query(
+		`DELETE FROM "Sessions"
+		 WHERE "expires" > NOW()
+		 AND (data::jsonb->'passport'->>'user') = :email`,
+		{ replacements: { email } },
+	);
+	console.log(
+		`Deleted ${(result[1] as { rowCount: number }).rowCount} sessions for user ${email}`,
+	);
+};
diff --git a/server/utils/slack.ts b/server/utils/slack.ts
index 450cac96ef..d1be03c4b2 100644
--- a/server/utils/slack.ts
+++ b/server/utils/slack.ts
@@ -62,3 +62,35 @@ export const postToSlackAboutNewCommunity = async (
 		});
 	}
 };
+
+export const postToSlackAboutSuspiciousUpload = async (
+	userId: string,
+	userEmail: string,
+	userName: string,
+	key: string,
+) => {
+	if (isProd()) {
+		const spamUsersUrl = `https://pubpub.org${getSuperAdminTabUrl('spamUsers')}?q=${encodeURIComponent(userEmail)}`;
+		await postToSlack({
+			icon_emoji: ':warning:',
+			attachments: [
+				{
+					fallback: `Suspicious upload by ${userName} (${userEmail}): ${key}`,
+					pretext: 'Suspicious upload detected (scam keywords in filename)',
+					color: 'warning',
+					fields: [
+						{ title: 'User', value: `${userName} (${userEmail})` },
+						{ title: 'Object key', value: key },
+					],
+					actions: [
+						{
+							type: 'button',
+							text: 'View in Spam Users Dashboard',
+							url: spamUsersUrl,
+						},
+					],
+				},
+			],
+		});
+	}
+};
diff --git a/tools/migrations/2026_02_10_addSpamTagToUser.js b/tools/migrations/2026_02_10_addSpamTagToUser.js
new file mode 100644
index 0000000000..697e674419
--- /dev/null
+++ b/tools/migrations/2026_02_10_addSpamTagToUser.js
@@ -0,0 +1,10 @@
+export const up = async ({ Sequelize, sequelize }) => {
+	await sequelize.queryInterface.addColumn('Users', 'spamTagId', {
+		type: Sequelize.UUID,
+		allowNull: true,
+	});
+};
+
+export const down = async ({ sequelize }) => {
+	await sequelize.queryInterface.removeColumn('Users', 'spamTagId');
+};
diff --git a/types/request.ts b/types/request.ts
index b409dee873..d6b1ab46e5 100644
--- a/types/request.ts
+++ b/types/request.ts
@@ -3,6 +3,7 @@ import type {
 	Collection,
 	Community,
 	DefinitelyHas,
+	DiscussionCreationAccess,
 	Integration,
 	Member,
 	MemberPermission,
@@ -37,6 +38,7 @@ export type LocationData = {
 	isQubQub: boolean;
 	isDashboard: boolean;
 	appCommit: string;
+	turnstileSiteKey?: string;
 };
 
 export type ScopeData = {
@@ -55,6 +57,11 @@ export type ScopeData = {
 		canView: boolean;
 		canViewDraft: boolean;
 		isSuperAdmin: boolean;
+		/**
+		 * Hacky: this is the value for the current scope's discussion creation access, not the
+		 * user's. Refer to canCreateDiscussions for the user's access.
+		 */
+		discussionCreationAccess: DiscussionCreationAccess;
 	};
 	elements: {
 		activeIds: {
diff --git a/types/spam.ts b/types/spam.ts
index b607ac944b..53ec8ce2ac 100644
--- a/types/spam.ts
+++ b/types/spam.ts
@@ -28,3 +28,21 @@ export type SpamCommunityQuery = {
 	searchTerm?: string;
 	ordering: SpamCommunityQueryOrdering;
 };
+
+export type SpamUserQueryOrderingField =
+	| 'user-created-at'
+	| 'spam-score'
+	| 'spam-status-updated-at';
+
+export type SpamUserQueryOrdering = {
+	direction: 'ASC' | 'DESC';
+	field: SpamUserQueryOrderingField;
+};
+
+export type SpamUserQuery = {
+	status: SpamStatus[];
+	offset?: number;
+	limit?: number;
+	searchTerm?: string;
+	ordering: SpamUserQueryOrdering;
+};
diff --git a/types/user.ts b/types/user.ts
index bd356b9354..2a65db2d76 100644
--- a/types/user.ts
+++ b/types/user.ts
@@ -39,6 +39,8 @@ export type User = Pick<
 export type UserWithPrivateFields = Pick<
 	UserType,
 	| keyof User
+	| 'spamTag'
+	| 'createdAt'
 	| 'isSuperAdmin'
 	| 'passwordDigest'
 	| 'hash'
diff --git a/utils/api/contract.ts b/utils/api/contract.ts
index 874042c01b..6fbe8fd71b 100644
--- a/utils/api/contract.ts
+++ b/utils/api/contract.ts
@@ -20,6 +20,10 @@ import { type PageRouter, pageRouter } from './contracts/page';
 import { type PubRouter, pubRouter } from './contracts/pub';
 import { type PubAttributionRouter, pubAttributionRouter } from './contracts/pubAttribution';
 import { type PubEdgeRouter, pubEdgeRouter } from './contracts/pubEdge';
+import {
+	type PublicPermissionsRouter,
+	publicPermissionsRouter,
+} from './contracts/publicPermissions';
 import { type ReleaseRouter, releaseRouter } from './contracts/release';
 import { type UploadRouter, uploadRouter } from './contracts/upload';
 import { type WorkerTaskRouter, workerTaskRouter } from './contracts/workerTask';
@@ -48,6 +52,7 @@ export const router = {
 	pub: pubRouter as PubRouter,
 	pubAttribution: pubAttributionRouter as PubAttributionRouter,
 	pubEdge: pubEdgeRouter as PubEdgeRouter,
+	publicPermissions: publicPermissionsRouter as PublicPermissionsRouter,
 	release: releaseRouter as ReleaseRouter,
 	/** Methods for dealing with worker tasks, i.e. imports and exports */
 	workerTask: workerTaskRouter as WorkerTaskRouter,
diff --git a/utils/api/contracts/auth.ts b/utils/api/contracts/auth.ts
index 64da673a35..90f5884ead 100644
--- a/utils/api/contracts/auth.ts
+++ b/utils/api/contracts/auth.ts
@@ -36,6 +36,9 @@ export const authRouter = {
 				description: `Successfully authenticated.\n The sesion ID is returned in a cookie named \`connect.sid\` and should be included in all subsequent requests.`,
 			}),
 			401: z.literal('Login attempt failed').openapi({}),
+			403: z.string().openapi({
+				description: 'Account restricted (e.g. marked as spam). Message is shown to the user.',
+			}),
 			500: z.string().openapi({}),
 		},
 	},
diff --git a/utils/api/contracts/publicPermissions.ts b/utils/api/contracts/publicPermissions.ts
new file mode 100644
index 0000000000..a0a770f307
--- /dev/null
+++ b/utils/api/contracts/publicPermissions.ts
@@ -0,0 +1,23 @@
+import { AppRouter } from '@ts-rest/core';
+import { z } from 'zod';
+import { extendZodWithOpenApi } from '@anatine/zod-openapi';
+
+extendZodWithOpenApi(z);
+
+export const publicPermissionsRouter = {
+	updateDiscussions: {
+		path: '/api/publicPermissions/discussions',
+		method: 'PUT',
+		summary: 'Update who is able to create new discussions',
+		body: z.object({
+			discussionCreationAccess: z.enum(['public', 'contributors', 'members', 'disabled']),
+		}),
+		responses: {
+			200: z.object({ success: z.boolean() }),
+		},
+	},
+} satisfies AppRouter;
+
+type PublicPermissionsRouterType = typeof publicPermissionsRouter;
+
+export interface PublicPermissionsRouter extends PublicPermissionsRouterType {}
diff --git a/utils/api/contracts/upload.ts b/utils/api/contracts/upload.ts
index 8d4fc57130..9cdfa3a8d8 100644
--- a/utils/api/contracts/upload.ts
+++ b/utils/api/contracts/upload.ts
@@ -56,6 +56,8 @@ export const uploadRouter = {
 		description: 'Get upload policy. Used for doing manual uploads.',
 		query: z.object({
 			contentType: z.string(),
+			filename: z.string().optional(),
+			key: z.string().optional(),
 		}),
 		responses: {
 			200: z.object({
diff --git a/utils/api/server.ts b/utils/api/server.ts
index f2a4052d7b..4fa597ccca 100644
--- a/utils/api/server.ts
+++ b/utils/api/server.ts
@@ -14,6 +14,7 @@ import { pageServer } from 'server/page/api';
 import { pubServer } from 'server/pub/api';
 import { pubAttributionServer } from 'server/pubAttribution/api';
 import { pubEdgeServer } from 'server/pubEdge/api';
+import { publicPermissionsServer } from 'server/publicPermissions/api';
 import { releaseServer } from 'server/release/api';
 import { uploadRouteImplementation } from 'server/upload/api';
 import { uploadPolicyRouteImplementation } from 'server/uploadPolicy/api';
@@ -44,6 +45,7 @@ export const server = s.router(contractWithScriptsAndCommunity, {
 	page: pageServer,
 	pub: pubServer,
 	pubAttribution: pubAttributionServer,
+	publicPermissions: publicPermissionsServer,
 	pubEdge: pubEdgeServer,
 	release: releaseServer,
 	upload: {
diff --git a/utils/superAdmin.ts b/utils/superAdmin.ts
index 7cc984ff61..88a9b86e44 100644
--- a/utils/superAdmin.ts
+++ b/utils/superAdmin.ts
@@ -1,4 +1,4 @@
-export const superAdminTabKinds = ['landingPageFeatures', 'spam'] as const;
+export const superAdminTabKinds = ['landingPageFeatures', 'spam', 'spamUsers'] as const;
 
 export const getSuperAdminTabUrl = (tabKind: SuperAdminTabKind) => {
 	return `/superadmin/${tabKind}` as const;

From 174fffa5cddc23d5d9eb28f66ec96ab37ea63a86 Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Tue, 10 Feb 2026 17:25:44 +0100
Subject: [PATCH 02/16] feat: improve blocking users

---
 .../UserSpam/MarkSpamStatusButton.tsx         |  11 +-
 .../SuperAdminDashboard/UserSpam/UserSpam.tsx |  56 ++----
 .../UserSpam/UserSpamEntry.tsx                | 177 +++++++++++++++---
 .../SuperAdminDashboard/UserSpam/filters.ts   |  16 +-
 .../SuperAdminDashboard/UserSpam/types.ts     |   8 +-
 .../UserSpam/useSpamUsers.ts                  |  12 +-
 client/webpack/webpackConfig.dev.js           |  12 +-
 client/webpack/webpackConfig.prod.js          |  10 +-
 server/login/api.ts                           |  11 ++
 server/routes/superAdminDashboard.tsx         |   3 +-
 server/spamTag/api.ts                         |  55 ++----
 server/spamTag/userQueries.ts                 |  11 ++
 server/spamTag/users.ts                       | 124 ++++++++++--
 13 files changed, 353 insertions(+), 153 deletions(-)

diff --git a/client/containers/SuperAdminDashboard/UserSpam/MarkSpamStatusButton.tsx b/client/containers/SuperAdminDashboard/UserSpam/MarkSpamStatusButton.tsx
index 150b5535f4..f36ba37a8f 100644
--- a/client/containers/SuperAdminDashboard/UserSpam/MarkSpamStatusButton.tsx
+++ b/client/containers/SuperAdminDashboard/UserSpam/MarkSpamStatusButton.tsx
@@ -10,6 +10,7 @@ type Props = {
 	userId: string;
 	status: SpamStatus;
 	onStatusChanged: (status: SpamStatus) => unknown;
+	label?: string;
 };
 
 const propsForStatuses: Record<SpamStatus, Partial<React.ComponentProps<typeof Button>>> = {
@@ -29,7 +30,7 @@ const propsForStatuses: Record<SpamStatus, Partial<React.ComponentProps<typeof B
 };
 
 const MarkSpamStatusButton = (props: Props) => {
-	const { status, userId, onStatusChanged } = props;
+	const { status, userId, onStatusChanged, label } = props;
 	const [isLoading, setIsLoading] = useState(false);
 
 	const handleClick = useCallback(async () => {
@@ -40,7 +41,13 @@ const MarkSpamStatusButton = (props: Props) => {
 	}, [status, userId, onStatusChanged]);
 
 	return (
-		<Button minimal loading={isLoading} onClick={handleClick} {...propsForStatuses[status]} />
+		<Button
+			minimal
+			loading={isLoading}
+			onClick={handleClick}
+			{...propsForStatuses[status]}
+			children={label ?? propsForStatuses[status]?.children}
+		/>
 	);
 };
 
diff --git a/client/containers/SuperAdminDashboard/UserSpam/UserSpam.tsx b/client/containers/SuperAdminDashboard/UserSpam/UserSpam.tsx
index 30813fabdc..e9d8d9ff3d 100644
--- a/client/containers/SuperAdminDashboard/UserSpam/UserSpam.tsx
+++ b/client/containers/SuperAdminDashboard/UserSpam/UserSpam.tsx
@@ -2,10 +2,9 @@ import type { SpamUser } from './types';
 
 import React, { useCallback, useState } from 'react';
 
-import { Button, InputGroup, Spinner } from '@blueprintjs/core';
+import { Spinner } from '@blueprintjs/core';
 import { useUpdateEffect } from 'react-use';
 
-import { apiFetch } from 'client/utils/apiFetch';
 import { OverviewSearchGroup } from 'client/containers/DashboardOverview/helpers';
 import { useInfiniteScroll } from 'client/utils/useInfiniteScroll';
 
@@ -22,13 +21,10 @@ type Props = {
 
 const UserSpam = (props: Props) => {
 	const { users: initialUsers, searchTerm: initialSearchTerm } = props;
-	const [filter, setFilter] = useState(filtersById[initialSearchTerm ? 'recent' : 'unreviewed']);
+	const [filter, setFilter] = useState(filtersById[initialSearchTerm ? 'all' : 'all']);
 	const [searchTerm, setSearchTerm] = useState(initialSearchTerm ?? '');
-	const [addIdentifier, setAddIdentifier] = useState('');
-	const [addError, setAddError] = useState<string | null>(null);
-	const [addLoading, setAddLoading] = useState(false);
 
-	const { users, isLoading, loadMoreUsers, mayLoadMoreUsers, prependUser } = useSpamUsers({
+	const { users, isLoading, loadMoreUsers, mayLoadMoreUsers, updateUser } = useSpamUsers({
 		limit: 50,
 		searchTerm,
 		initialUsers,
@@ -36,7 +32,7 @@ const UserSpam = (props: Props) => {
 	});
 
 	useInfiniteScroll({
-		scrollTolerance: 0,
+		scrollTolerance: 100,
 		useDocumentElement: true,
 		onRequestMoreItems: loadMoreUsers,
 		enabled: mayLoadMoreUsers,
@@ -47,22 +43,12 @@ const UserSpam = (props: Props) => {
 		window.history.replaceState({}, '', window.location.pathname + nextSearchPart);
 	}, [searchTerm]);
 
-	const handleAddUser = useCallback(async () => {
-		const trimmed = addIdentifier.trim();
-		if (!trimmed) return;
-		setAddError(null);
-		setAddLoading(true);
-		try {
-			const user = await apiFetch.post('/api/spamTags/addUser', { identifier: trimmed });
-			prependUser(user);
-			setAddIdentifier('');
-		} catch (err: any) {
-			const msg = err?.body?.error ?? err?.message ?? 'Failed to add user';
-			setAddError(msg);
-		} finally {
-			setAddLoading(false);
-		}
-	}, [addIdentifier, prependUser]);
+	const handleSpamTagRemoved = useCallback(
+		(userId: string) => {
+			updateUser(userId, { spamTag: null } as unknown as Partial<SpamUser>);
+		},
+		[updateUser],
+	);
 
 	return (
 		<div className="user-spam-component">
@@ -76,25 +62,13 @@ const UserSpam = (props: Props) => {
 				initialSearchTerm={initialSearchTerm ?? undefined}
 				rightControls={isLoading && <Spinner size={20} />}
 			/>
-			<div className="add-user-row">
-				<InputGroup
-					placeholder="Add user by email, slug, or ID"
-					value={addIdentifier}
-					onChange={(e) => setAddIdentifier(e.target.value)}
-					onKeyDown={(e) => e.key === 'Enter' && handleAddUser()}
-					disabled={addLoading}
-				/>
-				<Button
-					text="Add user"
-					onClick={handleAddUser}
-					loading={addLoading}
-					disabled={!addIdentifier.trim()}
-				/>
-			</div>
-			{addError && <p className="add-user-error">{addError}</p>}
 			<div className="users">
 				{users.map((user) => (
-					<UserSpamEntry user={user} key={user.id} />
+					<UserSpamEntry
+						user={user}
+						key={user.id}
+						onSpamTagRemoved={handleSpamTagRemoved}
+					/>
 				))}
 			</div>
 		</div>
diff --git a/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx b/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
index 4e33257f7f..72f9acd717 100644
--- a/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
+++ b/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
@@ -1,9 +1,10 @@
 import type { SpamStatus } from 'types';
 
-import React, { useMemo, useState } from 'react';
+import React, { useCallback, useMemo, useState } from 'react';
 
-import { ButtonGroup, type Intent, Tag } from '@blueprintjs/core';
+import { Button, ButtonGroup, type Intent, Tag } from '@blueprintjs/core';
 
+import { apiFetch } from 'client/utils/apiFetch';
 import { formatDate } from 'utils/dates';
 
 import MarkSpamStatusButton from './MarkSpamStatusButton';
@@ -14,27 +15,27 @@ import type { SpamUser } from './types';
 
 type Props = {
 	user: SpamUser;
+	onSpamTagRemoved?: (userId: string) => void;
 };
 
 const getIntentForSpamScore = (spamScore: number): Intent => {
-	if (spamScore > 3) {
-		return 'danger';
-	}
-	if (spamScore > 1) {
-		return 'warning';
-	}
+	if (spamScore > 3) return 'danger';
+	if (spamScore > 1) return 'warning';
 	return 'none';
 };
 
 const UserSpamEntry = (props: Props) => {
-	const { user } = props;
-	const { fullName, email, slug, createdAt, spamTag } = user;
-	const { spamScore, status: initialStatus, fields } = spamTag;
+	const { user, onSpamTagRemoved } = props;
+	const { fullName, email, slug, createdAt, spamTag, affiliation } = user;
+	const hasTag = spamTag != null;
+	const initialStatus = hasTag ? spamTag.status : null;
 	const [status, setUpdatedStatus] = useState<null | SpamStatus>(initialStatus);
 
+	const fields = hasTag ? (spamTag.fields ?? {}) : {};
 	const fieldsJsonString = useMemo(() => JSON.stringify(fields, null, 2), [fields]);
 
 	const renderFieldsReport = () => {
+		if (Object.keys(fields).length === 0) return null;
 		return (
 			<div className="fields-report">
 				<details>
@@ -48,6 +49,9 @@ const UserSpamEntry = (props: Props) => {
 	};
 
 	const renderStatusTag = () => {
+		if (!hasTag || status === null) {
+			return <Tag minimal>No spam information</Tag>;
+		}
 		if (status === 'unreviewed') {
 			return <Tag minimal>Unreviewed</Tag>;
 		}
@@ -65,7 +69,40 @@ const UserSpamEntry = (props: Props) => {
 		);
 	};
 
+	const [removeLoading, setRemoveLoading] = useState(false);
+	const handleRemoveTag = useCallback(async () => {
+		setRemoveLoading(true);
+		try {
+			await apiFetch.delete('/api/spamTags/user', { userId: user.id });
+			setUpdatedStatus(null);
+			onSpamTagRemoved?.(user.id);
+		} finally {
+			setRemoveLoading(false);
+		}
+	}, [user.id, onSpamTagRemoved]);
+
 	const renderActions = () => {
+		if (!hasTag || status === null) {
+			return (
+				<ButtonGroup>
+					<MarkSpamStatusButton
+						userId={user.id}
+						status="unreviewed"
+						onStatusChanged={setUpdatedStatus}
+					/>
+					<MarkSpamStatusButton
+						userId={user.id}
+						status="confirmed-not-spam"
+						onStatusChanged={setUpdatedStatus}
+					/>
+					<MarkSpamStatusButton
+						userId={user.id}
+						status="confirmed-spam"
+						onStatusChanged={setUpdatedStatus}
+					/>
+				</ButtonGroup>
+			);
+		}
 		if (status === 'unreviewed') {
 			return (
 				<ButtonGroup>
@@ -79,30 +116,62 @@ const UserSpamEntry = (props: Props) => {
 						status="confirmed-spam"
 						onStatusChanged={setUpdatedStatus}
 					/>
+					<Button minimal icon="remove" loading={removeLoading} onClick={handleRemoveTag}>
+						Remove spam tag
+					</Button>
+				</ButtonGroup>
+			);
+		}
+		if (status === 'confirmed-spam') {
+			return (
+				<ButtonGroup>
+					<MarkSpamStatusButton
+						userId={user.id}
+						status="confirmed-not-spam"
+						onStatusChanged={setUpdatedStatus}
+						label="Mark as not spam"
+					/>
+					<MarkSpamStatusButton
+						userId={user.id}
+						status="unreviewed"
+						onStatusChanged={setUpdatedStatus}
+					/>
+					<Button minimal icon="remove" loading={removeLoading} onClick={handleRemoveTag}>
+						Remove spam tag
+					</Button>
 				</ButtonGroup>
 			);
 		}
 		return (
-			<MarkSpamStatusButton
-				userId={user.id}
-				status="unreviewed"
-				onStatusChanged={setUpdatedStatus}
-			/>
+			<ButtonGroup>
+				<MarkSpamStatusButton
+					userId={user.id}
+					status="confirmed-spam"
+					onStatusChanged={setUpdatedStatus}
+					label="Mark as spam"
+				/>
+				<MarkSpamStatusButton
+					userId={user.id}
+					status="unreviewed"
+					onStatusChanged={setUpdatedStatus}
+				/>
+				<Button minimal icon="remove" onClick={handleRemoveTag}>
+					Remove spam tag
+				</Button>
+			</ButtonGroup>
 		);
 	};
 
 	const renderSuspiciousFiles = () => {
+		const list = fields?.suspiciousFiles;
+		if (!list?.length) return null;
 		return (
 			<div className="suspicious-files">
 				<h3>Suspicious files</h3>
 				<ul>
-					{fields.suspiciousFiles.map((file) => (
+					{list.map((file) => (
 						<li key={file}>
-							<a
-								href={`https://pubpub.org/uploads/${file}`}
-								target="_blank"
-								rel="noopener noreferrer"
-							>
+							<a href={file} target="_blank" rel="noopener noreferrer">
 								{file}
 							</a>
 						</li>
@@ -113,11 +182,13 @@ const UserSpamEntry = (props: Props) => {
 	};
 
 	const renderSuspiciousComments = () => {
+		const list = fields?.suspiciousComments;
+		if (!list?.length) return null;
 		return (
 			<div className="suspicious-comments">
 				<h3>Suspicious comments</h3>
 				<ul>
-					{fields.suspiciousComments.map((comment) => (
+					{list.map((comment) => (
 						<li key={comment}>{comment}</li>
 					))}
 				</ul>
@@ -125,21 +196,71 @@ const UserSpamEntry = (props: Props) => {
 		);
 	};
 
+	const renderAffiliation = () => {
+		if (!affiliation) return null;
+		const { communitySubdomains, pubCount, discussionCount } = affiliation;
+		if (communitySubdomains.length === 0 && pubCount === 0 && discussionCount === 0) {
+			return null;
+		}
+		const parts: React.ReactNode[] = [];
+		if (communitySubdomains.length > 0) {
+			parts.push(
+				<span>
+					Communities:{' '}
+					{communitySubdomains.slice(0, 5).map((subdomain, index) => (
+						<a
+							key={subdomain}
+							href={`https://${subdomain}.pubpub.org`}
+							target="_blank"
+							rel="noopener noreferrer"
+						>
+							{subdomain}
+							{index < communitySubdomains.length - 1 ? ', ' : ''}
+						</a>
+					))}
+					{communitySubdomains.length > 5 ? '...' : ''}
+				</span>,
+			);
+		}
+		if (pubCount > 0) parts.push(`${pubCount} pub(s)`);
+		if (discussionCount > 0) parts.push(`${discussionCount} discussion(s)`);
+		return (
+			<div className="affiliation">
+				<Tag minimal>
+					{parts.map((part, index) => (
+						// biome-ignore lint/suspicious/noArrayIndexKey: idcc
+						<span key={index}>
+							{part}
+							{index < parts.length - 1 ? ' · ' : ''}
+						</span>
+					))}
+				</Tag>
+			</div>
+		);
+	};
+
 	return (
 		<div className="user-spam-entry-component">
 			<div className="title">
-				<span className="name">{fullName}</span>
+				<a className="name" href={`/user/${slug}`}>
+					{fullName}
+				</a>
 				{email && <span className="email">{email}</span>}
 				{slug && <span className="slug">@{slug}</span>}
 			</div>
-			{Object.keys(fields).length > 0 && renderFieldsReport()}
-			{fields?.suspiciousFiles?.length > 0 && renderSuspiciousFiles()}
-			{fields?.suspiciousComments?.length > 0 && renderSuspiciousComments()}
+			{renderFieldsReport()}
+			{renderSuspiciousFiles()}
+			{renderSuspiciousComments()}
 			<div className="details">
 				<div className="tags">
 					{renderStatusTag()}
-					<Tag intent={getIntentForSpamScore(spamScore)}>Spam score: {spamScore}</Tag>
+					{hasTag && spamTag && (
+						<Tag intent={getIntentForSpamScore(spamTag.spamScore)}>
+							Spam score: {spamTag.spamScore}
+						</Tag>
+					)}
 					<Tag minimal>Created: {formatDate(createdAt)}</Tag>
+					{renderAffiliation()}
 				</div>
 				<div className="actions">{renderActions()}</div>
 			</div>
diff --git a/client/containers/SuperAdminDashboard/UserSpam/filters.ts b/client/containers/SuperAdminDashboard/UserSpam/filters.ts
index 76610fa888..c720943eef 100644
--- a/client/containers/SuperAdminDashboard/UserSpam/filters.ts
+++ b/client/containers/SuperAdminDashboard/UserSpam/filters.ts
@@ -9,19 +9,19 @@ export type SpamUsersFilter = OverviewSearchFilter<
 
 export const filters: SpamUsersFilter[] = [
 	{
-		title: 'Unreviewed',
-		id: 'unreviewed',
+		title: 'All',
+		id: 'all',
 		query: {
-			ordering: { field: 'spam-score', direction: 'DESC' },
-			status: ['unreviewed'],
+			ordering: { field: 'user-created-at', direction: 'DESC' },
+			status: null,
 		},
 	},
 	{
-		title: 'Recently created',
-		id: 'recent',
+		title: 'Unreviewed',
+		id: 'unreviewed',
 		query: {
-			ordering: { field: 'user-created-at', direction: 'DESC' },
-			status: ['unreviewed', 'confirmed-not-spam', 'confirmed-spam'],
+			ordering: { field: 'spam-score', direction: 'DESC' },
+			status: ['unreviewed'],
 		},
 	},
 	{
diff --git a/client/containers/SuperAdminDashboard/UserSpam/types.ts b/client/containers/SuperAdminDashboard/UserSpam/types.ts
index fa388c1eff..b4d60bc5bd 100644
--- a/client/containers/SuperAdminDashboard/UserSpam/types.ts
+++ b/client/containers/SuperAdminDashboard/UserSpam/types.ts
@@ -1,3 +1,7 @@
-import type { DefinitelyHas, UserWithPrivateFields } from 'types';
+import type { SpamTag } from 'types';
+import type { UserWithPrivateFields } from 'types';
 
-export type SpamUser = DefinitelyHas<UserWithPrivateFields, 'spamTag'>;
+export type SpamUser = UserWithPrivateFields & {
+	spamTag: SpamTag | null;
+	affiliation?: { communitySubdomains: string[]; pubCount: number; discussionCount: number };
+};
diff --git a/client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts b/client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts
index 0ca2aad21e..3807a6730d 100644
--- a/client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts
+++ b/client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts
@@ -47,13 +47,11 @@ export const useSpamUsers = (options: UseSpamUsersOptions) => {
 		loadMoreUsers();
 	}, [setOffset, loadMoreUsers, filter]);
 
-	const prependUser = useCallback((user: SpamUser) => {
-		setUsers((current) => {
-			const seen = new Set(current.map((u) => u.id));
-			if (seen.has(user.id)) return current;
-			return [user, ...current];
-		});
+	const updateUser = useCallback((userId: string, patch: Partial<SpamUser>) => {
+		setUsers((current) =>
+			current.map((u) => (u.id === userId ? { ...u, ...patch } : u)),
+		);
 	}, []);
 
-	return { users, isLoading, loadMoreUsers, mayLoadMoreUsers, prependUser };
+	return { users, isLoading, loadMoreUsers, mayLoadMoreUsers, updateUser };
 };
diff --git a/client/webpack/webpackConfig.dev.js b/client/webpack/webpackConfig.dev.js
index 60ac89d4ce..35a6c4efed 100644
--- a/client/webpack/webpackConfig.dev.js
+++ b/client/webpack/webpackConfig.dev.js
@@ -20,7 +20,7 @@ module.exports = {
 		main: resolve(__dirname, `../containers/App/App.tsx`),
 	},
 	resolve: {
-		extensions: ['.js', '.jsx', '.ts', '.tsx', '.scss'],
+		extensions: ['.mjs', '.cjs', '.js', '.jsx', '.ts', '.tsx', '.scss'],
 		modules: [resolve(__dirname, '../'), 'node_modules'],
 		alias: {
 			client: resolve(__dirname, '../../client'),
@@ -56,9 +56,15 @@ module.exports = {
 	module: {
 		rules: [
 			{
-				test: /\.mjs$/,
-				include: /node_modules/,
+				test: /\.(mjs|cjs)$/,
+				// this module includes nullish coalescing and optional chaining, which are not supported by webpack 4
+				include: /node_modules\/@marsidev\/react-turnstile/,
 				type: 'javascript/auto',
+				loader: 'esbuild-loader',
+				/** @type {import('esbuild-loader').LoaderOptions} */
+				options: {
+					target: 'es6'
+				},
 			},
 			{
 				test: /\.((c|m)?js|jsx|ts|tsx)$/,
diff --git a/client/webpack/webpackConfig.prod.js b/client/webpack/webpackConfig.prod.js
index d1bdfd3416..9392857573 100644
--- a/client/webpack/webpackConfig.prod.js
+++ b/client/webpack/webpackConfig.prod.js
@@ -46,9 +46,15 @@ module.exports = {
 	module: {
 		rules: [
 			{
-				test: /\.mjs$/,
-				include: /node_modules/,
+				test: /\.(mjs|cjs)$/,
+				// this module includes nullish coalescing and optional chaining, which are not supported by webpack 4
+				include: /node_modules\/@marsidev\/react-turnstile/,
 				type: 'javascript/auto',
+				loader: 'esbuild-loader',
+				/** @type {import('esbuild-loader').LoaderOptions} */
+				options: {
+					target: 'es6'
+				},
 			},
 			{
 				test: /\.(js|jsx|ts|tsx)$/,
diff --git a/server/login/api.ts b/server/login/api.ts
index 1452626f2f..1feec1ed24 100644
--- a/server/login/api.ts
+++ b/server/login/api.ts
@@ -8,6 +8,7 @@ import passport from 'passport';
 import { promisify } from 'util';
 
 import { User } from 'server/models';
+import { getSpamTagForUser } from 'server/spamTag/userQueries';
 import { assert } from 'utils/assert';
 import { getHashedUserId } from 'utils/caching/getHashedUserId';
 import { isDuqDuq, isProd } from 'utils/environment';
@@ -116,6 +117,10 @@ export const loginRouteImplementation: AppRouteImplementation<typeof contract.au
 			return updatedUserData[1][0];
 		})
 		.then(async (user) => {
+			const spamTag = await getSpamTagForUser(user.id);
+			if (spamTag?.status === 'confirmed-spam') {
+				throw new Error('ACCOUNT_RESTRICTED');
+			}
 			const logIn = promisify(req.logIn.bind(req));
 			await logIn(user);
 			const hashedUserId = getHashedUserId(user);
@@ -133,6 +138,12 @@ export const loginRouteImplementation: AppRouteImplementation<typeof contract.au
 			} as const;
 		})
 		.catch((err) => {
+			if (err.message === 'ACCOUNT_RESTRICTED') {
+				return {
+					status: 403,
+					body: 'Your account has been restricted. If you believe this is an error, please contact hello@pubpub.org.',
+				} as const;
+			}
 			const unaunthenticatedValues = ['Invalid password', 'Invalid email'];
 			if (unaunthenticatedValues.includes(err.message)) {
 				return { status: 401, body: 'Login attempt failed' } as const;
diff --git a/server/routes/superAdminDashboard.tsx b/server/routes/superAdminDashboard.tsx
index 6c916ed996..59512adbf6 100644
--- a/server/routes/superAdminDashboard.tsx
+++ b/server/routes/superAdminDashboard.tsx
@@ -40,13 +40,12 @@ const getTabProps = async (tabKind: SuperAdminTabKind, locationData: types.Locat
 	}
 	if (tabKind === 'spamUsers') {
 		const searchTerm = locationData.query.q ?? null;
-		const { query } = spamUsersFiltersById[searchTerm ? 'recent' : 'unreviewed'];
+		const { query } = spamUsersFiltersById['all'];
 		const users = await queryUsersForSpamManagement({
 			limit: 50,
 			searchTerm,
 			...query!,
 		});
-		console.log('users', users);
 		return {
 			searchTerm,
 			users,
diff --git a/server/spamTag/api.ts b/server/spamTag/api.ts
index f18814fd7c..b45c66c46f 100644
--- a/server/spamTag/api.ts
+++ b/server/spamTag/api.ts
@@ -10,7 +10,7 @@ import { expect } from 'utils/assert';
 import { queryCommunitiesForSpamManagement } from './communities';
 import { canManipulateSpamTags } from './permissions';
 import { updateSpamTagForCommunity } from './queries';
-import { addSpamTagToUser, getSpamTagForUser, updateSpamTagForUser } from './userQueries';
+import { addSpamTagToUser, getSpamTagForUser, removeSpamTagFromUser, updateSpamTagForUser } from './userQueries';
 import { queryUsersForSpamManagement } from './users';
 
 export const router = Router();
@@ -91,50 +91,19 @@ router.post('/api/spamTags/queryCommunitiesForSpam', async (req, res) => {
 	return res.status(200).send(queryResult);
 });
 
-router.post(
-	'/api/spamTags/addUser',
+router.delete(
+	'/api/spamTags/user',
 	wrap(async (req, res) => {
-		const canAdd = await canManipulateSpamTags({ userId: req.user?.id });
-		if (!canAdd) {
+		const canUpdate = await canManipulateSpamTags({ userId: req.user?.id });
+		if (!canUpdate) {
 			throw new ForbiddenError();
 		}
-		const { identifier } = req.body;
-		if (!identifier || typeof identifier !== 'string') {
-			return res.status(400).send({ error: 'identifier required' });
-		}
-		const trimmed = identifier.trim();
-		const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
-			trimmed,
-		);
-		let user: User | null = null;
-		if (isUuid) {
-			user = await User.findOne({
-				where: { id: trimmed },
-				include: [{ model: SpamTag, as: 'spamTag' }],
-			});
-		}
-		if (!user && trimmed.includes('@')) {
-			user = await User.findOne({
-				where: { email: trimmed },
-				include: [{ model: SpamTag, as: 'spamTag' }],
-			});
+		const { userId } = req.body;
+		if (!userId || typeof userId !== 'string') {
+			return res.status(400).send({ error: 'userId required' });
 		}
-		if (!user) {
-			user = await User.findOne({
-				where: { slug: trimmed },
-				include: [{ model: SpamTag, as: 'spamTag' }],
-			});
-		}
-		if (!user) {
-			return res.status(404).send({ error: 'User not found' });
-		}
-		await addSpamTagToUser(user.id);
-		const withTag = await User.findOne({
-			where: { id: user.id },
-			attributes: ['id', 'fullName', 'email', 'slug', 'createdAt'],
-			include: [{ model: SpamTag, as: 'spamTag', required: true }],
-		});
-		return res.status(200).send(withTag);
+		await removeSpamTagFromUser(userId);
+		return res.status(200).send({});
 	}),
 );
 
@@ -146,12 +115,14 @@ router.post('/api/spamTags/queryUsersForSpam', async (req, res) => {
 	if (!canQuery) {
 		throw new ForbiddenError();
 	}
+	const includeAll = !status || (Array.isArray(status) && status.length === 0);
 	const queryResult = await queryUsersForSpamManagement({
 		offset: offset && parseInt(offset, 10),
 		limit: limit && parseInt(limit, 10),
 		ordering,
 		searchTerm,
-		status,
+		status: status ?? null,
+		includeAffiliation: includeAll,
 	});
 	return res.status(200).send(queryResult);
 });
diff --git a/server/spamTag/userQueries.ts b/server/spamTag/userQueries.ts
index 8021ba84ed..92a029932b 100644
--- a/server/spamTag/userQueries.ts
+++ b/server/spamTag/userQueries.ts
@@ -84,3 +84,14 @@ export const updateSpamTagForUser = async (options: UpdateSpamTagForUserOptions)
 		throw new Error('User is missing a SpamTag');
 	}
 };
+
+export const removeSpamTagFromUser = async (userId: string) => {
+	const spamTag = await getSpamTagForUser(userId);
+	if (spamTag) {
+		await User.update(
+			{ spamTagId: null },
+			{ where: { id: userId }, limit: 1, individualHooks: false },
+		);
+		await spamTag.destroy();
+	}
+};
diff --git a/server/spamTag/users.ts b/server/spamTag/users.ts
index 5b0b8021c1..be47150d6a 100644
--- a/server/spamTag/users.ts
+++ b/server/spamTag/users.ts
@@ -2,7 +2,7 @@ import type * as types from 'types';
 
 import { Op } from 'sequelize';
 
-import { SpamTag, User } from 'server/models';
+import { Community, Discussion, Member, Pub, PubAttribution, SpamTag, User } from 'server/models';
 
 const orderableFields = {
 	'user-created-at': ['createdAt'],
@@ -11,7 +11,6 @@ const orderableFields = {
 } as const;
 
 const getUserWhereQuery = (searchTerm?: string | null) => {
-	console.log('searchTerm', searchTerm);
 	if (searchTerm) {
 		const normalizedQuery = `%${searchTerm.trim()}%`;
 		return {
@@ -27,8 +26,8 @@ const getUserWhereQuery = (searchTerm?: string | null) => {
 	return {};
 };
 
-const getSpamTagStatusWhereQuery = (status: undefined | types.SpamStatus[]) => {
-	if (status) {
+const getSpamTagStatusWhereQuery = (status: undefined | types.SpamStatus[] | null) => {
+	if (status && status.length > 0) {
 		return { where: { status: { [Op.in]: status } } };
 	}
 	return {};
@@ -40,21 +39,114 @@ const getQueryOrdering = (ordering: types.SpamUserQueryOrdering) => {
 	return [[...orderableFields[field], direction]] as [OrderFields[number], 'ASC' | 'DESC'][];
 };
 
-export const queryUsersForSpamManagement = (query: types.SpamUserQuery) => {
-	const { limit, offset, ordering, status, searchTerm } = query;
-	return User.findAll({
+export type UserSpamManagementRow = types.DefinitelyHas<User, 'spamTag'> | (types.User & { spamTag: null });
+
+type SerializedSpamUserRow = Record<string, unknown> & {
+	id: string;
+	affiliation?: types.SpamUserAffiliation;
+};
+
+export const queryUsersForSpamManagement = async (
+	query: types.SpamUserQuery,
+): Promise<SerializedSpamUserRow[]> => {
+	const { limit, offset, ordering, status, searchTerm, includeAffiliation } = query;
+	const includeAllUsers = !status || status.length === 0;
+	const include = [
+		{
+			model: SpamTag,
+			as: 'spamTag',
+			required: !includeAllUsers,
+			...getSpamTagStatusWhereQuery(status),
+		},
+	];
+	const rows = (await User.findAll({
 		...getUserWhereQuery(searchTerm),
 		attributes: ['id', 'fullName', 'email', 'slug', 'createdAt'],
 		limit,
 		offset,
 		order: getQueryOrdering(ordering),
-		include: [
-			{
-				model: SpamTag,
-				as: 'spamTag',
-				required: true,
-				...getSpamTagStatusWhereQuery(status),
-			},
-		],
-	}) as Promise<types.DefinitelyHas<User, 'spamTag'>[]>;
+		include,
+	})) as UserSpamManagementRow[];
+
+	const plain = rows.map((r) => {
+		const row = r as any;
+		return (row.toJSON ? row.toJSON() : row) as Record<string, unknown>;
+	});
+	if (includeAffiliation && plain.length > 0) {
+		const userIds = plain.map((r) => r.id as string);
+		const affiliationMap = await getAffiliationForUserIds(userIds);
+		return plain.map((r) => ({
+			...r,
+			affiliation: affiliationMap.get(r.id as string),
+		})) as SerializedSpamUserRow[];
+	}
+	return plain as SerializedSpamUserRow[];
+};
+
+const getAffiliationForUserIds = async (
+	userIds: string[],
+): Promise<Map<string, types.SpamUserAffiliation>> => {
+	const [members, attributions, discussions] = await Promise.all([
+		Member.findAll({
+			where: { userId: { [Op.in]: userIds } },
+			attributes: ['userId', 'communityId'],
+			include: [{ model: Community, as: 'community', attributes: ['subdomain'] }],
+		}),
+		PubAttribution.findAll({
+			where: { userId: { [Op.in]: userIds } },
+			attributes: ['userId'],
+			include: [
+				{
+					model: Pub,
+					as: 'pub',
+					attributes: ['communityId'],
+					include: [{ model: Community, as: 'community', attributes: ['subdomain'] }],
+				},
+			],
+		}),
+		Discussion.findAll({
+			where: { userId: { [Op.in]: userIds } },
+			attributes: ['userId', 'pubId'],
+			include: [
+				{
+					model: Pub,
+					as: 'pub',
+					attributes: ['communityId'],
+					include: [{ model: Community, as: 'community', attributes: ['subdomain'] }],
+				},
+			],
+		}),
+	]);
+	const map = new Map<string, types.SpamUserAffiliation>();
+	for (const uid of userIds) {
+		const subdomains = new Set<string>();
+		let pubCount = 0;
+		let discussionCount = 0;
+		for (const m of members) {
+			if (m.userId === uid) {
+				const comm = (m as any).community;
+				if (comm?.subdomain) subdomains.add(comm.subdomain);
+			}
+		}
+		for (const a of attributions) {
+			if (a.userId === uid) {
+				pubCount += 1;
+				const pub = (a as any).pub;
+				if (pub?.community?.subdomain) subdomains.add(pub.community.subdomain);
+			}
+		}
+		for (const d of discussions) {
+			if (d.userId === uid) {
+				discussionCount += 1;
+				const pub = (d as any).pub;
+				if (pub?.community?.subdomain) subdomains.add(pub.community.subdomain);
+			}
+		}
+		map.set(uid, {
+			communitySubdomains: Array.from(subdomains).slice(0, 10),
+			pubCount,
+			discussionCount,
+		});
+	}
+	return map;
 };

From 5c9d2bdc24daffdead77488438c62f0fdec744e3 Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Tue, 10 Feb 2026 17:31:09 +0100
Subject: [PATCH 03/16] fix: lint, etc

---
 .../SuperAdminDashboard/UserSpam/filters.ts   |  4 +---
 .../SuperAdminDashboard/UserSpam/types.ts     |  3 +--
 .../UserSpam/useSpamUsers.ts                  |  4 +---
 client/layouts/TwoColumnFooter/iconPaths.ts   | 10 +++++-----
 .../TwoColumnFooter/twoColumnFooterData.ts    | 20 +++++++++----------
 server/spamTag/api.ts                         |  7 ++++++-
 server/spamTag/userScore.ts                   |  6 ++----
 server/spamTag/users.ts                       |  4 +++-
 server/utils/email/spam.ts                    |  8 +-------
 types/request.ts                              |  6 ------
 types/spam.ts                                 |  9 ++++++++-
 utils/api/contract.ts                         |  5 -----
 utils/api/contracts/auth.ts                   |  3 ++-
 utils/api/contracts/publicPermissions.ts      |  5 +++--
 utils/api/server.ts                           |  2 --
 15 files changed, 43 insertions(+), 53 deletions(-)

diff --git a/client/containers/SuperAdminDashboard/UserSpam/filters.ts b/client/containers/SuperAdminDashboard/UserSpam/filters.ts
index c720943eef..3137fad975 100644
--- a/client/containers/SuperAdminDashboard/UserSpam/filters.ts
+++ b/client/containers/SuperAdminDashboard/UserSpam/filters.ts
@@ -3,9 +3,7 @@ import type { SpamUserQuery } from 'types';
 
 import { indexById } from 'utils/arrays';
 
-export type SpamUsersFilter = OverviewSearchFilter<
-	Pick<SpamUserQuery, 'status' | 'ordering'>
->;
+export type SpamUsersFilter = OverviewSearchFilter<Pick<SpamUserQuery, 'status' | 'ordering'>>;
 
 export const filters: SpamUsersFilter[] = [
 	{
diff --git a/client/containers/SuperAdminDashboard/UserSpam/types.ts b/client/containers/SuperAdminDashboard/UserSpam/types.ts
index b4d60bc5bd..4bd8970dcb 100644
--- a/client/containers/SuperAdminDashboard/UserSpam/types.ts
+++ b/client/containers/SuperAdminDashboard/UserSpam/types.ts
@@ -1,5 +1,4 @@
-import type { SpamTag } from 'types';
-import type { UserWithPrivateFields } from 'types';
+import type { SpamTag, UserWithPrivateFields } from 'types';
 
 export type SpamUser = UserWithPrivateFields & {
 	spamTag: SpamTag | null;
diff --git a/client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts b/client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts
index 3807a6730d..636094bffe 100644
--- a/client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts
+++ b/client/containers/SuperAdminDashboard/UserSpam/useSpamUsers.ts
@@ -48,9 +48,7 @@ export const useSpamUsers = (options: UseSpamUsersOptions) => {
 	}, [setOffset, loadMoreUsers, filter]);
 
 	const updateUser = useCallback((userId: string, patch: Partial<SpamUser>) => {
-		setUsers((current) =>
-			current.map((u) => (u.id === userId ? { ...u, ...patch } : u)),
-		);
+		setUsers((current) => current.map((u) => (u.id === userId ? { ...u, ...patch } : u)));
 	}, []);
 
 	return { users, isLoading, loadMoreUsers, mayLoadMoreUsers, updateUser };
diff --git a/client/layouts/TwoColumnFooter/iconPaths.ts b/client/layouts/TwoColumnFooter/iconPaths.ts
index 681d13c4a5..4f56a7f054 100644
--- a/client/layouts/TwoColumnFooter/iconPaths.ts
+++ b/client/layouts/TwoColumnFooter/iconPaths.ts
@@ -11,9 +11,9 @@ export const iconPaths = {
 	youtube:
 		'M14.3394034,5.00081974 C15.0650046,5.00416663 16.8547629,5.01866982 18.7408249,5.08151696 L19.3085648,5.10185861 L19.3085648,5.10185861 L19.8762758,5.12532402 C21.6678517,5.20481265 23.3716441,5.33464406 24.1578396,5.54670204 C25.2765782,5.84762249 26.157476,6.73428158 26.456476,7.86025886 C26.9532448,9.72604587 26.995825,13.4452634 26.9994747,14.0691357 L26.9994747,14.2486746 C26.995825,14.8725277 26.9532448,18.5916449 26.456476,20.457702 C26.157476,21.5835316 25.2765782,22.4701907 24.1578396,22.7712589 C23.3302654,22.9944175 21.4859633,23.126491 19.5927869,23.2046569 L19.0243355,23.2265266 C16.9417355,23.3010584 14.9171078,23.3148606 14.2386654,23.3174166 L13.7609683,23.3174166 C12.4040836,23.3123047 5.66245741,23.2622078 3.84179414,22.7712589 C2.72320323,22.4701907 1.84215778,21.5835316 1.54315778,20.457702 C1.06191297,18.6499592 1.00691357,15.1031629 1.00062792,14.316078 L1.00062792,14.0017303 C1.00691357,13.2146223 1.06191297,9.66774002 1.54315778,7.86025886 C1.84215778,6.73428158 2.72320323,5.84762249 3.84179414,5.54670204 C5.6210787,5.06678135 12.1001879,5.00801555 13.6602303,5.00081974 Z M11.1612194,10.2011473 L11.1612194,17.7986829 L17.8387126,14.0000603 L11.1612194,10.2011473 Z',
 	linkedin:
-    'M22.3830154,22.3830154 L18.8384,22.3830154 L18.8384,16.832 C18.8384,15.5083077 18.8147692,13.8043077 16.9948308,13.8043077 C15.1486769,13.8043077 14.8662154,15.2465231 14.8662154,16.7356308 L14.8662154,22.3826462 L11.3216,22.3826462 L11.3216,10.9675077 L14.7244308,10.9675077 L14.7244308,12.5275077 L14.7720615,12.5275077 C15.465918,11.3411519 16.7560586,10.632589 18.1294769,10.6835692 C21.7220923,10.6835692 22.3844923,13.0466462 22.3844923,16.1208615 L22.3830154,22.3830154 Z M7.32209231,9.4071385 C6.1860511,9.40734236 5.26494244,8.48656431 5.26473849,7.3505231 C5.26453461,6.21448189 6.18531266,5.29337322 7.32135387,5.29316926 C8.45739508,5.29296537 9.37850375,6.21374341 9.37870773,7.34978462 C9.37880563,7.89533086 9.16218215,8.41857185 8.77649194,8.80440054 C8.39080174,9.19022923 7.86763855,9.40704054 7.32209231,9.4071385 M9.0944,22.3830154 L5.54609231,22.3830154 L5.54609231,10.9675077 L9.0944,10.9675077 L9.0944,22.3830154 Z M24.1501538,2.00147692 L3.76492308,2.00147692 C2.80147497,1.99060441 2.01138912,2.76234691 1.99963077,3.72578462 L1.99963077,24.1955692 C2.01098655,25.1594712 2.80100881,25.9319778 3.76492308,25.9218636 L24.1501538,25.9218636 C25.115975,25.9338359 25.9090911,25.1613738 25.9224615,24.1955692 L25.9224615,3.72430769 C25.9086895,2.75896671 25.1155091,1.98726833 24.1501538,1.9998447',
-  bluesky:
-    'M14 12.8C12.913 10.686 9.954 6.747 7.202 4.805C4.566 2.944 3.561 3.266 2.902 3.565C2.139 3.908 2 5.08 2 5.768C2 6.458 2.378 11.418 2.624 12.247C3.439 14.983 6.337 15.907 9.007 15.611C9.143 15.591 9.282 15.572 9.422 15.555C9.284 15.577 9.146 15.595 9.007 15.611C5.095 16.191 1.62 17.616 6.177 22.689C11.19 27.879 13.047 21.576 14 18.381C14.953 21.576 16.05 27.652 21.733 22.689C26 18.381 22.905 16.191 18.993 15.611C18.8542 15.5956 18.7159 15.577 18.578 15.555C18.718 15.572 18.857 15.591 18.993 15.611C21.663 15.908 24.561 14.983 25.376 12.247C25.622 11.419 26 6.457 26 5.769C26 5.079 25.861 3.908 25.098 3.563C24.439 3.265 23.434 2.943 20.798 4.803C18.046 6.748 15.087 10.687 14 12.8Z',
-  threads:
-    'M12.0662 15.9565C12.0662 15.2903 12.3864 14.2308 14.8726 14.2308C15.6347 14.2308 16.1044 14.286 16.7349 14.4274C16.5334 17.0371 15.2561 17.3816 14.0146 17.3816C13.3354 17.3816 12.0662 17.0274 12.0662 15.9565Z M5.20875 27H22.7912C23.9075 27 24.978 26.5566 25.7673 25.7673C26.5566 24.978 27 23.9075 27 22.7912V5.20875C27 4.09252 26.5566 3.02201 25.7673 2.23271C24.978 1.44342 23.9075 1 22.7912 1L5.20875 1C4.09252 1 3.02201 1.44342 2.23271 2.23271C1.44342 3.02201 1 4.09252 1 5.20875L1 22.7912C1 23.9075 1.44342 24.978 2.23271 25.7673C3.02201 26.5566 4.09252 27 5.20875 27ZM10.5323 10.6037C11.4536 9.2875 12.6691 8.774 14.351 8.774C15.5372 8.774 16.5464 9.17375 17.2679 9.92937C17.9877 10.6866 18.3989 11.7689 18.4931 13.1518C18.8918 13.3186 19.259 13.5152 19.5949 13.7416C20.9469 14.65 21.6911 16.0085 21.6911 17.5653C21.6911 20.8754 18.9774 23.75 14.0666 23.75C9.84975 23.75 5.46875 21.2962 5.46875 13.9935C5.46875 6.72975 9.71163 4.25 14.0536 4.25C16.0589 4.25 20.7632 4.54575 22.5312 10.3876L20.8737 10.8166C19.5055 6.65662 16.6374 5.99362 14.0097 5.99362C9.66287 5.99362 7.20588 8.63913 7.20588 14.2698C7.20588 19.3186 9.95213 21.9999 14.0666 21.9999C17.4515 21.9999 19.9751 20.2416 19.9751 17.666C19.9751 15.9126 18.5029 15.0741 18.4265 15.0741C18.1389 16.5773 17.3686 19.1074 13.9854 19.1074C12.0143 19.1074 10.3129 17.7456 10.3129 15.9614C10.3129 13.4134 12.7309 12.4904 14.6403 12.4904C15.3553 12.4904 16.2165 12.5391 16.6666 12.6301C16.6666 11.8534 16.0101 10.5241 14.3494 10.5241C12.869 10.5241 12.4644 10.9921 11.9931 11.5381L11.9541 11.582C11.6259 11.3626 10.5323 10.6037 10.5323 10.6037Z',
+		'M22.3830154,22.3830154 L18.8384,22.3830154 L18.8384,16.832 C18.8384,15.5083077 18.8147692,13.8043077 16.9948308,13.8043077 C15.1486769,13.8043077 14.8662154,15.2465231 14.8662154,16.7356308 L14.8662154,22.3826462 L11.3216,22.3826462 L11.3216,10.9675077 L14.7244308,10.9675077 L14.7244308,12.5275077 L14.7720615,12.5275077 C15.465918,11.3411519 16.7560586,10.632589 18.1294769,10.6835692 C21.7220923,10.6835692 22.3844923,13.0466462 22.3844923,16.1208615 L22.3830154,22.3830154 Z M7.32209231,9.4071385 C6.1860511,9.40734236 5.26494244,8.48656431 5.26473849,7.3505231 C5.26453461,6.21448189 6.18531266,5.29337322 7.32135387,5.29316926 C8.45739508,5.29296537 9.37850375,6.21374341 9.37870773,7.34978462 C9.37880563,7.89533086 9.16218215,8.41857185 8.77649194,8.80440054 C8.39080174,9.19022923 7.86763855,9.40704054 7.32209231,9.4071385 M9.0944,22.3830154 L5.54609231,22.3830154 L5.54609231,10.9675077 L9.0944,10.9675077 L9.0944,22.3830154 Z M24.1501538,2.00147692 L3.76492308,2.00147692 C2.80147497,1.99060441 2.01138912,2.76234691 1.99963077,3.72578462 L1.99963077,24.1955692 C2.01098655,25.1594712 2.80100881,25.9319778 3.76492308,25.9218636 L24.1501538,25.9218636 C25.115975,25.9338359 25.9090911,25.1613738 25.9224615,24.1955692 L25.9224615,3.72430769 C25.9086895,2.75896671 25.1155091,1.98726833 24.1501538,1.9998447',
+	bluesky:
+		'M14 12.8C12.913 10.686 9.954 6.747 7.202 4.805C4.566 2.944 3.561 3.266 2.902 3.565C2.139 3.908 2 5.08 2 5.768C2 6.458 2.378 11.418 2.624 12.247C3.439 14.983 6.337 15.907 9.007 15.611C9.143 15.591 9.282 15.572 9.422 15.555C9.284 15.577 9.146 15.595 9.007 15.611C5.095 16.191 1.62 17.616 6.177 22.689C11.19 27.879 13.047 21.576 14 18.381C14.953 21.576 16.05 27.652 21.733 22.689C26 18.381 22.905 16.191 18.993 15.611C18.8542 15.5956 18.7159 15.577 18.578 15.555C18.718 15.572 18.857 15.591 18.993 15.611C21.663 15.908 24.561 14.983 25.376 12.247C25.622 11.419 26 6.457 26 5.769C26 5.079 25.861 3.908 25.098 3.563C24.439 3.265 23.434 2.943 20.798 4.803C18.046 6.748 15.087 10.687 14 12.8Z',
+	threads:
+		'M12.0662 15.9565C12.0662 15.2903 12.3864 14.2308 14.8726 14.2308C15.6347 14.2308 16.1044 14.286 16.7349 14.4274C16.5334 17.0371 15.2561 17.3816 14.0146 17.3816C13.3354 17.3816 12.0662 17.0274 12.0662 15.9565Z M5.20875 27H22.7912C23.9075 27 24.978 26.5566 25.7673 25.7673C26.5566 24.978 27 23.9075 27 22.7912V5.20875C27 4.09252 26.5566 3.02201 25.7673 2.23271C24.978 1.44342 23.9075 1 22.7912 1L5.20875 1C4.09252 1 3.02201 1.44342 2.23271 2.23271C1.44342 3.02201 1 4.09252 1 5.20875L1 22.7912C1 23.9075 1.44342 24.978 2.23271 25.7673C3.02201 26.5566 4.09252 27 5.20875 27ZM10.5323 10.6037C11.4536 9.2875 12.6691 8.774 14.351 8.774C15.5372 8.774 16.5464 9.17375 17.2679 9.92937C17.9877 10.6866 18.3989 11.7689 18.4931 13.1518C18.8918 13.3186 19.259 13.5152 19.5949 13.7416C20.9469 14.65 21.6911 16.0085 21.6911 17.5653C21.6911 20.8754 18.9774 23.75 14.0666 23.75C9.84975 23.75 5.46875 21.2962 5.46875 13.9935C5.46875 6.72975 9.71163 4.25 14.0536 4.25C16.0589 4.25 20.7632 4.54575 22.5312 10.3876L20.8737 10.8166C19.5055 6.65662 16.6374 5.99362 14.0097 5.99362C9.66287 5.99362 7.20588 8.63913 7.20588 14.2698C7.20588 19.3186 9.95213 21.9999 14.0666 21.9999C17.4515 21.9999 19.9751 20.2416 19.9751 17.666C19.9751 15.9126 18.5029 15.0741 18.4265 15.0741C18.1389 16.5773 17.3686 19.1074 13.9854 19.1074C12.0143 19.1074 10.3129 17.7456 10.3129 15.9614C10.3129 13.4134 12.7309 12.4904 14.6403 12.4904C15.3553 12.4904 16.2165 12.5391 16.6666 12.6301C16.6666 11.8534 16.0101 10.5241 14.3494 10.5241C12.869 10.5241 12.4644 10.9921 11.9931 11.5381L11.9541 11.582C11.6259 11.3626 10.5323 10.6037 10.5323 10.6037Z',
 };
diff --git a/client/layouts/TwoColumnFooter/twoColumnFooterData.ts b/client/layouts/TwoColumnFooter/twoColumnFooterData.ts
index f080a52f92..bb927a767e 100644
--- a/client/layouts/TwoColumnFooter/twoColumnFooterData.ts
+++ b/client/layouts/TwoColumnFooter/twoColumnFooterData.ts
@@ -47,16 +47,16 @@ const defaultTwoColumnFooterProps: TwoColumnFooterProps = {
 		},
 	],
 	iconLinks: [
-    {
-     	url: 'https://bsky.app/profile/did:plc:4irghgzlsjk6ugrekoqyl7km',
-     	ariaLabel: 'Bluesky',
-     	pathProps: {
-    		d: iconPaths.bluesky,
-    		fill: '#000000',
-    		fillRule: 'nonzero',
-     	},
-    },
-    {
+		{
+			url: 'https://bsky.app/profile/did:plc:4irghgzlsjk6ugrekoqyl7km',
+			ariaLabel: 'Bluesky',
+			pathProps: {
+				d: iconPaths.bluesky,
+				fill: '#000000',
+				fillRule: 'nonzero',
+			},
+		},
+		{
 			url: 'https://www.linkedin.com/company/elife-sciences-publications-ltd',
 			ariaLabel: 'LinkedIn',
 			pathProps: {
diff --git a/server/spamTag/api.ts b/server/spamTag/api.ts
index b45c66c46f..edb16172c6 100644
--- a/server/spamTag/api.ts
+++ b/server/spamTag/api.ts
@@ -10,7 +10,12 @@ import { expect } from 'utils/assert';
 import { queryCommunitiesForSpamManagement } from './communities';
 import { canManipulateSpamTags } from './permissions';
 import { updateSpamTagForCommunity } from './queries';
-import { addSpamTagToUser, getSpamTagForUser, removeSpamTagFromUser, updateSpamTagForUser } from './userQueries';
+import {
+	addSpamTagToUser,
+	getSpamTagForUser,
+	removeSpamTagFromUser,
+	updateSpamTagForUser,
+} from './userQueries';
 import { queryUsersForSpamManagement } from './users';
 
 export const router = Router();
diff --git a/server/spamTag/userScore.ts b/server/spamTag/userScore.ts
index 175fa55781..5592e11565 100644
--- a/server/spamTag/userScore.ts
+++ b/server/spamTag/userScore.ts
@@ -1,4 +1,4 @@
-import type { User, SpamTag } from 'server/models';
+import type { SpamTag, User } from 'server/models';
 import type * as types from 'types';
 
 import { communitySpamPhrases } from './phrases';
@@ -66,9 +66,7 @@ const getUserSpamScoreReport = (user: User) => {
 	);
 };
 
-export const getSuspectedUserSpamVerdict = (
-	user: User,
-): types.SpamVerdict<SpamTag> => {
+export const getSuspectedUserSpamVerdict = (user: User): types.SpamVerdict<SpamTag> => {
 	const { score, fields } = getUserSpamScoreReport(user);
 	return {
 		fields,
diff --git a/server/spamTag/users.ts b/server/spamTag/users.ts
index be47150d6a..1a84d0e2ef 100644
--- a/server/spamTag/users.ts
+++ b/server/spamTag/users.ts
@@ -39,7 +39,9 @@ const getQueryOrdering = (ordering: types.SpamUserQueryOrdering) => {
 	return [[...orderableFields[field], direction]] as [OrderFields[number], 'ASC' | 'DESC'][];
 };
 
-export type UserSpamManagementRow = types.DefinitelyHas<User, 'spamTag'> | (types.User & { spamTag: null });
+export type UserSpamManagementRow =
+	| types.DefinitelyHas<User, 'spamTag'>
+	| (types.User & { spamTag: null });
 
 type SerializedSpamUserRow = Record<string, unknown> & {
 	id: string;
diff --git a/server/utils/email/spam.ts b/server/utils/email/spam.ts
index 31636e22a7..f2de76ff9c 100644
--- a/server/utils/email/spam.ts
+++ b/server/utils/email/spam.ts
@@ -4,13 +4,7 @@ import { sendEmail } from './reset';
 
 const CC_DEV = ['dev@pubpub.org'];
 
-export const sendSpamBanEmail = ({
-	toEmail,
-	userName,
-}: {
-	toEmail: string;
-	userName: string;
-}) => {
+export const sendSpamBanEmail = ({ toEmail, userName }: { toEmail: string; userName: string }) => {
 	return sendEmail({
 		to: [toEmail],
 		cc: CC_DEV,
diff --git a/types/request.ts b/types/request.ts
index d6b1ab46e5..089b2c608c 100644
--- a/types/request.ts
+++ b/types/request.ts
@@ -3,7 +3,6 @@ import type {
 	Collection,
 	Community,
 	DefinitelyHas,
-	DiscussionCreationAccess,
 	Integration,
 	Member,
 	MemberPermission,
@@ -57,11 +56,6 @@ export type ScopeData = {
 		canView: boolean;
 		canViewDraft: boolean;
 		isSuperAdmin: boolean;
-		/**
-		 * Hacky: this is the value for the current scope's discussion creation access, not the
-		 * user's. Refer to canCreateDiscussions for the user's access.
-		 */
-		discussionCreationAccess: DiscussionCreationAccess;
 	};
 	elements: {
 		activeIds: {
diff --git a/types/spam.ts b/types/spam.ts
index 53ec8ce2ac..187a9b773a 100644
--- a/types/spam.ts
+++ b/types/spam.ts
@@ -39,10 +39,17 @@ export type SpamUserQueryOrdering = {
 	field: SpamUserQueryOrderingField;
 };
 
+export type SpamUserAffiliation = {
+	communitySubdomains: string[];
+	pubCount: number;
+	discussionCount: number;
+};
+
 export type SpamUserQuery = {
-	status: SpamStatus[];
+	status?: SpamStatus[] | null;
 	offset?: number;
 	limit?: number;
 	searchTerm?: string;
 	ordering: SpamUserQueryOrdering;
+	includeAffiliation?: boolean;
 };
diff --git a/utils/api/contract.ts b/utils/api/contract.ts
index 6fbe8fd71b..874042c01b 100644
--- a/utils/api/contract.ts
+++ b/utils/api/contract.ts
@@ -20,10 +20,6 @@ import { type PageRouter, pageRouter } from './contracts/page';
 import { type PubRouter, pubRouter } from './contracts/pub';
 import { type PubAttributionRouter, pubAttributionRouter } from './contracts/pubAttribution';
 import { type PubEdgeRouter, pubEdgeRouter } from './contracts/pubEdge';
-import {
-	type PublicPermissionsRouter,
-	publicPermissionsRouter,
-} from './contracts/publicPermissions';
 import { type ReleaseRouter, releaseRouter } from './contracts/release';
 import { type UploadRouter, uploadRouter } from './contracts/upload';
 import { type WorkerTaskRouter, workerTaskRouter } from './contracts/workerTask';
@@ -52,7 +48,6 @@ export const router = {
 	pub: pubRouter as PubRouter,
 	pubAttribution: pubAttributionRouter as PubAttributionRouter,
 	pubEdge: pubEdgeRouter as PubEdgeRouter,
-	publicPermissions: publicPermissionsRouter as PublicPermissionsRouter,
 	release: releaseRouter as ReleaseRouter,
 	/** Methods for dealing with worker tasks, i.e. imports and exports */
 	workerTask: workerTaskRouter as WorkerTaskRouter,
diff --git a/utils/api/contracts/auth.ts b/utils/api/contracts/auth.ts
index 90f5884ead..e37d34705b 100644
--- a/utils/api/contracts/auth.ts
+++ b/utils/api/contracts/auth.ts
@@ -37,7 +37,8 @@ export const authRouter = {
 			}),
 			401: z.literal('Login attempt failed').openapi({}),
 			403: z.string().openapi({
-				description: 'Account restricted (e.g. marked as spam). Message is shown to the user.',
+				description:
+					'Account restricted (e.g. marked as spam). Message is shown to the user.',
 			}),
 			500: z.string().openapi({}),
 		},
diff --git a/utils/api/contracts/publicPermissions.ts b/utils/api/contracts/publicPermissions.ts
index a0a770f307..68d5062dcf 100644
--- a/utils/api/contracts/publicPermissions.ts
+++ b/utils/api/contracts/publicPermissions.ts
@@ -1,6 +1,7 @@
-import { AppRouter } from '@ts-rest/core';
-import { z } from 'zod';
+import type { AppRouter } from '@ts-rest/core';
+
 import { extendZodWithOpenApi } from '@anatine/zod-openapi';
+import { z } from 'zod';
 
 extendZodWithOpenApi(z);
 
diff --git a/utils/api/server.ts b/utils/api/server.ts
index 4fa597ccca..f2a4052d7b 100644
--- a/utils/api/server.ts
+++ b/utils/api/server.ts
@@ -14,7 +14,6 @@ import { pageServer } from 'server/page/api';
 import { pubServer } from 'server/pub/api';
 import { pubAttributionServer } from 'server/pubAttribution/api';
 import { pubEdgeServer } from 'server/pubEdge/api';
-import { publicPermissionsServer } from 'server/publicPermissions/api';
 import { releaseServer } from 'server/release/api';
 import { uploadRouteImplementation } from 'server/upload/api';
 import { uploadPolicyRouteImplementation } from 'server/uploadPolicy/api';
@@ -45,7 +44,6 @@ export const server = s.router(contractWithScriptsAndCommunity, {
 	page: pageServer,
 	pub: pubServer,
 	pubAttribution: pubAttributionServer,
-	publicPermissions: publicPermissionsServer,
 	pubEdge: pubEdgeServer,
 	release: releaseServer,
 	upload: {

From 26dff7a64f74a31e3bcafa78326332eb45a0f57f Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Tue, 10 Feb 2026 18:36:20 +0100
Subject: [PATCH 04/16] feat: allow extra keywords to be added by env var

---
 server/spamTag/uploadScamKeywords.ts | 4 ++--
 server/uploadPolicy/api.ts           | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/server/spamTag/uploadScamKeywords.ts b/server/spamTag/uploadScamKeywords.ts
index 321e22a53a..2daca61d2e 100644
--- a/server/spamTag/uploadScamKeywords.ts
+++ b/server/spamTag/uploadScamKeywords.ts
@@ -13,7 +13,7 @@ export const uploadScamKeywords = [
 ] as const;
 
 export const isSuspiciousUploadKey = (keyOrFilename: string): boolean => {
-	console.log('keyOrFilename', keyOrFilename);
+	const extraSuspiciousKeywords = process.env.EXTRA_SUSPICIOUS_KEYWORDS?.split(',') ?? [];
 	const lower = keyOrFilename.toLowerCase();
-	return uploadScamKeywords.some((kw) => lower.includes(kw));
+	return [...uploadScamKeywords, ...extraSuspiciousKeywords].some((kw) => lower.includes(kw));
 };
diff --git a/server/uploadPolicy/api.ts b/server/uploadPolicy/api.ts
index bbd7e04253..93f92ce99a 100644
--- a/server/uploadPolicy/api.ts
+++ b/server/uploadPolicy/api.ts
@@ -16,7 +16,6 @@ export const uploadPolicyRouteImplementation: AppRouteImplementation<
 	if (user && (query.filename || query.key)) {
 		const keyOrName = query.key ?? query.filename ?? '';
 		if (isSuspiciousUploadKey(keyOrName)) {
-			console.log('SUS', keyOrName);
 			await addSpamTagToUser(user.id, {
 				suspiciousFiles: [`https://assets.pubpub.org/${keyOrName}`],
 			})

From 1abb43d91dcb1168edce09db3e603f0e31806820 Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Thu, 12 Feb 2026 19:48:20 +0100
Subject: [PATCH 05/16] fix: also stop showing user comment

---
 .../PubDiscussions/Discussion/Discussion.tsx  |  8 ++++
 .../Discussion/ThreadComment.tsx              | 15 ++++++-
 .../PubDiscussions/Discussion/discussion.scss | 12 ++++++
 .../Discussion/threadComment.scss             | 15 +++++++
 .../utils/queryHelpers/discussionsSanitize.ts | 41 ++++++++++++++++++-
 server/utils/queryHelpers/util.ts             | 13 +++---
 types/pub.ts                                  |  3 +-
 7 files changed, 99 insertions(+), 8 deletions(-)

diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx
index 39e00e1815..aec5c27d6c 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx
@@ -58,6 +58,7 @@ const Discussion = (props: Props) => {
 	const isDiscussionAuthor = loginData.id === discussionData.userId;
 	const showManageTools = canAdmin || (isDiscussionAuthor && !discussionData.isClosed);
 	const discussionId = discussionData.id;
+	const isAuthorSpam = !!discussionData.isAuthorSpam;
 
 	useEffect(() => {
 		if (isPreviewExpandedByHash(discussionId)) {
@@ -195,6 +196,7 @@ const Discussion = (props: Props) => {
 				previewExpanded && 'expanded-preview',
 				showManageTools && 'has-manage-tools',
 				emphasized && 'emphasized',
+				isAuthorSpam && 'is-author-spam',
 			)}
 			onClick={() => {
 				setEmphasized(false);
@@ -219,6 +221,12 @@ const Discussion = (props: Props) => {
 				/>
 			)}
 			<LabelList pubData={pubData} discussionData={discussionData} />
+			{!isPreview && isAuthorSpam && (
+				<div className="discussion-spam-banner">
+					This user has been banned. Only you and other admins of this community can see
+					this discussion. You can safely remove it.
+				</div>
+			)}
 			{!isPreview && (
 				<>
 					{showManageTools && (
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx
index e87b1952d9..573441dd75 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx
@@ -86,8 +86,15 @@ const ThreadComment = (props: Props) => {
 		);
 	};
 	const commenterName = discussionData.commenter?.name ?? threadCommentData.commenter?.name;
+	const isAuthorSpam = !!threadCommentData.isAuthorSpam;
 	return (
-		<div className={classNames('thread-comment-component', isPreview && 'is-preview')}>
+		<div
+			className={classNames(
+				'thread-comment-component',
+				isPreview && 'is-preview',
+				isAuthorSpam && 'is-spam',
+			)}
+		>
 			<div className="avatar-wrapper">
 				<Avatar
 					width={18}
@@ -150,6 +157,12 @@ const ThreadComment = (props: Props) => {
 						)}
 					</span>
 				</div>
+				{!isPreview && isAuthorSpam && (
+					<div className="thread-comment-spam-banner">
+						This user has been banned. Only you and other admins of this community can
+						see this comment. You can safely remove it.
+					</div>
+				)}
 				{!isPreview && (
 					<div
 						className={classNames({
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/discussion.scss b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/discussion.scss
index aa042e8622..9cd916f21f 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/discussion.scss
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/discussion.scss
@@ -10,6 +10,18 @@ $bp: vendor.$bp-namespace;
 	padding: 1em 0em;
 	font-size: 14px;
 	text-align: left;
+	&.is-author-spam {
+		opacity: 0.9;
+	}
+	.discussion-spam-banner {
+		margin-bottom: 0.75em;
+		padding: 0.4em 0.6em;
+		font-size: 12px;
+		background: #fcf3cd;
+		color: #856404;
+		border-radius: 2px;
+		border-left: 3px solid #ffc107;
+	}
 	.collapse-button {
 		position: absolute;
 		top: 0;
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/threadComment.scss b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/threadComment.scss
index 382d010f48..66165dfb3d 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/threadComment.scss
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/threadComment.scss
@@ -8,6 +8,21 @@
 		margin-bottom: 1em;
 		border-bottom: 1px solid #f0f0f7;
 	}
+	&.is-spam {
+		.discussion-body-wrapper {
+			opacity: 0.85;
+		}
+	}
+	.thread-comment-spam-banner {
+		width: 100%;
+		margin-bottom: 0.5em;
+		padding: 0.4em 0.6em;
+		font-size: 12px;
+		background: #fcf3cd;
+		color: #856404;
+		border-radius: 2px;
+		border-left: 3px solid #ffc107;
+	}
 	&.is-preview {
 		.content-wrapper {
 			margin-bottom: 0;
diff --git a/server/utils/queryHelpers/discussionsSanitize.ts b/server/utils/queryHelpers/discussionsSanitize.ts
index 61500931b2..197c7bd043 100644
--- a/server/utils/queryHelpers/discussionsSanitize.ts
+++ b/server/utils/queryHelpers/discussionsSanitize.ts
@@ -1,5 +1,44 @@
 import { sanitizeOnVisibility } from './util';
 
+const isAuthorSpam = (author: { spamTag?: { status?: string } } | null) => {
+	return author?.spamTag?.status === 'confirmed-spam';
+};
+
 export default (discussions, activePermissions, loginId) => {
-	return sanitizeOnVisibility(discussions, activePermissions, loginId);
+	const { canAdmin } = activePermissions;
+	const afterVisibility = sanitizeOnVisibility(discussions, activePermissions, loginId);
+
+	return afterVisibility
+		.filter((discussion) => {
+			if (!isAuthorSpam(discussion.author)) {
+				return true;
+			}
+			return canAdmin;
+		})
+		.map((discussion) => {
+			const discussionAuthorSpam = isAuthorSpam(discussion.author);
+			const comments = (discussion.thread?.comments ?? [])
+				.filter((comment) => {
+					if (!isAuthorSpam(comment.author)) {
+						return true;
+					}
+					return canAdmin;
+				})
+				.map((comment) => {
+					const commentAuthorSpam = isAuthorSpam(comment.author);
+					if (!commentAuthorSpam) {
+						return comment;
+					}
+					return { ...comment, isAuthorSpam: true };
+				});
+
+			return {
+				...discussion,
+				...(discussionAuthorSpam && { isAuthorSpam: true }),
+				thread: {
+					...discussion.thread,
+					comments,
+				},
+			};
+		});
 };
diff --git a/server/utils/queryHelpers/util.ts b/server/utils/queryHelpers/util.ts
index 459338c3c4..108a8e7288 100644
--- a/server/utils/queryHelpers/util.ts
+++ b/server/utils/queryHelpers/util.ts
@@ -1,6 +1,7 @@
 import {
 	Commenter,
 	includeUserModel,
+	SpamTag,
 	Thread,
 	ThreadComment,
 	ThreadEvent,
@@ -50,7 +51,12 @@ export const sanitizeOnVisibility = (objectsWithVisibility, activePermissions, l
 	});
 };
 
-export const baseAuthor = [includeUserModel({ as: 'author' })];
+const authorWithSpamTag = () => ({
+	...includeUserModel({ as: 'author' }),
+	include: [{ model: SpamTag, as: 'spamTag' }],
+});
+
+export const baseAuthor = [authorWithSpamTag()];
 export const baseThread = [
 	{
 		model: Thread,
@@ -59,10 +65,7 @@ export const baseThread = [
 			{
 				model: ThreadComment,
 				as: 'comments',
-				include: [
-					includeUserModel({ as: 'author' }),
-					{ model: Commenter, as: 'commenter' },
-				],
+				include: [authorWithSpamTag(), { model: Commenter, as: 'commenter' }],
 			},
 			{
 				model: ThreadEvent,
diff --git a/types/pub.ts b/types/pub.ts
index 1f9e657d42..938a60bb13 100644
--- a/types/pub.ts
+++ b/types/pub.ts
@@ -49,8 +49,9 @@ export type PubDocInfo = {
 };
 
 export type PubPageDiscussion = DefinitelyHas<Discussion, 'anchors'> & {
+	isAuthorSpam?: boolean;
 	thread: Thread & {
-		comments: DefinitelyHas<ThreadComment, 'author'>[];
+		comments: (DefinitelyHas<ThreadComment, 'author'> & { isAuthorSpam?: boolean })[];
 	};
 };
 

From ab023fc0b33cf035e59af79ff09d91a482946315 Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Thu, 12 Feb 2026 21:10:57 +0100
Subject: [PATCH 06/16] fix: lint

---
 server/spamTag/api.ts   | 10 ++++++++--
 server/spamTag/users.ts | 16 +++++++++-------
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/server/spamTag/api.ts b/server/spamTag/api.ts
index 395deb0a0c..d18ed070ff 100644
--- a/server/spamTag/api.ts
+++ b/server/spamTag/api.ts
@@ -10,16 +10,22 @@ import { expect } from 'utils/assert';
 import { queryCommunitiesForSpamManagement } from './communities';
 import { canManipulateSpamTags } from './permissions';
 import { updateSpamTagForCommunity } from './queries';
+
 <<<<<<< HEAD
+
 import {
 	addSpamTagToUser,
 	getSpamTagForUser,
 	removeSpamTagFromUser,
 	updateSpamTagForUser,
 } from './userQueries';
+
 =======
+
 import { addSpamTagToUser, getSpamTagForUser, updateSpamTagForUser } from './userQueries';
+
 >>>>>>> master
+
 import { queryUsersForSpamManagement } from './users';
 
 export const router = Router();
@@ -172,10 +178,10 @@ router.post('/api/spamTags/queryUsersForSpam', async (req, res) => {
 		throw new ForbiddenError();
 	}
 <<<<<<< HEAD
-	const includeAll = !status || (Array.isArray(status) && status.length === 0);
+	const _includeAll = !status || (Array.isArray(status) && status.length === 0);
 =======
 >>>>>>> master
-	const queryResult = await queryUsersForSpamManagement({
+	const _queryResult = await queryUsersForSpamManagement({
 		offset: offset && parseInt(offset, 10),
 		limit: limit && parseInt(limit, 10),
 		ordering,
diff --git a/server/spamTag/users.ts b/server/spamTag/users.ts
index fe5e21ec2a..b257dd8510 100644
--- a/server/spamTag/users.ts
+++ b/server/spamTag/users.ts
@@ -3,9 +3,13 @@ import type * as types from 'types';
 import { Op } from 'sequelize';
 
 <<<<<<< HEAD
+
 import { Community, Discussion, Member, Pub, PubAttribution, SpamTag, User } from 'server/models';
+
 =======
+
 import { SpamTag, User } from 'server/models';
+
 >>>>>>> master
 
 const orderableFields = {
@@ -35,7 +39,7 @@ const getUserWhereQuery = (searchTerm?: string | null) => {
 };
 
 <<<<<<< HEAD
-const getSpamTagStatusWhereQuery = (status: undefined | types.SpamStatus[] | null) => {
+const _getSpamTagStatusWhereQuery = (status: undefined | types.SpamStatus[] | null) => {
 	if (status && status.length > 0) {
 =======
 const getSpamTagStatusWhereQuery = (status: undefined | types.SpamStatus[]) => {
@@ -47,7 +51,7 @@ const getSpamTagStatusWhereQuery = (status: undefined | types.SpamStatus[]) => {
 };
 
 type OrderFields = (typeof orderableFields)[keyof typeof orderableFields];
-const getQueryOrdering = (ordering: types.SpamUserQueryOrdering) => {
+const _getQueryOrdering = (ordering: types.SpamUserQueryOrdering) => {
 	const { field, direction } = ordering;
 	return [[...orderableFields[field], direction]] as [OrderFields[number], 'ASC' | 'DESC'][];
 };
@@ -62,7 +66,7 @@ type SerializedSpamUserRow = Record<string, unknown> & {
 	affiliation?: types.SpamUserAffiliation;
 };
 
-export const queryUsersForSpamManagement = async (
+export const _queryUsersForSpamManagement = async (
 	query: types.SpamUserQuery,
 ): Promise<SerializedSpamUserRow[]> => {
 	const { limit, offset, ordering, status, searchTerm, includeAffiliation } = query;
@@ -77,7 +81,7 @@ export const queryUsersForSpamManagement = async (
 	];
 	const rows = (await User.findAll({
 =======
-export const queryUsersForSpamManagement = (query: types.SpamUserQuery) => {
+export const _queryUsersForSpamManagement = (query: types.SpamUserQuery) => {
 	const { limit, offset, ordering, status, searchTerm } = query;
 	return User.findAll({
 >>>>>>> master
@@ -173,12 +177,10 @@ const getAffiliationForUserIds = async (
 	return map;
 =======
 		include: [
-			{
 				model: SpamTag,
 				as: 'spamTag',
 				required: true,
-				...getSpamTagStatusWhereQuery(status),
-			},
+				...getSpamTagStatusWhereQuery(status),,
 		],
 	}) as Promise<types.DefinitelyHas<User, 'spamTag'>[]>;
 >>>>>>> master

From 7843395765b44ff11d8728a5a6c5ace0b677251d Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Thu, 12 Feb 2026 21:13:17 +0100
Subject: [PATCH 07/16] fix: lint, fr

---
 server/routes/superAdminDashboard.tsx |  8 ----
 server/spamTag/api.ts                 | 68 +--------------------------
 server/spamTag/uploadScamKeywords.ts  |  5 --
 server/spamTag/userQueries.ts         |  3 --
 server/spamTag/users.ts               | 39 ++-------------
 5 files changed, 5 insertions(+), 118 deletions(-)

diff --git a/server/routes/superAdminDashboard.tsx b/server/routes/superAdminDashboard.tsx
index 1983188170..59512adbf6 100644
--- a/server/routes/superAdminDashboard.tsx
+++ b/server/routes/superAdminDashboard.tsx
@@ -40,20 +40,12 @@ const getTabProps = async (tabKind: SuperAdminTabKind, locationData: types.Locat
 	}
 	if (tabKind === 'spamUsers') {
 		const searchTerm = locationData.query.q ?? null;
-<<<<<<< HEAD
 		const { query } = spamUsersFiltersById['all'];
-=======
-		const { query } = spamUsersFiltersById[searchTerm ? 'recent' : 'unreviewed'];
->>>>>>> master
 		const users = await queryUsersForSpamManagement({
 			limit: 50,
 			searchTerm,
 			...query!,
 		});
-<<<<<<< HEAD
-=======
-		console.log('users', users);
->>>>>>> master
 		return {
 			searchTerm,
 			users,
diff --git a/server/spamTag/api.ts b/server/spamTag/api.ts
index d18ed070ff..edb16172c6 100644
--- a/server/spamTag/api.ts
+++ b/server/spamTag/api.ts
@@ -10,22 +10,12 @@ import { expect } from 'utils/assert';
 import { queryCommunitiesForSpamManagement } from './communities';
 import { canManipulateSpamTags } from './permissions';
 import { updateSpamTagForCommunity } from './queries';
-
-<<<<<<< HEAD
-
 import {
 	addSpamTagToUser,
 	getSpamTagForUser,
 	removeSpamTagFromUser,
 	updateSpamTagForUser,
 } from './userQueries';
-
-=======
-
-import { addSpamTagToUser, getSpamTagForUser, updateSpamTagForUser } from './userQueries';
-
->>>>>>> master
-
 import { queryUsersForSpamManagement } from './users';
 
 export const router = Router();
@@ -106,7 +96,6 @@ router.post('/api/spamTags/queryCommunitiesForSpam', async (req, res) => {
 	return res.status(200).send(queryResult);
 });
 
-<<<<<<< HEAD
 router.delete(
 	'/api/spamTags/user',
 	wrap(async (req, res) => {
@@ -120,52 +109,6 @@ router.delete(
 		}
 		await removeSpamTagFromUser(userId);
 		return res.status(200).send({});
-=======
-router.post(
-	'/api/spamTags/addUser',
-	wrap(async (req, res) => {
-		const canAdd = await canManipulateSpamTags({ userId: req.user?.id });
-		if (!canAdd) {
-			throw new ForbiddenError();
-		}
-		const { identifier } = req.body;
-		if (!identifier || typeof identifier !== 'string') {
-			return res.status(400).send({ error: 'identifier required' });
-		}
-		const trimmed = identifier.trim();
-		const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
-			trimmed,
-		);
-		let user: User | null = null;
-		if (isUuid) {
-			user = await User.findOne({
-				where: { id: trimmed },
-				include: [{ model: SpamTag, as: 'spamTag' }],
-			});
-		}
-		if (!user && trimmed.includes('@')) {
-			user = await User.findOne({
-				where: { email: trimmed },
-				include: [{ model: SpamTag, as: 'spamTag' }],
-			});
-		}
-		if (!user) {
-			user = await User.findOne({
-				where: { slug: trimmed },
-				include: [{ model: SpamTag, as: 'spamTag' }],
-			});
-		}
-		if (!user) {
-			return res.status(404).send({ error: 'User not found' });
-		}
-		await addSpamTagToUser(user.id);
-		const withTag = await User.findOne({
-			where: { id: user.id },
-			attributes: ['id', 'fullName', 'email', 'slug', 'createdAt'],
-			include: [{ model: SpamTag, as: 'spamTag', required: true }],
-		});
-		return res.status(200).send(withTag);
->>>>>>> master
 	}),
 );
 
@@ -177,21 +120,14 @@ router.post('/api/spamTags/queryUsersForSpam', async (req, res) => {
 	if (!canQuery) {
 		throw new ForbiddenError();
 	}
-<<<<<<< HEAD
-	const _includeAll = !status || (Array.isArray(status) && status.length === 0);
-=======
->>>>>>> master
-	const _queryResult = await queryUsersForSpamManagement({
+	const includeAll = !status || (Array.isArray(status) && status.length === 0);
+	const queryResult = await queryUsersForSpamManagement({
 		offset: offset && parseInt(offset, 10),
 		limit: limit && parseInt(limit, 10),
 		ordering,
 		searchTerm,
-<<<<<<< HEAD
 		status: status ?? null,
 		includeAffiliation: includeAll,
-=======
-		status,
->>>>>>> master
 	});
 	return res.status(200).send(queryResult);
 });
diff --git a/server/spamTag/uploadScamKeywords.ts b/server/spamTag/uploadScamKeywords.ts
index 848b35e789..2daca61d2e 100644
--- a/server/spamTag/uploadScamKeywords.ts
+++ b/server/spamTag/uploadScamKeywords.ts
@@ -13,12 +13,7 @@ export const uploadScamKeywords = [
 ] as const;
 
 export const isSuspiciousUploadKey = (keyOrFilename: string): boolean => {
-<<<<<<< HEAD
 	const extraSuspiciousKeywords = process.env.EXTRA_SUSPICIOUS_KEYWORDS?.split(',') ?? [];
 	const lower = keyOrFilename.toLowerCase();
 	return [...uploadScamKeywords, ...extraSuspiciousKeywords].some((kw) => lower.includes(kw));
-=======
-	const lower = keyOrFilename.toLowerCase();
-	return uploadScamKeywords.some((kw) => lower.includes(kw));
->>>>>>> master
 };
diff --git a/server/spamTag/userQueries.ts b/server/spamTag/userQueries.ts
index d9c96ff61c..92a029932b 100644
--- a/server/spamTag/userQueries.ts
+++ b/server/spamTag/userQueries.ts
@@ -84,7 +84,6 @@ export const updateSpamTagForUser = async (options: UpdateSpamTagForUserOptions)
 		throw new Error('User is missing a SpamTag');
 	}
 };
-<<<<<<< HEAD
 
 export const removeSpamTagFromUser = async (userId: string) => {
 	const spamTag = await getSpamTagForUser(userId);
@@ -96,5 +95,3 @@ export const removeSpamTagFromUser = async (userId: string) => {
 		await spamTag.destroy();
 	}
 };
-=======
->>>>>>> master
diff --git a/server/spamTag/users.ts b/server/spamTag/users.ts
index b257dd8510..1a84d0e2ef 100644
--- a/server/spamTag/users.ts
+++ b/server/spamTag/users.ts
@@ -2,16 +2,8 @@ import type * as types from 'types';
 
 import { Op } from 'sequelize';
 
-<<<<<<< HEAD
-
 import { Community, Discussion, Member, Pub, PubAttribution, SpamTag, User } from 'server/models';
 
-=======
-
-import { SpamTag, User } from 'server/models';
-
->>>>>>> master
-
 const orderableFields = {
 	'user-created-at': ['createdAt'],
 	'spam-status-updated-at': [{ model: SpamTag, as: 'spamTag' }, 'statusUpdatedAt'],
@@ -19,10 +11,6 @@ const orderableFields = {
 } as const;
 
 const getUserWhereQuery = (searchTerm?: string | null) => {
-<<<<<<< HEAD
-=======
-	console.log('searchTerm', searchTerm);
->>>>>>> master
 	if (searchTerm) {
 		const normalizedQuery = `%${searchTerm.trim()}%`;
 		return {
@@ -38,25 +26,19 @@ const getUserWhereQuery = (searchTerm?: string | null) => {
 	return {};
 };
 
-<<<<<<< HEAD
-const _getSpamTagStatusWhereQuery = (status: undefined | types.SpamStatus[] | null) => {
+const getSpamTagStatusWhereQuery = (status: undefined | types.SpamStatus[] | null) => {
 	if (status && status.length > 0) {
-=======
-const getSpamTagStatusWhereQuery = (status: undefined | types.SpamStatus[]) => {
-	if (status) {
->>>>>>> master
 		return { where: { status: { [Op.in]: status } } };
 	}
 	return {};
 };
 
 type OrderFields = (typeof orderableFields)[keyof typeof orderableFields];
-const _getQueryOrdering = (ordering: types.SpamUserQueryOrdering) => {
+const getQueryOrdering = (ordering: types.SpamUserQueryOrdering) => {
 	const { field, direction } = ordering;
 	return [[...orderableFields[field], direction]] as [OrderFields[number], 'ASC' | 'DESC'][];
 };
 
-<<<<<<< HEAD
 export type UserSpamManagementRow =
 	| types.DefinitelyHas<User, 'spamTag'>
 	| (types.User & { spamTag: null });
@@ -66,7 +48,7 @@ type SerializedSpamUserRow = Record<string, unknown> & {
 	affiliation?: types.SpamUserAffiliation;
 };
 
-export const _queryUsersForSpamManagement = async (
+export const queryUsersForSpamManagement = async (
 	query: types.SpamUserQuery,
 ): Promise<SerializedSpamUserRow[]> => {
 	const { limit, offset, ordering, status, searchTerm, includeAffiliation } = query;
@@ -80,17 +62,11 @@ export const _queryUsersForSpamManagement = async (
 		},
 	];
 	const rows = (await User.findAll({
-=======
-export const _queryUsersForSpamManagement = (query: types.SpamUserQuery) => {
-	const { limit, offset, ordering, status, searchTerm } = query;
-	return User.findAll({
->>>>>>> master
 		...getUserWhereQuery(searchTerm),
 		attributes: ['id', 'fullName', 'email', 'slug', 'createdAt'],
 		limit,
 		offset,
 		order: getQueryOrdering(ordering),
-<<<<<<< HEAD
 		include,
 	})) as UserSpamManagementRow[];
 
@@ -175,13 +151,4 @@ const getAffiliationForUserIds = async (
 		});
 	}
 	return map;
-=======
-		include: [
-				model: SpamTag,
-				as: 'spamTag',
-				required: true,
-				...getSpamTagStatusWhereQuery(status),,
-		],
-	}) as Promise<types.DefinitelyHas<User, 'spamTag'>[]>;
->>>>>>> master
 };

From d75a949eedd5c43a038aa6fe48870beac2b13085 Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Thu, 12 Feb 2026 19:10:12 +0100
Subject: [PATCH 08/16] feat: captchas and honeypots

---
 client/components/Altcha/Altcha.tsx           | 180 +++++++++++++++++
 client/components/Altcha/index.ts             |   1 +
 .../GlobalControls/CreatePubButton.tsx        |  52 +++--
 client/components/Honeypot/Honeypot.tsx       |  52 +++++
 client/components/Honeypot/honeypot.scss      |   8 +
 client/components/Honeypot/index.ts           |   1 +
 client/components/Layout/LayoutBanner.tsx     |  72 +++++--
 client/components/index.ts                    |   2 +
 .../App/Breadcrumbs/Breadcrumbs.tsx           |  44 ++--
 .../CommunityCreate/CommunityCreate.tsx       |  59 +++---
 client/containers/Login/Login.tsx             |  74 ++++---
 .../Discussion/DiscussionInput.tsx            | 189 ++++++++++--------
 client/containers/Signup/Signup.tsx           | 107 ++++++----
 .../UserSpam/UserSpamEntry.tsx                |  26 ++-
 client/containers/User/UserEdit.tsx           |  12 +-
 client/containers/UserCreate/UserCreate.tsx   |  56 +++---
 client/utils/apiFetch.ts                      |   8 +-
 client/webpack/webpackConfig.dev.js           |   4 +-
 client/webpack/webpackConfig.prod.js          |   4 +-
 package.json                                  |   2 +
 pnpm-lock.yaml                                |  33 +++
 server/apiRoutes.ts                           |   2 +
 server/captcha/api.ts                         |  17 ++
 server/community/api.ts                       |  28 ++-
 server/discussion/api.ts                      |  29 ++-
 server/login/api.ts                           |  48 ++---
 server/pub/api.ts                             |  36 +++-
 server/signup/api.ts                          |  19 +-
 server/spamTag/__tests__/userQueries.test.ts  | 107 ++++++++++
 server/spamTag/api.ts                         |  31 ---
 server/spamTag/userQueries.ts                 |  50 +++--
 server/threadComment/api.ts                   |  28 ++-
 server/user/api.ts                            |  82 +++++---
 server/utils/__tests__/captcha.test.ts        |  62 ++++++
 server/utils/__tests__/honeypot.test.ts       |  28 +++
 .../__tests__/honeypotIntegration.test.ts     |  57 ++++++
 server/utils/captcha.ts                       |  21 ++
 server/utils/honeypot.ts                      |  19 ++
 types/spam.ts                                 |  18 ++
 utils/api/contracts/auth.ts                   |  24 +++
 utils/api/contracts/pub.ts                    |  17 ++
 utils/api/schemas/community.ts                |   4 +
 utils/api/schemas/pub.ts                      |   2 +-
 utils/api/server.ts                           |   3 +-
 44 files changed, 1331 insertions(+), 387 deletions(-)
 create mode 100644 client/components/Altcha/Altcha.tsx
 create mode 100644 client/components/Altcha/index.ts
 create mode 100644 client/components/Honeypot/Honeypot.tsx
 create mode 100644 client/components/Honeypot/honeypot.scss
 create mode 100644 client/components/Honeypot/index.ts
 create mode 100644 server/captcha/api.ts
 create mode 100644 server/spamTag/__tests__/userQueries.test.ts
 create mode 100644 server/utils/__tests__/captcha.test.ts
 create mode 100644 server/utils/__tests__/honeypot.test.ts
 create mode 100644 server/utils/__tests__/honeypotIntegration.test.ts
 create mode 100644 server/utils/captcha.ts
 create mode 100644 server/utils/honeypot.ts

diff --git a/client/components/Altcha/Altcha.tsx b/client/components/Altcha/Altcha.tsx
new file mode 100644
index 0000000000..dba4c32e96
--- /dev/null
+++ b/client/components/Altcha/Altcha.tsx
@@ -0,0 +1,180 @@
+import React, { forwardRef, useEffect, useImperativeHandle, useRef, useState } from 'react';
+
+import { usePageContext } from 'utils/hooks';
+
+export type AltchaRef = {
+	value: string | null;
+	verify: () => Promise<string>;
+};
+
+type AltchaProps = {
+	challengeurl?: string;
+	auto?: 'off' | 'onfocus' | 'onload' | 'onsubmit';
+	onStateChange?: (ev: Event | CustomEvent<{ payload?: string; state: string }>) => void;
+	style?: React.CSSProperties & Record<string, string>;
+};
+
+const DEFAULT_CHALLENGE_URL = '/api/captcha/challenge';
+
+type WidgetElement = HTMLElement & {
+	verify: () => Promise<void>;
+	reset: (state?: string, err?: Error) => void;
+	addEventListener: HTMLElement['addEventListener'];
+	removeEventListener: HTMLElement['removeEventListener'];
+} & AltchaWidgetMethods;
+
+const Altcha = forwardRef<AltchaRef, AltchaProps>((props, ref) => {
+	const { challengeurl = DEFAULT_CHALLENGE_URL, auto, onStateChange, style } = props;
+	const { locationData } = usePageContext();
+	const devMode = false; //!locationData.isProd;
+	const widgetRef = useRef<WidgetElement | null>(null);
+	const [value, setValue] = useState<string | null>(null);
+	const [loaded, setLoaded] = useState(false);
+	const [simulateFailure, setSimulateFailure] = useState(false);
+	// force remount when mockerror changes
+	const [widgetKey, setWidgetKey] = useState(0);
+	const valueRef = useRef<string | null>(null);
+	valueRef.current = value;
+
+	useEffect(() => {
+		import('altcha').then(() => setLoaded(true));
+	}, []);
+
+	// biome-ignore lint/correctness/useExhaustiveDependencies: widgetKey triggers re-attach after remount
+	useEffect(() => {
+		if (!loaded) return;
+		const w = widgetRef.current;
+		if (!w) return;
+		const handleStateChange = (ev: Event) => {
+			const e = ev as CustomEvent<{ payload?: string; state: string }>;
+			if (e.detail?.payload) setValue(e.detail.payload);
+			onStateChange?.(e);
+		};
+		w.addEventListener('statechange', handleStateChange);
+		return () => w.removeEventListener('statechange', handleStateChange);
+	}, [loaded, onStateChange, widgetKey]);
+
+	// biome-ignore lint/correctness/useExhaustiveDependencies: widgetKey triggers re-bind after remount
+	useImperativeHandle(
+		ref,
+		() => ({
+			get value() {
+				return valueRef.current;
+			},
+			verify(): Promise<string> {
+				const w = widgetRef.current;
+				if (!w) return Promise.reject(new Error('Altcha widget not mounted'));
+				const current = valueRef.current;
+				if (current) return Promise.resolve(current);
+				return new Promise((resolve, reject) => {
+					const handler = (ev: Event) => {
+						const e = ev as CustomEvent<{ payload?: string; state: string }>;
+						const state = e.detail?.state;
+						if (state === 'verified' && e.detail?.payload) {
+							w.removeEventListener('statechange', handler);
+							resolve(e.detail.payload);
+							return;
+						}
+						if (state === 'error' || state === 'expired') {
+							w.removeEventListener('statechange', handler);
+							w.show();
+							reject(new Error('Captcha verification failed'));
+						}
+					};
+					w.addEventListener('statechange', handler);
+					w.verify();
+				});
+			},
+		}),
+		[widgetKey],
+	);
+
+	const handleToggleFailure = () => {
+		setSimulateFailure((prev) => !prev);
+		setValue(null);
+		setWidgetKey((k) => k + 1);
+	};
+
+	const handleReset = () => {
+		setValue(null);
+		widgetRef.current?.reset();
+	};
+
+	if (!loaded) return null;
+
+	const widget = (
+		<React.Fragment key={widgetKey}>
+			<altcha-widget
+				ref={widgetRef as any}
+				challengeurl={challengeurl}
+				{...(auto ? { auto } : {})}
+				{...(devMode ? { debug: true, floating: true } : { floating: true })}
+				{...(simulateFailure ? { mockerror: true } : {})}
+				style={style as any}
+			/>
+		</React.Fragment>
+	);
+
+	if (!devMode) return widget;
+
+	return (
+		<div
+			style={{
+				border: '2px dashed #5c7080',
+				borderRadius: 4,
+				padding: 8,
+				margin: '8px 0',
+				background: '#f5f8fa',
+			}}
+		>
+			<div
+				style={{
+					fontSize: 11,
+					fontWeight: 600,
+					color: '#5c7080',
+					marginBottom: 6,
+				}}
+			>
+				Captcha (dev only)
+			</div>
+			{widget}
+			<div style={{ marginTop: 6, display: 'flex', gap: 8, alignItems: 'center' }}>
+				<label
+					style={{
+						fontSize: 11,
+						color: simulateFailure ? '#db3737' : '#5c7080',
+						cursor: 'pointer',
+						display: 'flex',
+						alignItems: 'center',
+						gap: 4,
+					}}
+				>
+					<input
+						type="checkbox"
+						checked={simulateFailure}
+						onChange={handleToggleFailure}
+					/>
+					Simulate failure
+				</label>
+				<button
+					type="button"
+					onClick={handleReset}
+					style={{
+						fontSize: 11,
+						padding: '2px 8px',
+						cursor: 'pointer',
+						border: '1px solid #ced9e0',
+						borderRadius: 3,
+						background: 'white',
+					}}
+				>
+					Reset
+				</button>
+			</div>
+		</div>
+	);
+});
+
+Altcha.displayName = 'Altcha';
+
+export default Altcha;
diff --git a/client/components/Altcha/index.ts b/client/components/Altcha/index.ts
new file mode 100644
index 0000000000..13dcaca628
--- /dev/null
+++ b/client/components/Altcha/index.ts
@@ -0,0 +1 @@
+export { default, type AltchaRef } from './Altcha';
diff --git a/client/components/GlobalControls/CreatePubButton.tsx b/client/components/GlobalControls/CreatePubButton.tsx
index aea3c48b5e..9d3866e5ca 100644
--- a/client/components/GlobalControls/CreatePubButton.tsx
+++ b/client/components/GlobalControls/CreatePubButton.tsx
@@ -1,35 +1,53 @@
-import React, { useState } from 'react';
+import type * as types from 'types';
+
+import React, { useRef, useState } from 'react';
 
 import { apiFetch } from 'client/utils/apiFetch';
+import { Altcha, Honeypot } from 'components';
 import { usePageContext } from 'utils/hooks';
 
 import GlobalControlsButton from './GlobalControlsButton';
 
 const CreatePubButton = () => {
 	const [isLoading, setIsLoading] = useState(false);
+	const altchaRef = useRef<import('components').AltchaRef>(null);
 	const { communityData } = usePageContext();
 
-	const handleCreatePub = () => {
+	const handleCreatePub = async (evt: React.FormEvent<HTMLFormElement>) => {
+		evt.preventDefault();
+		const formData = new FormData(evt.currentTarget);
+		const honeypot = (formData.get('description') as string) ?? '';
 		setIsLoading(true);
-		return apiFetch
-			.post('/api/pubs', { communityId: communityData.id })
-			.then((newPub) => {
-				window.location.href = `/pub/${newPub.slug}`;
-			})
-			.catch((err) => {
-				console.error(err);
-				setIsLoading(false);
+		try {
+			const altchaPayload = await altchaRef.current?.verify();
+			if (!altchaPayload) return;
+			const newPub = await apiFetch.post<types.Pub>('/api/pubs/fromForm', {
+				communityId: communityData.id,
+				altcha: altchaPayload,
+				_honeypot: honeypot,
 			});
+			window.location.href = `/pub/${newPub.slug}`;
+		} finally {
+			setIsLoading(false);
+		}
 	};
 
 	return (
-		<GlobalControlsButton
-			loading={isLoading}
-			aria-label="Create Pub"
-			onClick={handleCreatePub}
-			desktop={{ text: 'Create Pub' }}
-			mobile={{ icon: 'pubDocNew' }}
-		/>
+		<form
+			onSubmit={handleCreatePub}
+			// only relevant in dev
+			style={{ display: 'flex', alignItems: 'center', gap: '10px' }}
+		>
+			<Altcha ref={altchaRef} />
+			<Honeypot name="description" />
+			<GlobalControlsButton
+				loading={isLoading}
+				aria-label="Create Pub"
+				type="submit"
+				desktop={{ text: 'Create Pub' }}
+				mobile={{ icon: 'pubDocNew' }}
+			/>
+		</form>
 	);
 };
 
diff --git a/client/components/Honeypot/Honeypot.tsx b/client/components/Honeypot/Honeypot.tsx
new file mode 100644
index 0000000000..3fce8682ce
--- /dev/null
+++ b/client/components/Honeypot/Honeypot.tsx
@@ -0,0 +1,52 @@
+import React from 'react';
+
+import { usePageContext } from 'utils/hooks';
+
+import './honeypot.scss';
+
+type HoneypotProps = {
+	name: string;
+};
+
+const Honeypot = (props: HoneypotProps) => {
+	const { name } = props;
+	const { locationData } = usePageContext();
+	const devMode = !locationData.isProd;
+
+	if (devMode) {
+		return (
+			<div
+				className="honeypot-dev"
+				style={{
+					border: '2px dashed orange',
+					padding: 8,
+					margin: '8px 0',
+					borderRadius: 4,
+				}}
+			>
+				<label style={{ fontSize: 11, color: 'orange', fontWeight: 600 }}>
+					Honeypot ({name}) - visible in dev only
+					<input
+						type="text"
+						name={name}
+						autoComplete="off"
+						style={{ display: 'block', marginTop: 4, width: '100%' }}
+					/>
+				</label>
+			</div>
+		);
+	}
+
+	return (
+		<input
+			type="text"
+			className="honeypot-input"
+			name={name}
+			tabIndex={-1}
+			autoComplete="off"
+			aria-hidden="true"
+		/>
+	);
+};
+
+export default Honeypot;
diff --git a/client/components/Honeypot/honeypot.scss b/client/components/Honeypot/honeypot.scss
new file mode 100644
index 0000000000..a35b7dc422
--- /dev/null
+++ b/client/components/Honeypot/honeypot.scss
@@ -0,0 +1,8 @@
+.honeypot-input {
+	position: absolute;
+	left: -9999px;
+	width: 1px;
+	height: 1px;
+	opacity: 0;
+	pointer-events: none;
+}
diff --git a/client/components/Honeypot/index.ts b/client/components/Honeypot/index.ts
new file mode 100644
index 0000000000..e8624180f0
--- /dev/null
+++ b/client/components/Honeypot/index.ts
@@ -0,0 +1 @@
+export { default } from './Honeypot';
diff --git a/client/components/Layout/LayoutBanner.tsx b/client/components/Layout/LayoutBanner.tsx
index 5ae562b5aa..3c3b95acc1 100644
--- a/client/components/Layout/LayoutBanner.tsx
+++ b/client/components/Layout/LayoutBanner.tsx
@@ -1,9 +1,10 @@
-import React, { Component } from 'react';
+import React, { Component, createRef } from 'react';
 
-import { AnchorButton, Classes, Tooltip } from '@blueprintjs/core';
+import { AnchorButton, Button, Classes, Tooltip } from '@blueprintjs/core';
 import Color from 'color';
 
 import { apiFetch } from 'client/utils/apiFetch';
+import { Altcha, Honeypot } from 'components';
 import { getResizedUrl } from 'utils/images';
 
 import './layoutBanner.scss';
@@ -34,6 +35,8 @@ const createPubFailureText =
 	'Error creating a new Pub. You may want to refresh the page and try again.';
 
 class LayoutBanner extends Component<Props, State> {
+	altchaRef = createRef<import('components').AltchaRef>();
+
 	constructor(props: Props) {
 		super(props);
 		this.state = {
@@ -43,16 +46,25 @@ class LayoutBanner extends Component<Props, State> {
 		this.createPub = this.createPub.bind(this);
 	}
 
-	createPub() {
+	createPub(evt: React.FormEvent<HTMLFormElement>) {
+		evt.preventDefault();
+		const formData = new FormData(evt.currentTarget);
+		const honeypot = (formData.get('description') as string) ?? '';
 		const { communityData, content } = this.props;
 		this.setState({ isLoading: true, buttonError: null });
-		return apiFetch('/api/pubs', {
-			method: 'POST',
-			body: JSON.stringify({
-				communityId: communityData.id,
-				createPubToken: content.createPubToken,
-			}),
-		})
+		this.altchaRef.current
+			?.verify()
+			.then((altchaPayload) =>
+				apiFetch('/api/pubs/fromForm', {
+					method: 'POST',
+					body: JSON.stringify({
+						communityId: communityData.id,
+						createPubToken: content.createPubToken,
+						altcha: altchaPayload,
+						_honeypot: honeypot,
+					}),
+				}),
+			)
 			.then((newPub) => {
 				window.location.href = `/pub/${newPub.slug}`;
 				this.setState({ isLoading: false });
@@ -85,18 +97,34 @@ class LayoutBanner extends Component<Props, State> {
 			buttonUrl = 'signup';
 		}
 
-		const onButtonClick =
-			(isLoggedIn && buttonType === 'create-pub' && this.createPub) || undefined;
-
-		const button = (
-			<AnchorButton
-				className={Classes.LARGE}
-				onClick={onButtonClick}
-				loading={this.state.isLoading}
-				text={buttonText}
-				href={buttonUrl}
-			/>
-		);
+		// const onButtonClick =
+		// 	(isLoggedIn && buttonType === 'create-pub' && this.createPub) || undefined;
+
+		let button: React.ReactNode;
+
+		if (isLoggedIn && buttonType === 'create-pub') {
+			button = (
+				<form onSubmit={this.createPub}>
+					<Altcha ref={this.altchaRef} />
+					<Honeypot name="description" />
+					<Button
+						type="submit"
+						className={Classes.LARGE}
+						text="Create Pub"
+						loading={this.state.isLoading}
+					/>
+				</form>
+			);
+		} else {
+			button = (
+				<AnchorButton
+					className={Classes.LARGE}
+					href={buttonUrl}
+					loading={this.state.isLoading}
+					text={buttonText}
+				/>
+			);
+		}
 
 		return buttonError ? (
 			<Tooltip content={buttonError} defaultIsOpen={true}>
diff --git a/client/components/index.ts b/client/components/index.ts
index 23b957915c..8b57d940a5 100644
--- a/client/components/index.ts
+++ b/client/components/index.ts
@@ -1,4 +1,5 @@
 export { default as AccentStyle } from './AccentStyle/AccentStyle';
+export { default as Altcha, type AltchaRef } from './Altcha';
 export { default as AssignDoi } from './AssignDoi/AssignDoi';
 export { default as AttributionEditor } from './AttributionEditor/AttributionEditor';
 export { default as Avatar } from './Avatar/Avatar';
@@ -43,6 +44,7 @@ export { default as FormattingBar } from './FormattingBar/FormattingBar';
 export { default as GlobalControls } from './GlobalControls';
 export { default as GridWrapper } from './GridWrapper/GridWrapper';
 export { default as Header } from './Header/Header';
+export { default as Honeypot } from './Honeypot';
 export { default as Icon, type IconName } from './Icon/Icon';
 export { default as ImageCropper } from './ImageCropper/ImageCropper';
 export { default as ImageUpload } from './ImageUpload/ImageUpload';
diff --git a/client/containers/App/Breadcrumbs/Breadcrumbs.tsx b/client/containers/App/Breadcrumbs/Breadcrumbs.tsx
index 43149a495b..02970cea63 100644
--- a/client/containers/App/Breadcrumbs/Breadcrumbs.tsx
+++ b/client/containers/App/Breadcrumbs/Breadcrumbs.tsx
@@ -1,10 +1,10 @@
-import React, { useState } from 'react';
+import React, { useRef, useState } from 'react';
 
 import { AnchorButton, Button, Intent } from '@blueprintjs/core';
 import classNames from 'classnames';
 
 import { apiFetch } from 'client/utils/apiFetch';
-import { Avatar, Icon } from 'components';
+import { Altcha, Avatar, Honeypot, Icon } from 'components';
 import { getDashUrl } from 'utils/dashboard';
 import { usePageContext } from 'utils/hooks';
 
@@ -26,6 +26,7 @@ const Breadcrumbs = (props: Props) => {
 	const { mode, subMode } = dashboardMenu.activeMode!;
 	const [newPubIsLoading, setNewPubIsLoading] = useState(false);
 	const [newCollectionIsOpen, setNewCollectionIsOpen] = useState(false);
+	const createPubAltchaRef = useRef<import('components').AltchaRef>(null);
 
 	// console.log(locationData.path.split('/'), locationData.path.split('/').slice(-1))
 	// const modesWithSubmodes = ['discussions', 'reviews', 'pages'];
@@ -44,20 +45,24 @@ const Breadcrumbs = (props: Props) => {
 		avatar = activePub.avatar;
 	}
 
-	const handleCreatePub = () => {
+	const handleCreatePub = async (evt: React.FormEvent<HTMLFormElement>) => {
+		evt.preventDefault();
+		const formData = new FormData(evt.currentTarget);
+		const honeypot = (formData.get('description') as string) ?? '';
 		setNewPubIsLoading(true);
-		return apiFetch
-			.post('/api/pubs', {
+		try {
+			const altchaPayload = await createPubAltchaRef.current?.verify();
+			if (!altchaPayload) return;
+			const newPub = await apiFetch.post('/api/pubs/fromForm', {
 				communityId: communityData.id,
 				collectionId: activeCollection && activeCollection.id,
-			})
-			.then((newPub) => {
-				window.location.href = `/pub/${newPub.slug}`;
-			})
-			.catch((err) => {
-				console.error(err);
-				setNewPubIsLoading(false);
+				altcha: altchaPayload,
+				_honeypot: honeypot,
 			});
+			window.location.href = `/pub/${newPub.slug}`;
+		} finally {
+			setNewPubIsLoading(false);
+		}
 	};
 
 	const actions = {
@@ -71,14 +76,14 @@ const Breadcrumbs = (props: Props) => {
 			},
 			{
 				text: 'Create Pub',
-				onClick: handleCreatePub,
+				// onClick: handleCreatePub,
 				minPermissions: 'manage',
 			},
 		],
 		collection: [
 			{
 				text: 'Create Pub',
-				onClick: handleCreatePub,
+				// onClick: handleCreatePub,
 				minPermissions: 'manage',
 			},
 			activeCollection && {
@@ -202,6 +207,17 @@ const Breadcrumbs = (props: Props) => {
 								disabled: action.text !== 'Create Pub' && newPubIsLoading,
 								outlined: true,
 							};
+							if (action.text === 'Create Pub') {
+								const { onClick: _, ...buttonProps } = buttonsProps;
+								return (
+									<form key={action.text} onSubmit={handleCreatePub}>
+										<Altcha ref={createPubAltchaRef} />
+										<Honeypot name="description" />
+										<Button {...buttonProps} type="submit" />
+									</form>
+								);
+							}
+
 							return buttonsProps.href ? (
 								<AnchorButton {...buttonsProps} />
 							) : (
diff --git a/client/containers/CommunityCreate/CommunityCreate.tsx b/client/containers/CommunityCreate/CommunityCreate.tsx
index bdae6c4658..b04e2426bf 100644
--- a/client/containers/CommunityCreate/CommunityCreate.tsx
+++ b/client/containers/CommunityCreate/CommunityCreate.tsx
@@ -1,9 +1,9 @@
-import React, { useState } from 'react';
+import React, { useRef, useState } from 'react';
 
 import { Button, Checkbox, Classes, NonIdealState } from '@blueprintjs/core';
 
 import { apiFetch } from 'client/utils/apiFetch';
-import { ColorInput, GridWrapper, ImageUpload, InputField } from 'components';
+import { Altcha, ColorInput, GridWrapper, Honeypot, ImageUpload, InputField } from 'components';
 import { usePageContext } from 'utils/hooks';
 import { slugifyString } from 'utils/strings';
 
@@ -11,6 +11,7 @@ import './communityCreate.scss';
 
 const CommunityCreate = () => {
 	const { loginData } = usePageContext();
+	const altchaRef = useRef<import('components').AltchaRef>(null);
 	const [subdomain, setSubdomain] = useState('');
 	const [title, setTitle] = useState('');
 	const [description, setDescription] = useState('');
@@ -21,32 +22,39 @@ const CommunityCreate = () => {
 	const [createIsLoading, setCreateIsLoading] = useState(false);
 	const [createError, setCreateError] = useState<string | undefined>(undefined);
 
-	const onCreateSubmit = (evt) => {
+	const onCreateSubmit = async (evt: React.FormEvent<HTMLFormElement>) => {
 		evt.preventDefault();
 		setCreateIsLoading(true);
 		if (!acceptTerms) return false;
-		return apiFetch('/api/communities', {
-			method: 'POST',
-			body: JSON.stringify({
-				subdomain,
-				title,
-				description,
-				headerLogo: heroLogo,
-				heroLogo,
-				accentColorLight,
-				accentColorDark,
-			}),
-		})
-			.then(() => {
-				setCreateIsLoading(false);
-				setCreateError(undefined);
-
-				window.location.href = `https://${subdomain}.pubpub.org`;
-			})
-			.catch((err) => {
-				setCreateIsLoading(false);
-				setCreateError(err);
+		const formData = new FormData(evt.currentTarget);
+		const honeypot = (formData.get('website') as string) ?? '';
+		const payload = {
+			subdomain,
+			title,
+			description,
+			headerLogo: heroLogo,
+			heroLogo,
+			accentColorLight,
+			accentColorDark,
+			_honeypot: honeypot,
+		};
+		const altchaPayload = await altchaRef.current?.verify();
+		if (!altchaPayload) {
+			setCreateIsLoading(false);
+			return;
+		}
+		try {
+			const newCommunity = await apiFetch.post<string>('/api/communities', {
+				...payload,
+				altcha: altchaPayload,
 			});
+			window.location.href = newCommunity;
+			setCreateIsLoading(false);
+		} catch (error) {
+			setCreateIsLoading(false);
+			setCreateError((error as Error).message);
+			return;
+		}
 	};
 	const onSubdomainChange = (evt) => {
 		setSubdomain(slugifyString(evt.target.value));
@@ -97,6 +105,8 @@ const CommunityCreate = () => {
 							.
 						</p>
 						<form onSubmit={onCreateSubmit}>
+							<Altcha ref={altchaRef} auto="onload" />
+							<Honeypot name="website" />
 							<InputField
 								label="URL"
 								isRequired={true}
@@ -173,7 +183,6 @@ const CommunityCreate = () => {
 									name="create"
 									type="submit"
 									className={`${Classes.BUTTON} ${Classes.INTENT_PRIMARY} create-account-button`}
-									onClick={onCreateSubmit}
 									text="Create Community"
 									disabled={!subdomain || !title || !acceptTerms}
 									loading={createIsLoading}
diff --git a/client/containers/Login/Login.tsx b/client/containers/Login/Login.tsx
index 31860aaf71..190b0fd0fb 100644
--- a/client/containers/Login/Login.tsx
+++ b/client/containers/Login/Login.tsx
@@ -5,7 +5,8 @@ import encHex from 'crypto-js/enc-hex';
 import SHA3 from 'crypto-js/sha3';
 
 import { apiFetch } from 'client/utils/apiFetch';
-import { Avatar, GridWrapper, InputField } from 'components';
+import type { AltchaRef } from 'components';
+import { Altcha, Avatar, GridWrapper, InputField } from 'components';
 import { usePageContext } from 'utils/hooks';
 
 import './login.scss';
@@ -16,6 +17,7 @@ const Login = () => {
 	const [logoutLoading, setLogoutLoading] = useState(false);
 	const emailRef = useRef(null);
 	const passwordRef = useRef(null);
+	const altchaRef = useRef<AltchaRef>(null);
 	const { locationData, loginData, communityData } = usePageContext();
 	const onLoginSubmit = (evt) => {
 		evt.preventDefault();
@@ -34,30 +36,38 @@ const Login = () => {
 		}
 		setLoginLoading(true);
 		setLoginError(undefined);
-		return apiFetch('/api/login', {
-			method: 'POST',
-			body: JSON.stringify({
-				// @ts-expect-error ts-migrate(2531) FIXME: Object is possibly 'null'.
-				email: emailRef.current.value.toLowerCase(),
-				// @ts-expect-error ts-migrate(2531) FIXME: Object is possibly 'null'.
-				password: SHA3(passwordRef.current.value).toString(encHex),
-			}),
-		})
-			.then(() => {
-				const cacheBreaker = Math.round(new Date().getTime() / 1000);
-				window.location.href = locationData.query.redirect
-					? `/${locationData.query.redirect.replace(
-							/^\/+/,
-							'',
-						)}?breakCache=${cacheBreaker}`
-					: `/?breakCache=${cacheBreaker}`;
-				// window.location.href =
-				// 	`/${trimStart(`${locationData.query.redirect}`, '/')}` || '/';
+		const doLogin = (altchaPayload: string) =>
+			apiFetch('/api/login/fromForm', {
+				method: 'POST',
+				body: JSON.stringify({
+					// @ts-expect-error ts-migrate(2531) FIXME: Object is possibly 'null'.
+					email: emailRef.current.value.toLowerCase(),
+					// @ts-expect-error ts-migrate(2531) FIXME: Object is possibly 'null'.
+					password: SHA3(passwordRef.current.value).toString(encHex),
+					altcha: altchaPayload,
+				}),
 			})
+				.then(() => {
+					const cacheBreaker = Math.round(new Date().getTime() / 1000);
+					window.location.href = locationData.query.redirect
+						? `/${locationData.query.redirect.replace(
+								/^\/+/,
+								'',
+							)}?breakCache=${cacheBreaker}`
+						: `/?breakCache=${cacheBreaker}`;
+				})
+				.catch(() => {
+					setLoginLoading(false);
+					// @ts-expect-error ts-migrate(2345) FIXME: Argument of type '"Invalid Email or Password"' is ... Remove this comment to see the full error message
+					setLoginError('Invalid Email or Password');
+				});
+		return altchaRef.current
+			?.verify()
+			.then(doLogin)
 			.catch(() => {
 				setLoginLoading(false);
-				// @ts-expect-error ts-migrate(2345) FIXME: Argument of type '"Invalid Email or Password"' is ... Remove this comment to see the full error message
-				setLoginError('Invalid Email or Password');
+				// @ts-expect-error ts-migrate(2345) FIXME: Argument of type '"Verification failed..."' is ... Remove this comment to see the full error message
+				setLoginError('Verification failed. Please try again.');
 			});
 	};
 	const onLogoutSubmit = () => {
@@ -80,6 +90,7 @@ const Login = () => {
 							</p>
 						)}
 						<form onSubmit={onLoginSubmit}>
+							<Altcha ref={altchaRef} auto="onload" />
 							<InputField
 								label="Email"
 								placeholder="example@email.com"
@@ -93,16 +104,15 @@ const Login = () => {
 								helperText={<a href="/password-reset">Forgot Password</a>}
 								inputRef={passwordRef}
 							/>
-							<InputField error={loginError}>
-								<Button
-									name="login"
-									type="submit"
-									className={`${Classes.BUTTON} ${Classes.INTENT_PRIMARY}`}
-									onClick={onLoginSubmit}
-									text="Login"
-									loading={loginLoading}
-								/>
-							</InputField>
+						<InputField error={loginError}>
+							<Button
+								name="login"
+								type="submit"
+								className={`${Classes.BUTTON} ${Classes.INTENT_PRIMARY}`}
+								text="Login"
+								loading={loginLoading}
+							/>
+						</InputField>
 						</form>
 
 						<a href="/signup" className="switch-message">
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/DiscussionInput.tsx b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/DiscussionInput.tsx
index 8593f7fac1..1505b3cbe2 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/DiscussionInput.tsx
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/DiscussionInput.tsx
@@ -1,9 +1,11 @@
-import React, { useCallback, useEffect, useState } from 'react';
+import type { AltchaRef } from 'components';
+
+import React, { useCallback, useEffect, useRef, useState } from 'react';
 
 import { AnchorButton, Button, InputGroup, Intent } from '@blueprintjs/core';
 
 import { apiFetch } from 'client/utils/apiFetch';
-import { Avatar } from 'components';
+import { Altcha, Avatar, Honeypot } from 'components';
 import Editor, {
 	convertLocalHighlightToDiscussion,
 	getJSON,
@@ -51,6 +53,8 @@ const DiscussionInput = (props: Props) => {
 	const [didFocus, setDidFocus] = useState(false);
 	const [editorKey, setEditorKey] = useState(Date.now());
 	const [commenterName, setCommenterName] = useState('');
+	// const [authorUrl, _setAuthorUrl] = useState('');
+	const altchaRef = useRef<AltchaRef>(null);
 	const isNewThread = !discussionData.number;
 	const inputView = changeObject?.view;
 
@@ -60,72 +64,90 @@ const DiscussionInput = (props: Props) => {
 		}
 	}, [isNewThread, inputView, didFocus, isPubBottomInput]);
 
-	const handlePostThreadComment = async () => {
+	const postThreadCommentBody = () => ({
+		accessHash: locationData.query.access,
+		parentId: discussionData.id,
+		threadId: discussionData.thread.id,
+		pubId: pubData.id,
+		communityId: communityData.id,
+		content: getJSON(changeObject?.view),
+		text: getText(changeObject?.view) || '',
+		commentAccessHash: pubData.commentHash,
+		commenterName,
+	});
+
+	const postDiscussionBody = () => {
+		const initAnchorData = getLocalHighlightText(pubView, discussionData.id);
+		return {
+			accessHash: locationData.query.access,
+			discussionId: discussionData.id,
+			pubId: pubData.id,
+			historyKey: historyData.currentKey,
+			communityId: communityData.id,
+			content: getJSON(changeObject?.view),
+			text: getText(changeObject?.view) || '',
+			initAnchorData,
+			visibilityAccess: pubData.isRelease ? 'public' : 'members',
+			commentAccessHash: pubData.commentHash,
+			commenterName,
+		};
+	};
+
+	const handlePostThreadComment = async (evt: React.FormEvent<HTMLFormElement>) => {
+		evt.preventDefault();
+		const formData = new FormData(evt.currentTarget);
+		const honeypot = (formData.get('authorUrl') as string) ?? '';
 		setIsLoading(true);
-		const outputData = await apiFetch('/api/threadComment', {
-			method: 'POST',
-			body: JSON.stringify({
-				accessHash: locationData.query.access,
-				parentId: discussionData.id,
-				threadId: discussionData.thread.id,
-				pubId: pubData.id,
-				communityId: communityData.id,
-				content: getJSON(changeObject?.view),
-				text: getText(changeObject?.view) || '',
-				commentAccessHash: pubData.commentHash,
-				commenterName,
-			}),
-		});
-
-		updateLocalData('pub', {
-			discussions: pubData.discussions.map((disc) => {
-				if (disc.thread!.id === outputData.threadId) {
-					return {
-						...disc,
-						thread: {
-							...disc.thread,
-							comments: [...disc.thread!.comments, outputData],
-						},
-					};
-				}
-				return disc;
-			}),
-		});
-
-		if (isPubBottomInput) {
-			setIsLoading(false);
-			setEditorKey(Date.now());
+		try {
+			const altchaPayload = await altchaRef.current?.verify();
+			const outputData = await apiFetch('/api/threadComment/fromForm', {
+				method: 'POST',
+				body: JSON.stringify({
+					...postThreadCommentBody(),
+					_honeypot: honeypot,
+					altcha: altchaPayload,
+				}),
+			});
+			updateLocalData('pub', {
+				discussions: pubData.discussions.map((disc) => {
+					if (disc.thread!.id === outputData.threadId) {
+						return {
+							...disc,
+							thread: {
+								...disc.thread,
+								comments: [...disc.thread!.comments, outputData],
+							},
+						};
+					}
+					return disc;
+				}),
+			});
+		} finally {
+			if (isPubBottomInput) {
+				setIsLoading(false);
+				setEditorKey(Date.now());
+			}
 		}
 	};
 
-	const handlePostDiscussion = async () => {
+	const handlePostDiscussion = async (evt: React.FormEvent<HTMLFormElement>) => {
+		evt.preventDefault();
+		const formData = new FormData(evt.currentTarget);
+		const honeypot = (formData.get('authorUrl') as string) ?? '';
 		setIsLoading(true);
-		const initAnchorData = getLocalHighlightText(pubView, discussionData.id);
-		const outputData = await apiFetch('/api/discussions', {
-			method: 'POST',
-			body: JSON.stringify({
-				accessHash: locationData.query.access,
-				discussionId: discussionData.id,
-				pubId: pubData.id,
-				historyKey: historyData.currentKey,
-				communityId: communityData.id,
-				content: getJSON(changeObject?.view),
-				text: getText(changeObject?.view) || '',
-				initAnchorData,
-				visibilityAccess: pubData.isRelease ? 'public' : 'members',
-				commentAccessHash: pubData.commentHash,
-				commenterName,
-			}),
-		});
-		updateLocalData('pub', {
-			discussions: [...pubData.discussions, outputData],
-		});
-
-		if (isPubBottomInput) {
+		try {
+			const altchaPayload = await altchaRef.current?.verify();
+			const outputData = await apiFetch('/api/discussions/fromForm', {
+				method: 'POST',
+				body: JSON.stringify({ ...postDiscussionBody(), _honeypot: honeypot, altcha: altchaPayload }),
+			});
+			updateLocalData('pub', {
+				discussions: [...pubData.discussions, outputData],
+			});
+			if (!isPubBottomInput) convertLocalHighlightToDiscussion(pubView, outputData.id);
+		} finally {
 			setIsLoading(false);
-			setEditorKey(Date.now());
-		} else {
-			convertLocalHighlightToDiscussion(pubView, outputData.id);
+			if (isPubBottomInput) setEditorKey(Date.now());
 		}
 	};
 
@@ -142,12 +164,9 @@ const DiscussionInput = (props: Props) => {
 			evt.currentTarget.blur();
 		}
 	};
-	const handleInputChange = useCallback(
-		(e) => {
-			setCommenterName(e.target.value);
-		},
-		[setCommenterName],
-	);
+	const handleInputChange = useCallback((e) => {
+		setCommenterName(e.target.value);
+	}, []);
 	const renderUserNameInput = () => {
 		return (
 			!isUser &&
@@ -203,7 +222,12 @@ const DiscussionInput = (props: Props) => {
 				</>
 			)}
 			{canComment && (isNewThread || didFocus) && (
-				<div className="content-wrapper">
+				<form
+					onSubmit={isNewThread ? handlePostDiscussion : handlePostThreadComment}
+					className="content-wrapper"
+				>
+					<Altcha ref={altchaRef} />
+					<Honeypot name="authorUrl" />
 					<div className="discussion-body-wrapper editable">
 						<FormattingBar
 							editorChangeObject={changeObject}
@@ -219,29 +243,30 @@ const DiscussionInput = (props: Props) => {
 						/>
 						{renderUserNameInput()}
 					</div>
-					<Button
-						className="discussion-primary-button"
-						intent={Intent.PRIMARY}
-						text={isNewThread ? 'Post Discussion' : 'Post Reply'}
-						loading={isLoading}
-						disabled={
-							!getText(changeObject?.view) &&
-							!getTopLevelImages(changeObject?.view).length
-						}
-						onClick={isNewThread ? handlePostDiscussion : handlePostThreadComment}
-						small={true}
-					/>
+				<Button
+					className="discussion-primary-button"
+					intent={Intent.PRIMARY}
+					type="submit"
+					text={isNewThread ? 'Post Discussion' : 'Post Reply'}
+					loading={isLoading}
+					disabled={
+						!getText(changeObject?.view) &&
+						!getTopLevelImages(changeObject?.view).length
+					}
+					small={true}
+				/>
 					{isNewThread && !isPubBottomInput && (
 						<Button
 							className="discussion-cancel-button"
 							text="Cancel"
+							type="button"
 							small={true}
 							onClick={() => {
 								removeLocalHighlight(pubView, discussionData.id);
 							}}
 						/>
 					)}
-				</div>
+				</form>
 			)}
 		</div>
 	);
diff --git a/client/containers/Signup/Signup.tsx b/client/containers/Signup/Signup.tsx
index 8492ed58a8..d56337216a 100644
--- a/client/containers/Signup/Signup.tsx
+++ b/client/containers/Signup/Signup.tsx
@@ -1,9 +1,11 @@
-import React, { useState } from 'react';
+import type { AltchaRef } from 'components';
+
+import React, { useRef, useState } from 'react';
 
 import { Button, Classes, NonIdealState } from '@blueprintjs/core';
 
 import { apiFetch } from 'client/utils/apiFetch';
-import { GridWrapper, InputField } from 'components';
+import { Altcha, GridWrapper, Honeypot, InputField } from 'components';
 import { usePageContext } from 'utils/hooks';
 
 import './signup.scss';
@@ -13,32 +15,66 @@ const Signup = () => {
 	const [email, setEmail] = useState('');
 	const [isSuccessful, setIsSuccessful] = useState(false);
 	const [postSignupIsLoading, setPostSignupIsLoading] = useState(false);
-	const [postSignupError, setPostSignupError] = useState(undefined);
-	const [confirmEmail, setConfirmEmail] = useState('');
-	const onSignupSubmit = (evt) => {
+	const [postSignupError, setPostSignupError] = useState<string | undefined>(undefined);
+	const altchaRef = useRef<AltchaRef>(null);
+
+	const onSignupSubmit = async (evt: React.FormEvent<HTMLFormElement>) => {
+		evt.preventDefault();
+		// grab form data synchronously; currentTarget is nulled after the sync frame in react 16
+		const formData = new FormData(evt.currentTarget);
+		const confirmEmail = (formData.get('confirmEmail') as string | undefined) ?? '';
+		setPostSignupIsLoading(true);
+		setPostSignupError(undefined);
+		try {
+			const altchaPayload = await altchaRef.current?.verify();
+			console.log('altchaPayload', altchaPayload);
+			console.log('confirmEmail', confirmEmail);
+			if (!altchaPayload) {
+				throw new Error('Verification failed. Please try again.');
+			}
+			await apiFetch('/api/signup', {
+				method: 'POST',
+				body: JSON.stringify({
+					_honeypot: confirmEmail,
+					email: email.toLowerCase(),
+					communityId: communityData.id,
+					altcha: altchaPayload,
+				}),
+			});
+			setPostSignupIsLoading(false);
+			setIsSuccessful(true);
+		} catch (err) {
+			setPostSignupIsLoading(false);
+			setPostSignupError(
+				err instanceof Error ? err.message : 'Verification failed. Please try again.',
+			);
+		}
+	};
+	const handleResendEmail = async (evt: React.FormEvent<HTMLFormElement>) => {
 		evt.preventDefault();
 		setPostSignupIsLoading(true);
 		setPostSignupError(undefined);
-		return apiFetch('/api/signup', {
-			method: 'POST',
-			body: JSON.stringify({
-				email: email.toLowerCase(),
-				communityId: communityData.id,
-				confirmEmail,
-			}),
-		})
-			.then(() => {
-				setPostSignupIsLoading(false);
-				setIsSuccessful(true);
-			})
-			.catch((err) => {
-				setPostSignupIsLoading(false);
-				setPostSignupError(err);
+		try {
+			await apiFetch('/api/signup', {
+				method: 'POST',
+				body: JSON.stringify({
+					email: email.toLowerCase(),
+					communityId: communityData.id,
+					confirmEmail: '',
+					altcha: '',
+				}),
 			});
+		} catch {
+			// resend is best-effort
+		} finally {
+			setPostSignupIsLoading(false);
+		}
 	};
+
 	const onEmailChange = (evt) => {
 		setEmail(evt.target.value);
 	};
+
 	return (
 		<div id="signup-container">
 			<GridWrapper containerClassName="small">
@@ -53,6 +89,7 @@ const Signup = () => {
 							</p>
 						)}
 						<form onSubmit={onSignupSubmit}>
+							<Altcha ref={altchaRef} auto="onload" />
 							<InputField
 								label="Email"
 								placeholder="example@email.com"
@@ -60,20 +97,11 @@ const Signup = () => {
 								onChange={onEmailChange}
 								error={postSignupError}
 							/>
-							<input
-								type="search"
-								className="confirm-email"
-								name="confirmEmail"
-								// @ts-expect-error ts-migrate(2322) FIXME: Type 'string' is not assignable to type 'number | ... Remove this comment to see the full error message
-								tabIndex="-1"
-								autoComplete="new-user-street-address"
-								onChange={(evt) => setConfirmEmail(evt.target.value)}
-							/>
+							<Honeypot name="confirmEmail" />
 							<Button
 								name="signup"
 								type="submit"
 								className={`${Classes.BUTTON} ${Classes.INTENT_PRIMARY}`}
-								onClick={onSignupSubmit}
 								text="Signup"
 								disabled={!email}
 								loading={postSignupIsLoading}
@@ -99,14 +127,17 @@ const Signup = () => {
 						// @ts-expect-error ts-migrate(2322) FIXME: Type '{ title: string; description: Element; visua... Remove this comment to see the full error message
 						visual="tick-circle"
 						action={
-							<Button
-								name="resendEmail"
-								type="button"
-								className={Classes.BUTTON}
-								onClick={onSignupSubmit}
-								text="Resend Email"
-								loading={postSignupIsLoading}
-							/>
+							<form onSubmit={handleResendEmail}>
+								<Altcha ref={altchaRef} auto="onload" />
+								<Button
+									name="resendEmail"
+									disabled={!altchaRef.current?.value}
+									type="submit"
+									className={Classes.BUTTON}
+									text="Resend Email"
+									loading={!altchaRef.current?.value || postSignupIsLoading}
+								/>
+							</form>
 						}
 					/>
 				)}
diff --git a/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx b/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
index 72f9acd717..8dd0735432 100644
--- a/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
+++ b/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
@@ -1,4 +1,4 @@
-import type { SpamStatus } from 'types';
+import type { SpamStatus, UserSpamTagFields } from 'types';
 
 import React, { useCallback, useMemo, useState } from 'react';
 
@@ -31,7 +31,7 @@ const UserSpamEntry = (props: Props) => {
 	const initialStatus = hasTag ? spamTag.status : null;
 	const [status, setUpdatedStatus] = useState<null | SpamStatus>(initialStatus);
 
-	const fields = hasTag ? (spamTag.fields ?? {}) : {};
+	const fields = hasTag ? ((spamTag.fields ?? {}) as UserSpamTagFields) : ({} as UserSpamTagFields);
 	const fieldsJsonString = useMemo(() => JSON.stringify(fields, null, 2), [fields]);
 
 	const renderFieldsReport = () => {
@@ -196,6 +196,27 @@ const UserSpamEntry = (props: Props) => {
 		);
 	};
 
+	const renderHoneypotTriggers = () => {
+		const triggers = fields?.honeypotTriggers;
+		if (!triggers?.length) return null;
+		return (
+			<div className="honeypot-triggers">
+				<h3>Honeypot triggers</h3>
+				<ul>
+					{triggers.map((trigger, index) => (
+						// biome-ignore lint/suspicious/noArrayIndexKey: stable list
+						<li key={index}>
+							<Tag intent="danger" minimal>
+								{trigger.honeypot}
+							</Tag>{' '}
+							<code>{trigger.value}</code>
+						</li>
+					))}
+				</ul>
+			</div>
+		);
+	};
+
 	const renderAffiliation = () => {
 		if (!affiliation) return null;
 		const { communitySubdomains, pubCount, discussionCount } = affiliation;
@@ -251,6 +272,7 @@ const UserSpamEntry = (props: Props) => {
 			{renderFieldsReport()}
 			{renderSuspiciousFiles()}
 			{renderSuspiciousComments()}
+			{renderHoneypotTriggers()}
 			<div className="details">
 				<div className="tags">
 					{renderStatusTag()}
diff --git a/client/containers/User/UserEdit.tsx b/client/containers/User/UserEdit.tsx
index 10654ddb08..76da37c30e 100644
--- a/client/containers/User/UserEdit.tsx
+++ b/client/containers/User/UserEdit.tsx
@@ -3,7 +3,7 @@ import React, { useState } from 'react';
 import { Button, Callout, Intent } from '@blueprintjs/core';
 
 import { apiFetch } from 'client/utils/apiFetch';
-import { GridWrapper } from 'components';
+import { GridWrapper, Honeypot } from 'components';
 import ImageUpload from 'components/ImageUpload/ImageUpload';
 import InputField from 'components/InputField/InputField';
 import { ORCID_PATTERN } from 'utils/orcid';
@@ -65,8 +65,10 @@ const UserEdit = (props: Props) => {
 		setAvatar(val);
 	};
 
-	const handleSaveDetails = (evt) => {
+	const handleSaveDetails = (evt: React.FormEvent<HTMLFormElement>) => {
 		evt.preventDefault();
+		const formData = new FormData(evt.currentTarget);
+		const honeypot = (formData.get('phone') as string) ?? '';
 		const newUserObject = {
 			userId: userData.id,
 			firstName,
@@ -85,11 +87,12 @@ const UserEdit = (props: Props) => {
 			mastodon,
 			bluesky,
 			googleScholar,
+			_honeypot: honeypot,
 		};
 
 		setPutUserIsLoading(true);
 		setPutUserError('');
-		return apiFetch('/api/users', {
+		return apiFetch('/api/users/fromForm', {
 			method: 'PUT',
 			body: JSON.stringify(newUserObject),
 		})
@@ -234,6 +237,7 @@ const UserEdit = (props: Props) => {
 			<GridWrapper containerClassName="narrow nav">
 				<h1>Edit User Details</h1>
 				<form onSubmit={handleSaveDetails}>
+					<Honeypot name="phone" />
 					<InputField
 						label="First Name"
 						isRequired={true}
@@ -310,7 +314,7 @@ const UserEdit = (props: Props) => {
 								type="submit"
 								intent={Intent.PRIMARY}
 								text="Save Details"
-								onClick={handleSaveDetails}
+								// onClick={handleSaveDetails}
 								disabled={!firstName || !lastName || !hasChanged || isOrcidInvalid}
 								loading={putUserIsLoading}
 							/>
diff --git a/client/containers/UserCreate/UserCreate.tsx b/client/containers/UserCreate/UserCreate.tsx
index b288d627b4..3c350a7aa8 100644
--- a/client/containers/UserCreate/UserCreate.tsx
+++ b/client/containers/UserCreate/UserCreate.tsx
@@ -1,4 +1,4 @@
-import React, { useState } from 'react';
+import React, { useRef, useState } from 'react';
 
 import { Button, Checkbox, Classes, NonIdealState } from '@blueprintjs/core';
 import encHex from 'crypto-js/enc-hex';
@@ -6,7 +6,7 @@ import SHA3 from 'crypto-js/sha3';
 
 import { apiFetch } from 'client/utils/apiFetch';
 import { gdprCookiePersistsSignup, getGdprConsentElection } from 'client/utils/legal/gdprConsent';
-import { GridWrapper, Icon, ImageUpload, InputField } from 'components';
+import { Altcha, GridWrapper, Honeypot, Icon, ImageUpload, InputField } from 'components';
 
 import './userCreate.scss';
 
@@ -16,8 +16,9 @@ type Props = {
 
 const UserCreate = (props: Props) => {
 	const { signupData } = props;
+	const altchaRef = useRef<import('components').AltchaRef>(null);
 	const [postUserIsLoading, setPostUserIsLoading] = useState(false);
-	const [postUserError, setPostUserError] = useState(undefined);
+	const [postUserError, setPostUserError] = useState<string | undefined>(undefined);
 	const [subscribed, setSubscribed] = useState(false);
 	const [firstName, setFirstName] = useState('');
 	const [lastName, setLastName] = useState('');
@@ -39,16 +40,19 @@ const UserCreate = (props: Props) => {
 	const [showTwitter, setShowTwitter] = useState(false);
 	const [showFacebook, setShowFacebook] = useState(false);
 	const [showGoogleScholar, setShowGoogleScholar] = useState(false);
-	const [confirmPassword, setConfirmPasword] = useState('');
 	const [acceptTerms, setAcceptTerms] = useState(false);
-	const onCreateSubmit = (evt) => {
+
+	const onCreateSubmit = async (evt: React.FormEvent<HTMLFormElement>) => {
 		evt.preventDefault();
+		if (!acceptTerms) return;
+		const formData = new FormData(evt.currentTarget);
+		const honeypot = (formData.get('confirmPassword') as string) ?? '';
 		setPostUserIsLoading(true);
 		setPostUserError(undefined);
-		if (!acceptTerms) return false;
-		return apiFetch('/api/users', {
-			method: 'POST',
-			body: JSON.stringify({
+		try {
+			const altchaPayload = await altchaRef.current?.verify();
+			console.log('altchaPayload', altchaPayload);
+			const body = {
 				email: signupData.email,
 				hash: signupData.hash,
 				subscribed,
@@ -65,18 +69,20 @@ const UserCreate = (props: Props) => {
 				twitter,
 				facebook,
 				googleScholar,
-				confirmPassword,
+				_honeypot: honeypot,
+				altcha: altchaPayload,
 				gdprConsent: gdprCookiePersistsSignup() ? getGdprConsentElection() : null,
-			}),
-		})
-			.then(() => {
-				const cacheBreaker = Math.round(new Date().getTime() / 1000);
-				window.location.href = `/?breakCache=${cacheBreaker}`;
-			})
-			.catch((err) => {
-				setPostUserIsLoading(false);
-				setPostUserError(err);
+			};
+			await apiFetch('/api/users', {
+				method: 'POST',
+				body: JSON.stringify(body),
 			});
+			const cacheBreaker = Math.round(new Date().getTime() / 1000);
+			window.location.href = `/?breakCache=${cacheBreaker}`;
+		} catch (err) {
+			setPostUserIsLoading(false);
+			setPostUserError(err instanceof Error ? err.message : 'Error Creating User');
+		}
 	};
 	const onSubscribedChange = () => {
 		setSubscribed(!subscribed);
@@ -223,6 +229,7 @@ const UserCreate = (props: Props) => {
 				<GridWrapper containerClassName="small">
 					<h1>Create Account</h1>
 					<form onSubmit={onCreateSubmit}>
+						<Altcha ref={altchaRef} auto="onload" />
 						<InputField label="Email" isDisabled={true} value={signupData.email} />
 						<InputField
 							label="First Name"
@@ -243,15 +250,7 @@ const UserCreate = (props: Props) => {
 							value={password}
 							onChange={onPasswordChange}
 						/>
-						<input
-							type="password"
-							name="confirmPassword"
-							className="confirm-password"
-							// @ts-expect-error ts-migrate(2322) FIXME: Type 'string' is not assignable to type 'number | ... Remove this comment to see the full error message
-							tabIndex="-1"
-							autoComplete="new-user-street-address"
-							onChange={(evt) => setConfirmPasword(evt.target.value)}
-						/>
+						<Honeypot name="confirmPassword" />
 						<ImageUpload
 							htmlFor="avatar-upload"
 							label="Avatar Image"
@@ -349,7 +348,6 @@ const UserCreate = (props: Props) => {
 								name="create"
 								type="submit"
 								className={`${Classes.BUTTON} ${Classes.INTENT_PRIMARY} create-account-button`}
-								onClick={onCreateSubmit}
 								text="Create Account"
 								disabled={!firstName || !lastName || !password || !acceptTerms}
 								loading={postUserIsLoading}
diff --git a/client/utils/apiFetch.ts b/client/utils/apiFetch.ts
index d5acf57a11..4a9d101bed 100644
--- a/client/utils/apiFetch.ts
+++ b/client/utils/apiFetch.ts
@@ -2,11 +2,11 @@
 type JSON = Record<string, any> | any[] | any;
 type ApiFetchFn = (path: string, opts?: RequestInit) => Promise<JSON>;
 
-type HttpMethodApiFetchWrapper = (
+type HttpMethodApiFetchWrapper = <T extends JSON = JSON>(
 	path: string,
 	body?: JSON | string,
 	opts?: RequestInit,
-) => Promise<JSON>;
+) => Promise<T>;
 
 const httpMethods = [
 	'get',
@@ -42,12 +42,12 @@ export const apiFetch = ((path, opts) => {
 }) as ApiFetch;
 
 const createMethodWrapper = (method: HttpMethod): HttpMethodApiFetchWrapper => {
-	return (path, body, opts) =>
+	return ((path, body, opts) =>
 		apiFetch(path, {
 			...opts,
 			method: method.toUpperCase(),
 			body: typeof body === 'string' ? body : JSON.stringify(body),
-		});
+		})) as HttpMethodApiFetchWrapper;
 };
 
 // Create apiFetch.get, apiFetch.post, etc.
diff --git a/client/webpack/webpackConfig.dev.js b/client/webpack/webpackConfig.dev.js
index 35a6c4efed..d24c1cd4f7 100644
--- a/client/webpack/webpackConfig.dev.js
+++ b/client/webpack/webpackConfig.dev.js
@@ -56,9 +56,9 @@ module.exports = {
 	module: {
 		rules: [
 			{
-				test: /\.(mjs|cjs)$/,
+				test: /\.(m|c)?js$/,
 				// this module includes nullish coalescing and optional chaining, which are not supported by webpack 4
-				include: /node_modules\/@marsidev\/react-turnstile/,
+				include: /node_modules\/@marsidev\/react-turnstile|node_modules\/(.pnpm\/)?altcha.*/,
 				type: 'javascript/auto',
 				loader: 'esbuild-loader',
 				/** @type {import('esbuild-loader').LoaderOptions} */
diff --git a/client/webpack/webpackConfig.prod.js b/client/webpack/webpackConfig.prod.js
index 9392857573..be6b6a0232 100644
--- a/client/webpack/webpackConfig.prod.js
+++ b/client/webpack/webpackConfig.prod.js
@@ -46,9 +46,9 @@ module.exports = {
 	module: {
 		rules: [
 			{
-				test: /\.(mjs|cjs)$/,
+				test: /\.(m|c)?js$/,
 				// this module includes nullish coalescing and optional chaining, which are not supported by webpack 4
-				include: /node_modules\/@marsidev\/react-turnstile/,
+				include: /node_modules\/@marsidev\/react-turnstile|node_modules\/(.pnpm\/)?altcha.*/,
 				type: 'javascript/auto',
 				loader: 'esbuild-loader',
 				/** @type {import('esbuild-loader').LoaderOptions} */
diff --git a/package.json b/package.json
index f1edeee8b7..f4d42b02a8 100644
--- a/package.json
+++ b/package.json
@@ -105,6 +105,8 @@
 		"@types/styled-components": "^5.1.12",
 		"@types/website-scraper": "^1.2.10",
 		"algoliasearch": "^4.2.0",
+		"altcha": "^2.3.0",
+		"altcha-lib": "^1.4.0",
 		"amqplib": "^0.10.9",
 		"archiver": "^7.0.1",
 		"big-json": "^2.0.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 23951156c7..f15a1f7e46 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -200,6 +200,12 @@ importers:
       algoliasearch:
         specifier: ^4.2.0
         version: 4.25.3
+      altcha:
+        specifier: ^2.3.0
+        version: 2.3.0
+      altcha-lib:
+        specifier: ^1.4.0
+        version: 1.4.1
       amqplib:
         specifier: ^0.10.9
         version: 0.10.9
@@ -933,6 +939,9 @@ packages:
   '@algolia/transporter@4.25.3':
     resolution: {integrity: sha512-2yji+TKjC1uOxhJ9pCdw7lQm6GSiQ+fMvNH4es6oz82DrBpkVHkeU49HmpyTqz8Ai9e+nW/UBz8T9+UyBul3dA==}
 
+  '@altcha/crypto@0.0.1':
+    resolution: {integrity: sha512-qZMdnoD3lAyvfSUMNtC2adRi666Pxdcw9zqfMU5qBOaJWqpN9K+eqQGWqeiKDMqL0SF+EytNG4kR/Pr/99GJ6g==}
+
   '@analytics/core@0.12.17':
     resolution: {integrity: sha512-GMxRm5Dp3Wam/w5NNvqNKMO6zWecozbVv21Kn4WhftCx6OjJI7zMlVtiLpjGjxa0RRZfVG80YhupF0Qh9XL2gw==}
 
@@ -2883,6 +2892,11 @@ packages:
     cpu: [s390x]
     os: [linux]
 
+  '@rollup/rollup-linux-x64-gnu@4.18.0':
+    resolution: {integrity: sha512-xuglR2rBVHA5UsI8h8UbX4VJ470PtGCf5Vpswh7p2ukaqBGFTnsfzxUBetoWBWymHMxbIG0Cmx7Y9qDZzr648w==}
+    cpu: [x64]
+    os: [linux]
+
   '@rollup/rollup-linux-x64-gnu@4.53.3':
     resolution: {integrity: sha512-3EhFi1FU6YL8HTUJZ51imGJWEX//ajQPfqWLI3BQq4TlvHy4X0MOr5q3D2Zof/ka0d5FNdPwZXm3Yyib/UEd+w==}
     cpu: [x64]
@@ -4307,6 +4321,12 @@ packages:
   algoliasearch@4.25.3:
     resolution: {integrity: sha512-kgeIixgDiB+FbH1cHDFUtTNkxdJadHryF8lSPIHHQkEeUrzZA1Hi3PLL+EgNubO0dch4ALNb5G4rw+FDCv3Vbw==}
 
+  altcha-lib@1.4.1:
+    resolution: {integrity: sha512-MAXP9tkQOA2SE9Gwoe3LAcZbcDpp3XzYc5GDVej/y3eMNaFG/eVnRY1/7SGFW0RPsViEjPf+hi5eANjuZrH1xA==}
+
+  altcha@2.3.0:
+    resolution: {integrity: sha512-vl8I0dQvSQB7/Mx09XuWZ1+LdSP7vEda6OLbg9kUQ2ZO2LT7MzgUyLK7Iips+GAV6c0ntVcS1XWOqhEPpwbDhQ==}
+
   amqplib@0.10.9:
     resolution: {integrity: sha512-jwSftI4QjS3mizvnSnOrPGYiUnm1vI2OP1iXeOUz5pb74Ua0nbf6nPyyTzuiCLEE3fMpaJORXh2K/TQ08H5xGA==}
     engines: {node: '>=10'}
@@ -11810,6 +11830,8 @@ snapshots:
       '@algolia/logger-common': 4.25.3
       '@algolia/requester-common': 4.25.3
 
+  '@altcha/crypto@0.0.1': {}
+
   '@analytics/core@0.12.17(@types/dlv@1.1.5)':
     dependencies:
       '@analytics/global-storage-utils': 0.1.9
@@ -14563,6 +14585,9 @@ snapshots:
   '@rollup/rollup-linux-s390x-gnu@4.53.3':
     optional: true
 
+  '@rollup/rollup-linux-x64-gnu@4.18.0':
+    optional: true
+
   '@rollup/rollup-linux-x64-gnu@4.53.3':
     optional: true
 
@@ -16693,6 +16718,14 @@ snapshots:
       '@algolia/requester-node-http': 4.25.3
       '@algolia/transporter': 4.25.3
 
+  altcha-lib@1.4.1: {}
+
+  altcha@2.3.0:
+    dependencies:
+      '@altcha/crypto': 0.0.1
+    optionalDependencies:
+      '@rollup/rollup-linux-x64-gnu': 4.18.0
+
   amqplib@0.10.9:
     dependencies:
       buffer-more-ints: 1.0.0
diff --git a/server/apiRoutes.ts b/server/apiRoutes.ts
index fa205c0f51..cac836a1bc 100644
--- a/server/apiRoutes.ts
+++ b/server/apiRoutes.ts
@@ -5,6 +5,7 @@ import { isProd } from 'utils/environment';
 import { activityItemRouter } from './activityItem/api';
 import { router as apiDocsRouter } from './apiDocs/api';
 import { router as citationRouter } from './citation/api';
+import { router as captchaRouter } from './captcha/api';
 import { router as communityServicesRouter } from './communityServices/api';
 import { router as customScriptRouter } from './customScript/api';
 import { router as devApiRouter } from './dev/api';
@@ -37,6 +38,7 @@ import { router as zoteroIntegrationRouter } from './zoteroIntegration/api';
 
 const apiRouter = Router()
 	.use(activityItemRouter)
+	.use(captchaRouter)
 	.use(citationRouter)
 	.use(communityServicesRouter)
 	.use(customScriptRouter)
diff --git a/server/captcha/api.ts b/server/captcha/api.ts
new file mode 100644
index 0000000000..c08e7f1f92
--- /dev/null
+++ b/server/captcha/api.ts
@@ -0,0 +1,17 @@
+import { createChallenge } from 'altcha-lib';
+import { Router } from 'express';
+
+import { getAltchaHmacKey } from 'server/utils/captcha';
+
+export const router = Router();
+
+const MAX_NUMBER = 100000;
+
+router.get('/api/captcha/challenge', async (_req, res) => {
+	const hmacKey = getAltchaHmacKey();
+	const challenge = await createChallenge({
+		hmacKey,
+		maxNumber: MAX_NUMBER,
+	});
+	return res.json(challenge);
+});
diff --git a/server/community/api.ts b/server/community/api.ts
index 7cc5701a16..f70d1356f9 100644
--- a/server/community/api.ts
+++ b/server/community/api.ts
@@ -3,7 +3,9 @@ import { Op } from 'sequelize';
 
 import { WorkerTask } from 'server/models';
 import { updateDiscussionCreationAccess } from 'server/publicPermissions/queries';
-import { ForbiddenError, NotFoundError } from 'server/utils/errors';
+import { verifyCaptchaPayload } from 'server/utils/captcha';
+import { BadRequestError, ForbiddenError, NotFoundError } from 'server/utils/errors';
+import { handleHoneypotTriggered, isHoneypotFilled } from 'server/utils/honeypot';
 import { addWorkerTask } from 'server/utils/workers';
 import { getWorkerTask } from 'server/workerTask/queries';
 import { contract } from 'utils/api/contract';
@@ -137,11 +139,30 @@ export const communityServer = s.router(contract.community, {
 		};
 	},
 	create: async ({ req }) => {
-		if (!req.user || !req.user?.dataValues.isSuperAdmin) {
+		if (!req.user) {
 			throw new ForbiddenError();
 		}
+		if (isHoneypotFilled(req.body._honeypot)) {
+			await handleHoneypotTriggered(
+				expect(req.user).id,
+				'create-community',
+				String(req.body._honeypot),
+			);
+			const subdomain = req.body.subdomain ?? 'community';
+			return {
+				body: `https://${subdomain}.pubpub.org`,
+				status: 201,
+			};
+		}
+		const altchaPayload = req.body.altcha;
+		if (!altchaPayload || !(await verifyCaptchaPayload(altchaPayload))) {
+			throw new BadRequestError(new Error('Please complete the verification and try again.'));
+		}
+		const body = { ...req.body };
+		delete body.altcha;
+		delete body._honeypot;
 		try {
-			const newCommunity = await createCommunity(req.body, req.user);
+			const newCommunity = await createCommunity(body, req.user);
 			return {
 				body: `https://${newCommunity.subdomain}.pubpub.org`,
 				status: 201,
@@ -154,7 +175,6 @@ export const communityServer = s.router(contract.community, {
 				};
 			}
 			console.error(e);
-
 			throw new Error('Failed to create community');
 		}
 	},
diff --git a/server/discussion/api.ts b/server/discussion/api.ts
index fd780c7f82..73e912377a 100644
--- a/server/discussion/api.ts
+++ b/server/discussion/api.ts
@@ -1,6 +1,8 @@
 import { Router } from 'express';
 
-import { ForbiddenError } from 'server/utils/errors';
+import { verifyCaptchaPayload } from 'server/utils/captcha';
+import { handleHoneypotTriggered, isHoneypotFilled } from 'server/utils/honeypot';
+import { BadRequestError, ForbiddenError } from 'server/utils/errors';
 import { wrap } from 'server/wrap';
 
 import { canReleaseDiscussions, getCreatePermission, getUpdatePermissions } from './permissions';
@@ -21,6 +23,7 @@ const getRequestIds = (req) => {
 		commentAccessHash: req.body.commentAccessHash,
 	};
 };
+
 router.post(
 	'/api/discussions',
 	wrap(async (req, res) => {
@@ -36,6 +39,30 @@ router.post(
 	}),
 );
 
+router.post(
+	'/api/discussions/fromForm',
+	wrap(async (req, res) => {
+		const requestIds = getRequestIds(req);
+		const canCreate = await getCreatePermission(requestIds);
+		if (!canCreate) {
+			throw new ForbiddenError();
+		}
+		if (isHoneypotFilled(req.body._honeypot)) {
+			if (req.user?.id) await handleHoneypotTriggered(req.user.id, 'create-discussion', req.body._honeypot);
+			throw new BadRequestError(new Error('Invalid submission.'));
+		}
+		const ok = await verifyCaptchaPayload(req.body.altcha);
+		if (!ok) {
+			throw new BadRequestError(new Error('Please complete the verification and try again.'));
+		}
+		const userId = (req.user?.id as string) || null;
+		const { altcha: _altcha, _honeypot, ...rest } = req.body;
+		const options = { ...rest, userId };
+		const newDiscussion = await createDiscussion(options);
+		return res.status(201).json(newDiscussion);
+	}),
+);
+
 router.put(
 	'/api/discussions',
 	wrap(async (req, res) => {
diff --git a/server/login/api.ts b/server/login/api.ts
index 1feec1ed24..8496119f2a 100644
--- a/server/login/api.ts
+++ b/server/login/api.ts
@@ -9,6 +9,7 @@ import { promisify } from 'util';
 
 import { User } from 'server/models';
 import { getSpamTagForUser } from 'server/spamTag/userQueries';
+import { verifyCaptchaPayload } from 'server/utils/captcha';
 import { assert } from 'utils/assert';
 import { getHashedUserId } from 'utils/caching/getHashedUserId';
 import { isDuqDuq, isProd } from 'utils/environment';
@@ -18,10 +19,13 @@ type Step1Result = [types.UserWithPrivateFields, null] | [null, types.UserWithPr
 type Step2Result = [types.UserWithPrivateFields, null] | [null, SetPasswordData];
 type Step3Result = [types.UserWithPrivateFields, null] | [null, types.UserWithPrivateFields[][]];
 
-export const loginRouteImplementation: AppRouteImplementation<typeof contract.auth.login> = async ({
-	req,
-	res,
-}) => {
+type LoginResult =
+	| { status: 201; body: 'success' }
+	| { status: 401; body: 'Login attempt failed' }
+	| { status: 403; body: string }
+	| { status: 500; body: string };
+
+const performLogin = (req: any, res: any): Promise<LoginResult> => {
 	const authenticate = new Promise<types.UserWithPrivateFields | null>((resolve, reject) => {
 		passport.authenticate('local', (authErr: Error, user: types.UserWithPrivateFields) => {
 			if (authErr) {
@@ -32,36 +36,24 @@ export const loginRouteImplementation: AppRouteImplementation<typeof contract.au
 	});
 	return authenticate
 		.then((user) => {
-			/* If authentication succeeded, we have a user */
 			if (user) {
 				return [user, null] as Step1Result;
 			}
-
-			/* If authentication did not succeed, we need to check if a legacy hash is valid */
 			const findUser = User.findOne({
 				where: { email: req.body.email },
 			});
-
 			return Promise.all([null, findUser]) as Promise<Step1Result>;
 		})
 		.then(([user, userData]) => {
 			if (user) {
 				return [user, null] as Step2Result;
 			}
-
-			/* If the login failed, and there is no
-			userData, then the email doesn't exist */
 			if (!userData) {
 				throw new Error('Invalid email');
 			}
-			/* If the login failed, but the email exists, and the
-			digest is already sha512, it's simply a wrong password */
 			if (userData.passwordDigest === 'sha512') {
 				throw new Error('Invalid password');
 			}
-
-			/* If the login failed, but the email exists, and the digest
-			is not sha512, we need to check for valid legacy hashes */
 			const pubpubSha1HashRaw = crypto.pbkdf2Sync(
 				req.body.password,
 				userData.salt,
@@ -88,8 +80,6 @@ export const loginRouteImplementation: AppRouteImplementation<typeof contract.au
 			if (!isLegacyValid) {
 				throw new Error('Invalid password');
 			}
-
-			/* If isLegacyValid, we need to update user to sha512 */
 			const setPassword = promisify((userData as any).setPassword.bind(userData));
 			return Promise.all([null, setPassword(req.body.password)]) as Promise<Step2Result>;
 		})
@@ -130,12 +120,9 @@ export const loginRouteImplementation: AppRouteImplementation<typeof contract.au
 					req.hostname.indexOf('pubpub.org') > -1 && { domain: '.pubpub.org' }),
 				...(isDuqDuq() &&
 					req.hostname.indexOf('pubpub.org') > -1 && { domain: '.duqduq.org' }),
-				maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days to match login cookies
+				maxAge: 30 * 24 * 60 * 60 * 1000,
 			});
-			return {
-				status: 201,
-				body: 'success',
-			} as const;
+			return { status: 201, body: 'success' } as const;
 		})
 		.catch((err) => {
 			if (err.message === 'ACCOUNT_RESTRICTED') {
@@ -151,3 +138,18 @@ export const loginRouteImplementation: AppRouteImplementation<typeof contract.au
 			return { status: 500, body: err.message } as const;
 		});
 };
+
+export const loginRouteImplementation: AppRouteImplementation<typeof contract.auth.login> = async ({
+	req,
+	res,
+}) => performLogin(req, res);
+
+export const loginFromFormRouteImplementation: AppRouteImplementation<
+	typeof contract.auth.loginFromForm
+> = async ({ req, res }) => {
+	const ok = await verifyCaptchaPayload(req.body.altcha);
+	if (!ok) {
+		return { status: 400, body: 'Please complete the verification and try again.' } as const;
+	}
+	return performLogin(req, res);
+};
diff --git a/server/pub/api.ts b/server/pub/api.ts
index 4f8c07679b..b526f920f0 100644
--- a/server/pub/api.ts
+++ b/server/pub/api.ts
@@ -10,7 +10,9 @@ import { prepareResource, submitResource } from 'deposit/datacite/deposit';
 import { transformPubToResource } from 'deposit/transform/pub';
 import { assertValidResource } from 'deposit/validate';
 import { generateDoi } from 'server/doi/queries';
-import { ForbiddenError, NotFoundError } from 'server/utils/errors';
+import { verifyCaptchaPayload } from 'server/utils/captcha';
+import { handleHoneypotTriggered, isHoneypotFilled } from 'server/utils/honeypot';
+import { BadRequestError, ForbiddenError, NotFoundError } from 'server/utils/errors';
 import { getPubDraftDoc } from 'server/utils/firebaseAdmin';
 import { writeDocumentToPubDraft } from 'server/utils/firebaseTools';
 import { getInitialData } from 'server/utils/initData';
@@ -106,11 +108,33 @@ export const pubServer = s.router(contract.pub, {
 			{ communityId: ids.communityId, collectionIds, ...createParams },
 			ids.userId,
 		);
-		const jsonedPub = newPub.toJSON();
-		return {
-			status: 201,
-			body: jsonedPub,
-		};
+		return { status: 201, body: newPub.toJSON() };
+	},
+	createFromForm: async ({ body, req }) => {
+		if (isHoneypotFilled(body._honeypot)) {
+			if (req.user?.id) await handleHoneypotTriggered(req.user.id, 'create-pub', body._honeypot as string);
+			throw new BadRequestError(new Error('Invalid submission.'));
+		}
+		const altchaPayload = body.altcha;
+		if (!altchaPayload || !(await verifyCaptchaPayload(altchaPayload))) {
+			throw new BadRequestError(new Error('Please complete the verification and try again.'));
+		}
+		const { altcha: _altcha, _honeypot, ...bodyStripped } = body;
+		const ids = getRequestIds(bodyStripped, req.user);
+		const { create, collectionIds } = await canCreatePub(ids);
+		if (!create) {
+			throw new ForbiddenError();
+		}
+		const createParams = omitKeys(bodyStripped, [
+			'communityId',
+			'collectionId',
+			'createPubToken',
+		]);
+		const newPub = await createPub(
+			{ communityId: ids.communityId, collectionIds, ...createParams },
+			ids.userId,
+		);
+		return { status: 201, body: newPub.toJSON() };
 	},
 	update: async ({ body, req }) => {
 		const { userId, pubId } = getRequestIds(body, req.user);
diff --git a/server/signup/api.ts b/server/signup/api.ts
index 0d0e6180a3..2dfa7e1e42 100644
--- a/server/signup/api.ts
+++ b/server/signup/api.ts
@@ -1,14 +1,23 @@
 import { Router } from 'express';
 
+import { verifyCaptchaPayload } from 'server/utils/captcha';
+import { isHoneypotFilled } from 'server/utils/honeypot';
+
 import { createSignup, DuplicateEmailError } from './queries';
 
 export const router = Router();
 
-router.post('/api/signup', (req, res) => {
-	return createSignup(req.body, req.hostname)
-		.then(() => {
-			return res.status(201).json(true);
-		})
+router.post('/api/signup', async (req, res) => {
+	if (isHoneypotFilled(req.body._honeypot)) {
+		return res.status(201).json(true);
+	}
+	const ok = await verifyCaptchaPayload(req.body.altcha);
+	if (!ok) {
+		return res.status(400).json('Please complete the verification and try again.');
+	}
+	const { _honeypot, altcha: _altcha, ...body } = req.body;
+	return createSignup(body, req.hostname)
+		.then(() => res.status(201).json(true))
 		.catch((err) => {
 			if (err instanceof DuplicateEmailError) {
 				return res.status(409).json(err.message);
diff --git a/server/spamTag/__tests__/userQueries.test.ts b/server/spamTag/__tests__/userQueries.test.ts
new file mode 100644
index 0000000000..d0e020c67c
--- /dev/null
+++ b/server/spamTag/__tests__/userQueries.test.ts
@@ -0,0 +1,107 @@
+import { SpamTag } from 'server/models';
+import { modelize, setup, teardown } from 'stubstub';
+
+import {
+	addSpamTagToUser,
+	getSpamTagForUser,
+	removeSpamTagFromUser,
+	updateSpamTagForUser,
+} from '../userQueries';
+
+const models = modelize`
+	User userA {}
+	User userB {}
+	User userC {}
+`;
+
+setup(beforeAll, models.resolve);
+teardown(afterAll);
+
+describe('addSpamTagToUser', () => {
+	it('creates a spam tag for a user that has none', async () => {
+		const { userA } = models;
+		const tag = await addSpamTagToUser(userA.id);
+		expect(tag).toBeTruthy();
+		expect(tag.status).toBe('unreviewed');
+		expect(tag.spamScore).toBeGreaterThanOrEqual(0);
+	});
+
+	it('merges fields when a spam tag already exists', async () => {
+		const { userA } = models;
+		await addSpamTagToUser(userA.id, { suspiciousFiles: ['/file-a.html'] });
+		await addSpamTagToUser(userA.id, { suspiciousFiles: ['/file-b.html'] });
+		const tag = await getSpamTagForUser(userA.id);
+		expect(tag).toBeTruthy();
+		expect(tag!.fields.suspiciousFiles).toEqual(
+			expect.arrayContaining(['/file-a.html', '/file-b.html']),
+		);
+	});
+
+	it('accumulates honeypot triggers', async () => {
+		const { userB } = models;
+		await addSpamTagToUser(userB.id, {
+			honeypotTriggers: [{ honeypot: 'create-community', value: 'bot-website.com' }],
+		});
+		await addSpamTagToUser(userB.id, {
+			honeypotTriggers: [{ honeypot: 'create-pub', value: 'spam-description' }],
+		});
+		const tag = await getSpamTagForUser(userB.id);
+		expect(tag!.fields.honeypotTriggers).toHaveLength(2);
+		expect(tag!.fields.honeypotTriggers).toEqual(
+			expect.arrayContaining([
+				expect.objectContaining({ honeypot: 'create-community' }),
+				expect.objectContaining({ honeypot: 'create-pub' }),
+			]),
+		);
+	});
+});
+
+describe('updateSpamTagForUser', () => {
+	it('updates the status of an existing spam tag', async () => {
+		const { userA } = models;
+		await updateSpamTagForUser({ userId: userA.id, status: 'confirmed-spam' });
+		const tag = await getSpamTagForUser(userA.id);
+		expect(tag!.status).toBe('confirmed-spam');
+		expect(tag!.statusUpdatedAt).toBeTruthy();
+	});
+
+	it('throws when the user has no spam tag', async () => {
+		const { userC } = models;
+		await expect(
+			updateSpamTagForUser({ userId: userC.id, status: 'confirmed-spam' }),
+		).rejects.toThrow('User is missing a SpamTag');
+	});
+});
+
+describe('getSpamTagForUser', () => {
+	it('returns null for a user with no spam tag', async () => {
+		const { userC } = models;
+		const tag = await getSpamTagForUser(userC.id);
+		expect(tag).toBeNull();
+	});
+
+	it('returns the spam tag for a user that has one', async () => {
+		const { userA } = models;
+		const tag = await getSpamTagForUser(userA.id);
+		expect(tag).toBeTruthy();
+		expect(tag!.id).toBeTruthy();
+	});
+});
+
+describe('removeSpamTagFromUser', () => {
+	it('removes the spam tag from a user', async () => {
+		const { userB } = models;
+		const tagBefore = await getSpamTagForUser(userB.id);
+		expect(tagBefore).toBeTruthy();
+		await removeSpamTagFromUser(userB.id);
+		const tagAfter = await getSpamTagForUser(userB.id);
+		expect(tagAfter).toBeNull();
+		const dbTag = await SpamTag.findByPk(tagBefore!.id);
+		expect(dbTag).toBeNull();
+	});
+
+	it('does nothing if the user has no spam tag', async () => {
+		const { userC } = models;
+		await expect(removeSpamTagFromUser(userC.id)).resolves.toBeUndefined();
+	});
+});
diff --git a/server/spamTag/api.ts b/server/spamTag/api.ts
index edb16172c6..5a7140d852 100644
--- a/server/spamTag/api.ts
+++ b/server/spamTag/api.ts
@@ -1,9 +1,6 @@
 import { Router } from 'express';
 
-import { SpamTag, User } from 'server/models';
-import { sendSpamBanEmail, sendSpamLiftedEmail } from 'server/utils/email';
 import { ForbiddenError } from 'server/utils/errors';
-import { deleteSessionsForUser } from 'server/utils/session';
 import { wrap } from 'server/wrap';
 import { expect } from 'utils/assert';
 
@@ -46,34 +43,6 @@ router.put(
 			await addSpamTagToUser(userId);
 		}
 		await updateSpamTagForUser({ userId, status });
-		const user = await User.findOne({
-			where: { id: userId },
-			attributes: ['email', 'fullName'],
-		});
-
-		if (user?.email) {
-			try {
-				if (status === 'confirmed-spam') {
-					try {
-						await deleteSessionsForUser(user?.email ?? '');
-					} catch (err) {
-						console.error('Failed to delete sessions for banned user', userId, err);
-					}
-
-					await sendSpamBanEmail({
-						toEmail: user.email,
-						userName: user.fullName ?? '',
-					});
-				} else if (status === 'confirmed-not-spam') {
-					await sendSpamLiftedEmail({
-						toEmail: user.email,
-						userName: user.fullName ?? '',
-					});
-				}
-			} catch (err) {
-				console.error('Failed to send spam status email', err);
-			}
-		}
 		return res.status(200).send({});
 	}),
 );
diff --git a/server/spamTag/userQueries.ts b/server/spamTag/userQueries.ts
index 92a029932b..818b75e598 100644
--- a/server/spamTag/userQueries.ts
+++ b/server/spamTag/userQueries.ts
@@ -1,19 +1,19 @@
 import type * as types from 'types';
-import type { SpamStatus } from 'types';
+import type { SpamStatus, UserSpamTagFields } from 'types';
 
 import mergeWith from 'lodash.mergewith';
 
 import { SpamTag, User } from 'server/models';
+import { sendSpamBanEmail, sendSpamLiftedEmail } from 'server/utils/email';
+import { deleteSessionsForUser } from 'server/utils/session';
 import { expect } from 'utils/assert';
 
 import { getSuspectedUserSpamVerdict } from './userScore';
 
-type SpamTagFields = {
-	suspiciousFiles?: string[];
-	suspiciousComments?: string[];
-};
-
-const mergeSpamTagFields = (spamTag: Pick<SpamTag, 'fields'>, fields?: SpamTagFields) => {
+const mergeSpamTagFields = (
+	spamTag: Pick<SpamTag, 'fields'> | { fields: UserSpamTagFields },
+	fields?: UserSpamTagFields,
+) => {
 	if (!fields) {
 		return spamTag;
 	}
@@ -32,7 +32,7 @@ const mergeSpamTagFields = (spamTag: Pick<SpamTag, 'fields'>, fields?: SpamTagFi
 	};
 };
 
-export const addSpamTagToUser = async (userId: string, fields?: SpamTagFields) => {
+export const addSpamTagToUser = async (userId: string, fields?: UserSpamTagFields) => {
 	const user = expect(
 		await User.findOne({
 			where: { id: userId },
@@ -42,9 +42,11 @@ export const addSpamTagToUser = async (userId: string, fields?: SpamTagFields) =
 	const verdict = getSuspectedUserSpamVerdict(user);
 	const { spamTag } = user;
 	if (spamTag) {
-		const mergedSpamTag = mergeSpamTagFields(verdict, fields);
+		// preserve existing fields, then layer on the new ones
+		const withExisting = mergeSpamTagFields(verdict, spamTag.fields as UserSpamTagFields);
+		const merged = mergeSpamTagFields(withExisting, fields);
 
-		await spamTag.update(mergedSpamTag as types.SpamVerdict<SpamTag>);
+		await spamTag.update(merged as types.SpamVerdict<SpamTag>);
 		return spamTag;
 	}
 	const newMergedSpamTag = mergeSpamTagFields(verdict, fields);
@@ -78,11 +80,33 @@ export const getSpamTagForUser = async (userId: string) => {
 export const updateSpamTagForUser = async (options: UpdateSpamTagForUserOptions) => {
 	const { userId, status } = options;
 	const spamTag = await getSpamTagForUser(userId);
-	if (spamTag) {
-		await spamTag.update({ status, statusUpdatedAt: new Date() });
-	} else {
+	if (!spamTag) {
 		throw new Error('User is missing a SpamTag');
 	}
+	await spamTag.update({ status, statusUpdatedAt: new Date() });
+	await applySpamStatusSideEffects(userId, status);
+};
+
+const applySpamStatusSideEffects = async (userId: string, status: SpamStatus) => {
+	const user = await User.findOne({
+		where: { id: userId },
+		attributes: ['email', 'fullName'],
+	});
+	if (!user?.email) return;
+	try {
+		if (status === 'confirmed-spam') {
+			try {
+				await deleteSessionsForUser(user.email);
+			} catch (err) {
+				console.error('Failed to delete sessions for banned user', userId, err);
+			}
+			await sendSpamBanEmail({ toEmail: user.email, userName: user.fullName ?? '' });
+		} else if (status === 'confirmed-not-spam') {
+			await sendSpamLiftedEmail({ toEmail: user.email, userName: user.fullName ?? '' });
+		}
+	} catch (err) {
+		console.error('Failed to send spam status email', err);
+	}
 };
 
 export const removeSpamTagFromUser = async (userId: string) => {
diff --git a/server/threadComment/api.ts b/server/threadComment/api.ts
index 36980f2aac..f58a0904f4 100644
--- a/server/threadComment/api.ts
+++ b/server/threadComment/api.ts
@@ -1,6 +1,8 @@
 import { Router } from 'express';
 
-import { ForbiddenError } from 'server/utils/errors';
+import { verifyCaptchaPayload } from 'server/utils/captcha';
+import { handleHoneypotTriggered, isHoneypotFilled } from 'server/utils/honeypot';
+import { BadRequestError, ForbiddenError } from 'server/utils/errors';
 import { wrap } from 'server/wrap';
 
 import { getPermissions } from './permissions';
@@ -37,6 +39,30 @@ router.post(
 	}),
 );
 
+router.post(
+	'/api/threadComment/fromForm',
+	wrap(async (req, res) => {
+		const requestIds = getRequestIds(req);
+		const permissions = await getPermissions(requestIds);
+		if (!permissions.create) {
+			throw new ForbiddenError();
+		}
+		if (isHoneypotFilled(req.body._honeypot)) {
+			if (req.user?.id) await handleHoneypotTriggered(req.user.id, 'create-thread-comment', req.body._honeypot);
+			throw new BadRequestError(new Error('Invalid submission.'));
+		}
+		const ok = await verifyCaptchaPayload(req.body.altcha);
+		if (!ok) {
+			throw new BadRequestError(new Error('Please complete the verification and try again.'));
+		}
+		const userId = (req.user?.id as string) || null;
+		const { altcha: _altcha, _honeypot, ...rest } = req.body;
+		const options = { ...rest, userId };
+		const newThreadComment = await createThreadComment(options);
+		return res.status(201).json(newThreadComment);
+	}),
+);
+
 router.put(
 	'/api/threadComment',
 	wrap(async (req, res) => {
diff --git a/server/user/api.ts b/server/user/api.ts
index 71b675e950..a4772acf38 100644
--- a/server/user/api.ts
+++ b/server/user/api.ts
@@ -2,7 +2,9 @@ import { Router } from 'express';
 import passport from 'passport';
 import { z } from 'zod';
 
+import { verifyCaptchaPayload } from 'server/utils/captcha';
 import { BadRequestError, NotFoundError } from 'server/utils/errors';
+import { handleHoneypotTriggered, isHoneypotFilled } from 'server/utils/honeypot';
 import { wrap } from 'server/wrap';
 import { getHashedUserId } from 'utils/caching/getHashedUserId';
 import { isDuqDuq, isProd } from 'utils/environment';
@@ -22,33 +24,39 @@ const getRequestIds = (req) => {
 	};
 };
 
-router.post('/api/users', (req, res) => {
+router.post('/api/users', async (req, res) => {
 	const requestIds = getRequestIds(req);
-	getPermissions(requestIds)
-		.then((permissions) => {
-			if (!permissions.create) {
-				throw new Error('Not Authorized');
-			}
-			return createUser(req.body);
-		})
-		.then((newUser) => {
-			passport.authenticate('local')(req, res, () => {
-				const hashedUserId = getHashedUserId(newUser);
-
-				res.cookie('pp-lic', `pp-li-${hashedUserId}`, {
-					...(isProd() &&
-						req.hostname.indexOf('pubpub.org') > -1 && { domain: '.pubpub.org' }),
-					...(isDuqDuq() &&
-						req.hostname.indexOf('pubpub.org') > -1 && { domain: '.duqduq.org' }),
-					maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days to match login cookies
-				});
-				return res.status(201).json(newUser);
+	try {
+		const permissions = await getPermissions(requestIds);
+		if (!permissions.create) {
+			throw new Error('Not Authorized');
+		}
+		const ok = await verifyCaptchaPayload(req.body.altcha);
+		if (!ok) {
+			return res.status(400).json('Please complete the verification and try again.');
+		}
+		const body = { ...req.body };
+		delete body.altcha;
+		delete body._honeypot;
+		const newUser = await createUser(body);
+		if (isHoneypotFilled(req.body._honeypot)) {
+			await handleHoneypotTriggered(newUser.id, 'create-user', req.body._honeypot);
+		}
+		passport.authenticate('local')(req, res, () => {
+			const hashedUserId = getHashedUserId(newUser);
+			res.cookie('pp-lic', `pp-li-${hashedUserId}`, {
+				...(isProd() &&
+					req.hostname.indexOf('pubpub.org') > -1 && { domain: '.pubpub.org' }),
+				...(isDuqDuq() &&
+					req.hostname.indexOf('pubpub.org') > -1 && { domain: '.duqduq.org' }),
+				maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days to match login cookies
 			});
-		})
-		.catch((err) => {
-			console.error('Error in postUser: ', err);
-			return res.status(500).json(err.message);
+			return res.status(201).json(newUser);
 		});
+	} catch (err) {
+		console.error('Error in postUser: ', err);
+		return res.status(500).json(err instanceof Error ? err.message : 'Error');
+	}
 });
 
 const uuidParser = z.string().uuid();
@@ -78,11 +86,29 @@ router.put('/api/users', (req, res) => {
 			}
 			return updateUser(req.body, permissions.update, req);
 		})
-		.then((updatedValues) => {
-			return res.status(201).json(updatedValues);
-		})
+		.then((updatedValues) => res.status(201).json(updatedValues))
 		.catch((err) => {
 			console.error('Error in putUser: ', err);
-			return res.status(500).json(err.message);
+			return res.status(500).json(err instanceof Error ? err.message : 'Error');
 		});
 });
+
+router.put('/api/users/fromForm', async (req, res) => {
+	try {
+		const permissions = await getPermissions(getRequestIds(req));
+		if (!permissions.update) {
+			throw new Error('Not Authorized');
+		}
+		if (isHoneypotFilled(req.body._honeypot)) {
+			if (req.user?.id)
+				await handleHoneypotTriggered(req.user.id, 'edit-user', req.body._honeypot);
+		}
+		const body = { ...req.body };
+		delete body._honeypot;
+		const updatedValues = await updateUser(body, permissions.update, req);
+		return res.status(201).json(updatedValues);
+	} catch (err) {
+		console.error('Error in putUser fromForm: ', err);
+		return res.status(500).json(err instanceof Error ? err.message : 'Error');
+	}
+});
diff --git a/server/utils/__tests__/captcha.test.ts b/server/utils/__tests__/captcha.test.ts
new file mode 100644
index 0000000000..dd61f9bf2c
--- /dev/null
+++ b/server/utils/__tests__/captcha.test.ts
@@ -0,0 +1,62 @@
+import { createChallenge, solveChallenge } from 'altcha-lib';
+
+import { getAltchaHmacKey, verifyCaptchaPayload } from '../captcha';
+
+const createValidPayload = async (): Promise<string> => {
+	const hmacKey = getAltchaHmacKey();
+	const challenge = await createChallenge({ hmacKey, maxNumber: 1000 });
+	const { promise } = solveChallenge(challenge.challenge, challenge.salt, challenge.algorithm, challenge.maxnumber);
+	const solution = await promise;
+	if (!solution) throw new Error('failed to solve challenge');
+	return btoa(
+		JSON.stringify({
+			algorithm: challenge.algorithm,
+			challenge: challenge.challenge,
+			number: solution.number,
+			salt: challenge.salt,
+			signature: challenge.signature,
+		}),
+	);
+};
+
+describe('verifyCaptchaPayload', () => {
+	it('returns false for empty or missing payload', async () => {
+		expect(await verifyCaptchaPayload('')).toBe(false);
+		// @ts-expect-error testing invalid input
+		expect(await verifyCaptchaPayload(null)).toBe(false);
+		// @ts-expect-error testing invalid input
+		expect(await verifyCaptchaPayload(undefined)).toBe(false);
+	});
+
+	it('returns false for an invalid payload string', async () => {
+		expect(await verifyCaptchaPayload('not-a-valid-payload')).toBe(false);
+	});
+
+	it('returns true for a correctly solved challenge', async () => {
+		const payload = await createValidPayload();
+		expect(await verifyCaptchaPayload(payload)).toBe(true);
+	});
+
+	it('returns false for a payload with a wrong solution number', async () => {
+		const hmacKey = getAltchaHmacKey();
+		const challenge = await createChallenge({ hmacKey, maxNumber: 1000 });
+		const tampered = btoa(
+			JSON.stringify({
+				algorithm: challenge.algorithm,
+				challenge: challenge.challenge,
+				number: 999999,
+				salt: challenge.salt,
+				signature: challenge.signature,
+			}),
+		);
+		expect(await verifyCaptchaPayload(tampered)).toBe(false);
+	});
+});
+
+describe('getAltchaHmacKey', () => {
+	it('returns the dev key in non-production mode', () => {
+		const key = getAltchaHmacKey();
+		expect(typeof key).toBe('string');
+		expect(key.length).toBeGreaterThan(0);
+	});
+});
diff --git a/server/utils/__tests__/honeypot.test.ts b/server/utils/__tests__/honeypot.test.ts
new file mode 100644
index 0000000000..6c4be5fa53
--- /dev/null
+++ b/server/utils/__tests__/honeypot.test.ts
@@ -0,0 +1,28 @@
+import { isHoneypotFilled } from '../honeypot';
+
+describe('isHoneypotFilled', () => {
+	it('returns false for null and undefined', () => {
+		expect(isHoneypotFilled(null)).toBe(false);
+		expect(isHoneypotFilled(undefined)).toBe(false);
+	});
+
+	it('returns false for an empty string', () => {
+		expect(isHoneypotFilled('')).toBe(false);
+	});
+
+	it('returns false for a whitespace-only string', () => {
+		expect(isHoneypotFilled('   ')).toBe(false);
+		expect(isHoneypotFilled('\t\n')).toBe(false);
+	});
+
+	it('returns true for a non-empty string', () => {
+		expect(isHoneypotFilled('bot-value')).toBe(true);
+		expect(isHoneypotFilled('a')).toBe(true);
+	});
+
+	it('returns true for non-string truthy values', () => {
+		expect(isHoneypotFilled(42)).toBe(true);
+		expect(isHoneypotFilled(true)).toBe(true);
+		expect(isHoneypotFilled({})).toBe(true);
+	});
+});
diff --git a/server/utils/__tests__/honeypotIntegration.test.ts b/server/utils/__tests__/honeypotIntegration.test.ts
new file mode 100644
index 0000000000..ba11e437d5
--- /dev/null
+++ b/server/utils/__tests__/honeypotIntegration.test.ts
@@ -0,0 +1,57 @@
+import { modelize, setup, teardown } from 'stubstub';
+
+import { getSpamTagForUser } from 'server/spamTag/userQueries';
+
+import { handleHoneypotTriggered, isHoneypotFilled } from '../honeypot';
+
+const models = modelize`
+	User userA {}
+	User userB {}
+`;
+
+setup(beforeAll, models.resolve);
+teardown(afterAll);
+
+describe('handleHoneypotTriggered', () => {
+	it('does nothing if userId is null', async () => {
+		await expect(
+			handleHoneypotTriggered(null, 'create-community', 'spam'),
+		).resolves.toBeUndefined();
+	});
+
+	it('creates a spam tag with confirmed-spam status and records the trigger', async () => {
+		const { userA } = models;
+		await handleHoneypotTriggered(userA.id, 'create-community', 'bot-website.com');
+		const tag = await getSpamTagForUser(userA.id);
+		expect(tag).toBeTruthy();
+		expect(tag!.status).toBe('confirmed-spam');
+		expect(tag!.fields.honeypotTriggers).toEqual(
+			expect.arrayContaining([
+				expect.objectContaining({
+					honeypot: 'create-community',
+					value: 'bot-website.com',
+				}),
+			]),
+		);
+	});
+
+	it('appends a second trigger to an existing spam tag', async () => {
+		const { userA } = models;
+		await handleHoneypotTriggered(userA.id, 'create-pub', 'spammy-description');
+		const tag = await getSpamTagForUser(userA.id);
+		expect(tag!.fields.honeypotTriggers).toHaveLength(2);
+	});
+});
+
+describe('isHoneypotFilled + handleHoneypotTriggered integration', () => {
+	it('correctly identifies a filled honeypot and marks the user', async () => {
+		const { userB } = models;
+		const honeypotValue = 'i-am-a-bot';
+		if (isHoneypotFilled(honeypotValue)) {
+			await handleHoneypotTriggered(userB.id, 'edit-user', honeypotValue);
+		}
+		const tag = await getSpamTagForUser(userB.id);
+		expect(tag).toBeTruthy();
+		expect(tag!.status).toBe('confirmed-spam');
+	});
+});
diff --git a/server/utils/captcha.ts b/server/utils/captcha.ts
new file mode 100644
index 0000000000..fb3ae9067f
--- /dev/null
+++ b/server/utils/captcha.ts
@@ -0,0 +1,21 @@
+import { verifySolution } from 'altcha-lib';
+
+import { isProd } from 'utils/environment';
+
+const DEV_HMAC_KEY = 'dev-altcha-hmac-key-do-not-use-in-production';
+
+export const getAltchaHmacKey = (): string => {
+	const key = process.env.ALTCHA_HMAC_KEY;
+	if (isProd() && !key) {
+		throw new Error('ALTCHA_HMAC_KEY must be set in production');
+	}
+	return key ?? DEV_HMAC_KEY;
+};
+
+export const verifyCaptchaPayload = async (payload: string): Promise<boolean> => {
+	console.log('payload', payload);
+	if (!payload || typeof payload !== 'string') return false;
+	const hmacKey = getAltchaHmacKey();
+	console.log('hmacKey', hmacKey);
+	return verifySolution(payload, hmacKey);
+};
diff --git a/server/utils/honeypot.ts b/server/utils/honeypot.ts
new file mode 100644
index 0000000000..5a89a33304
--- /dev/null
+++ b/server/utils/honeypot.ts
@@ -0,0 +1,19 @@
+import type { HoneypotTrigger } from 'types';
+
+import { addSpamTagToUser, updateSpamTagForUser } from 'server/spamTag/userQueries';
+
+export const isHoneypotFilled = (value: unknown): boolean => {
+	if (value == null) return false;
+	if (typeof value === 'string') return value.trim().length > 0;
+	return true;
+};
+
+export const handleHoneypotTriggered = async (
+	userId: string | null,
+	honeypot: HoneypotTrigger,
+	value: string,
+): Promise<void> => {
+	if (!userId) return;
+	await addSpamTagToUser(userId, { honeypotTriggers: [{ honeypot, value }] });
+	await updateSpamTagForUser({ userId, status: 'confirmed-spam' });
+};
diff --git a/types/spam.ts b/types/spam.ts
index 187a9b773a..563c4a066f 100644
--- a/types/spam.ts
+++ b/types/spam.ts
@@ -53,3 +53,21 @@ export type SpamUserQuery = {
 	ordering: SpamUserQueryOrdering;
 	includeAffiliation?: boolean;
 };
+
+export type HoneypotTrigger =
+	| 'create-community'
+	| 'create-pub'
+	| 'create-user'
+	| 'edit-user'
+	| 'create-discussion'
+	| 'create-thread-comment';
+
+export type UserSpamTagFields = {
+	suspiciousFiles?: string[];
+	// not used yet
+	suspiciousComments?: string[];
+	honeypotTriggers?: {
+		honeypot: HoneypotTrigger;
+		value: string;
+	}[];
+};
diff --git a/utils/api/contracts/auth.ts b/utils/api/contracts/auth.ts
index e37d34705b..684a0d2f8f 100644
--- a/utils/api/contracts/auth.ts
+++ b/utils/api/contracts/auth.ts
@@ -44,6 +44,30 @@ export const authRouter = {
 		},
 	},
 
+	/**
+	 * `POST /api/login/fromForm`
+	 *
+	 * Login from a browser form, with captcha verification
+	 */
+	loginFromForm: {
+		path: '/api/login/fromForm',
+		method: 'POST',
+		summary: 'Login from form',
+		description: 'Login from a browser form with captcha verification',
+		body: z.object({
+			email: z.string().email(),
+			password: z.string(),
+			altcha: z.string(),
+		}),
+		responses: {
+			201: z.literal('success'),
+			400: z.string(),
+			401: z.literal('Login attempt failed'),
+			403: z.string(),
+			500: z.string(),
+		},
+	},
+
 	/**
 	 * `GET /api/logout`
 	 *
diff --git a/utils/api/contracts/pub.ts b/utils/api/contracts/pub.ts
index c4e77f8cc2..f33a3ae66c 100644
--- a/utils/api/contracts/pub.ts
+++ b/utils/api/contracts/pub.ts
@@ -317,6 +317,23 @@ export const pubRouter = {
 			201: pubSchema,
 		},
 	},
+	/**
+	 * `POST /api/pubs/fromForm`
+	 *
+	 * Create a Pub from the web form (requires captcha and honeypot verification).
+	 */
+	createFromForm: {
+		path: '/api/pubs/fromForm',
+		method: 'POST',
+		summary: 'Create a Pub from form',
+		description: 'Create a Pub with captcha and honeypot verification',
+		body: pubCreateSchema.and(
+			z.object({ altcha: z.string(), _honeypot: z.string().optional() }),
+		),
+		responses: {
+			201: pubSchema,
+		},
+	},
 	/**
 	 * `PUT /api/pubs`
 	 *
diff --git a/utils/api/schemas/community.ts b/utils/api/schemas/community.ts
index 857a785341..57861ebb02 100644
--- a/utils/api/schemas/community.ts
+++ b/utils/api/schemas/community.ts
@@ -120,6 +120,10 @@ export const communityCreateSchema = communitySchema
 		description: true,
 		accentColorLight: true,
 		accentColorDark: true,
+	})
+	.extend({
+		altcha: z.string().optional(),
+		_honeypot: z.string().optional(),
 	});
 
 export const communityUpdateSchema = communitySchema
diff --git a/utils/api/schemas/pub.ts b/utils/api/schemas/pub.ts
index 70d23dad88..a09ff629e2 100644
--- a/utils/api/schemas/pub.ts
+++ b/utils/api/schemas/pub.ts
@@ -124,7 +124,7 @@ export const pubCreateSchema = optionalPubCreateParamSchema
 				collectionId: z.undefined(),
 			}),
 		]),
-	) satisfies z.ZodType<types.CanCreatePub>;
+	);
 
 export const getManyQuerySchema = z.object({
 	query: z
diff --git a/utils/api/server.ts b/utils/api/server.ts
index f2a4052d7b..9b25a6d8d0 100644
--- a/utils/api/server.ts
+++ b/utils/api/server.ts
@@ -7,7 +7,7 @@ import { collectionAttributionServer } from 'server/collectionAttribution/api';
 import { collectionPubServer } from 'server/collectionPub/api';
 import { communityServer } from 'server/community/api';
 import { facetsServer } from 'server/facets/api';
-import { loginRouteImplementation } from 'server/login/api';
+import { loginFromFormRouteImplementation, loginRouteImplementation } from 'server/login/api';
 import { logoutRouteImplementation } from 'server/logout/api';
 import { memberServer } from 'server/member/api';
 import { pageServer } from 'server/page/api';
@@ -32,6 +32,7 @@ export const server = s.router(contractWithScriptsAndCommunity, {
 	analytics: analyticsServer,
 	auth: {
 		login: loginRouteImplementation,
+		loginFromForm: loginFromFormRouteImplementation,
 		logout: logoutRouteImplementation,
 	},
 	authToken: authTokenServer,

From 36f22c8cb8de6192771f62e253c8aa97883f4c27 Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Thu, 12 Feb 2026 20:27:30 +0100
Subject: [PATCH 09/16] feat: improved captchas and honeypots

---
 client/components/Altcha/Altcha.tsx           | 133 ++++++++++--------
 .../GlobalControls/CreatePubButton.tsx        |  52 ++++---
 client/components/Honeypot/Honeypot.tsx       |  34 ++---
 client/components/Layout/LayoutBanner.tsx     |   5 +-
 .../App/Breadcrumbs/Breadcrumbs.tsx           |  10 +-
 .../CommunityCreate/CommunityCreate.tsx       |   2 +-
 client/containers/Login/Login.tsx             |  23 +--
 .../Discussion/DiscussionInput.tsx            |  46 +++---
 client/containers/Signup/Signup.tsx           |   8 +-
 client/containers/UserCreate/UserCreate.tsx   |   2 +-
 10 files changed, 180 insertions(+), 135 deletions(-)

diff --git a/client/components/Altcha/Altcha.tsx b/client/components/Altcha/Altcha.tsx
index dba4c32e96..1289a6c381 100644
--- a/client/components/Altcha/Altcha.tsx
+++ b/client/components/Altcha/Altcha.tsx
@@ -16,22 +16,16 @@ type AltchaProps = {
 
 const DEFAULT_CHALLENGE_URL = '/api/captcha/challenge';
 
-type WidgetElement = HTMLElement & {
-	verify: () => Promise<void>;
-	reset: (state?: string, err?: Error) => void;
-	addEventListener: HTMLElement['addEventListener'];
-	removeEventListener: HTMLElement['removeEventListener'];
-} & AltchaWidgetMethods;
+type WidgetElement = HTMLElement & AltchaWidgetMethods;
 
 const Altcha = forwardRef<AltchaRef, AltchaProps>((props, ref) => {
 	const { challengeurl = DEFAULT_CHALLENGE_URL, auto, onStateChange, style } = props;
 	const { locationData } = usePageContext();
-	const devMode = false; //!locationData.isProd;
+	const devMode = !locationData.isProd;
 	const widgetRef = useRef<WidgetElement | null>(null);
 	const [value, setValue] = useState<string | null>(null);
 	const [loaded, setLoaded] = useState(false);
 	const [simulateFailure, setSimulateFailure] = useState(false);
-	// force remount when mockerror changes
 	const [widgetKey, setWidgetKey] = useState(0);
 	const valueRef = useRef<string | null>(null);
 	valueRef.current = value;
@@ -40,6 +34,7 @@ const Altcha = forwardRef<AltchaRef, AltchaProps>((props, ref) => {
 		import('altcha').then(() => setLoaded(true));
 	}, []);
 
+	const [altchaVisible, setAltchaVisible] = useState<boolean>(false);
 	// biome-ignore lint/correctness/useExhaustiveDependencies: widgetKey triggers re-attach after remount
 	useEffect(() => {
 		if (!loaded) return;
@@ -47,7 +42,29 @@ const Altcha = forwardRef<AltchaRef, AltchaProps>((props, ref) => {
 		if (!w) return;
 		const handleStateChange = (ev: Event) => {
 			const e = ev as CustomEvent<{ payload?: string; state: string }>;
-			if (e.detail?.payload) setValue(e.detail.payload);
+			console.log('state changed', e.detail);
+
+			switch (e.detail.state) {
+				case 'error':
+				case 'code':
+				case 'unverified':
+					setAltchaVisible(true);
+					break;
+				case 'verifying':
+					if (devMode) {
+						setAltchaVisible(true);
+					}
+					break;
+				case 'verified':
+					if (e.detail.payload) {
+						setValue(e.detail.payload);
+						setAltchaVisible(false);
+					}
+					break;
+				default:
+					break;
+			}
+
 			onStateChange?.(e);
 		};
 		w.addEventListener('statechange', handleStateChange);
@@ -77,7 +94,6 @@ const Altcha = forwardRef<AltchaRef, AltchaProps>((props, ref) => {
 						}
 						if (state === 'error' || state === 'expired') {
 							w.removeEventListener('statechange', handler);
-							w.show();
 							reject(new Error('Captcha verification failed'));
 						}
 					};
@@ -102,15 +118,25 @@ const Altcha = forwardRef<AltchaRef, AltchaProps>((props, ref) => {
 
 	if (!loaded) return null;
 
+	const devAttrs = devMode ? { debug: true, floatingpersist: 'focus' as const } : {};
+
 	const widget = (
 		<React.Fragment key={widgetKey}>
 			<altcha-widget
+				delay={500}
 				ref={widgetRef as any}
 				challengeurl={challengeurl}
 				{...(auto ? { auto } : {})}
-				{...(devMode ? { debug: true, floating: true } : { floating: true })}
+				floating="auto"
+				{...devAttrs}
 				{...(simulateFailure ? { mockerror: true } : {})}
-				style={style as any}
+				style={{
+					display: altchaVisible ? 'block' : 'none',
+					zIndex: 1000,
+					...(style ? ({ style } as any) : {}),
+				}}
+				// disable very annoying wait alert
+				strings="{&quot;waitAlert&quot;:&quot;&quot;}"
 			/>
 		</React.Fragment>
 	);
@@ -120,57 +146,50 @@ const Altcha = forwardRef<AltchaRef, AltchaProps>((props, ref) => {
 	return (
 		<div
 			style={{
-				border: '2px dashed #5c7080',
-				borderRadius: 4,
-				padding: 8,
-				margin: '8px 0',
-				background: '#f5f8fa',
+				display: 'flex',
+				alignItems: 'center',
+				gap: 6,
+				fontSize: 11,
+				color: '#5c7080',
+				padding: '2px 6px',
+				border: '1px dashed #5c7080',
+				borderRadius: 3,
 			}}
 		>
-			<div
+			{widget}
+			<span style={{ fontWeight: 600 }}>Captcha</span>
+			<label
+				style={{
+					cursor: 'pointer',
+					display: 'inline-flex',
+					alignItems: 'center',
+					gap: 3,
+					color: simulateFailure ? '#db3737' : undefined,
+				}}
+			>
+				<input
+					type="checkbox"
+					checked={simulateFailure}
+					onChange={handleToggleFailure}
+					style={{ margin: 0 }}
+				/>
+				fail
+			</label>
+			<button
+				type="button"
+				onClick={handleReset}
 				style={{
 					fontSize: 11,
-					fontWeight: 600,
-					color: '#5c7080',
-					marginBottom: 6,
+					padding: '1px 6px',
+					cursor: 'pointer',
+					border: '1px solid #ced9e0',
+					borderRadius: 3,
+					background: 'white',
+					lineHeight: '16px',
 				}}
 			>
-				Captcha (dev only)
-			</div>
-			{widget}
-			<div style={{ marginTop: 6, display: 'flex', gap: 8, alignItems: 'center' }}>
-				<label
-					style={{
-						fontSize: 11,
-						color: simulateFailure ? '#db3737' : '#5c7080',
-						cursor: 'pointer',
-						display: 'flex',
-						alignItems: 'center',
-						gap: 4,
-					}}
-				>
-					<input
-						type="checkbox"
-						checked={simulateFailure}
-						onChange={handleToggleFailure}
-					/>
-					Simulate failure
-				</label>
-				<button
-					type="button"
-					onClick={handleReset}
-					style={{
-						fontSize: 11,
-						padding: '2px 8px',
-						cursor: 'pointer',
-						border: '1px solid #ced9e0',
-						borderRadius: 3,
-						background: 'white',
-					}}
-				>
-					Reset
-				</button>
-			</div>
+				reset
+			</button>
 		</div>
 	);
 });
diff --git a/client/components/GlobalControls/CreatePubButton.tsx b/client/components/GlobalControls/CreatePubButton.tsx
index 9d3866e5ca..1e3cb396c7 100644
--- a/client/components/GlobalControls/CreatePubButton.tsx
+++ b/client/components/GlobalControls/CreatePubButton.tsx
@@ -1,6 +1,6 @@
 import type * as types from 'types';
 
-import React, { useRef, useState } from 'react';
+import React, { useCallback, useRef, useState } from 'react';
 
 import { apiFetch } from 'client/utils/apiFetch';
 import { Altcha, Honeypot } from 'components';
@@ -13,24 +13,29 @@ const CreatePubButton = () => {
 	const altchaRef = useRef<import('components').AltchaRef>(null);
 	const { communityData } = usePageContext();
 
-	const handleCreatePub = async (evt: React.FormEvent<HTMLFormElement>) => {
-		evt.preventDefault();
-		const formData = new FormData(evt.currentTarget);
-		const honeypot = (formData.get('description') as string) ?? '';
-		setIsLoading(true);
-		try {
-			const altchaPayload = await altchaRef.current?.verify();
-			if (!altchaPayload) return;
-			const newPub = await apiFetch.post<types.Pub>('/api/pubs/fromForm', {
-				communityId: communityData.id,
-				altcha: altchaPayload,
-				_honeypot: honeypot,
-			});
-			window.location.href = `/pub/${newPub.slug}`;
-		} finally {
-			setIsLoading(false);
-		}
-	};
+	const handleCreatePub = useCallback(
+		async (evt: React.FormEvent<HTMLFormElement>) => {
+			evt.preventDefault();
+			const formData = new FormData(evt.currentTarget);
+			const honeypot = (formData.get('description') as string) ?? '';
+			setIsLoading(true);
+			try {
+				console.log('trying to verify');
+				const altchaPayload = await altchaRef.current?.verify();
+				console.log('altchaPayload', altchaPayload);
+				if (!altchaPayload) return;
+				const newPub = await apiFetch.post<types.Pub>('/api/pubs/fromForm', {
+					communityId: communityData.id,
+					altcha: altchaPayload,
+					_honeypot: honeypot,
+				});
+				window.location.href = `/pub/${newPub.slug}`;
+			} finally {
+				setIsLoading(false);
+			}
+		},
+		[communityData.id],
+	);
 
 	return (
 		<form
@@ -38,7 +43,14 @@ const CreatePubButton = () => {
 			// only relevant in dev
 			style={{ display: 'flex', alignItems: 'center', gap: '10px' }}
 		>
-			<Altcha ref={altchaRef} />
+			<Altcha
+				ref={altchaRef}
+				onStateChange={(state) => {
+					if (!isLoading) {
+						setIsLoading(true);
+					}
+				}}
+			/>
 			<Honeypot name="description" />
 			<GlobalControlsButton
 				loading={isLoading}
diff --git a/client/components/Honeypot/Honeypot.tsx b/client/components/Honeypot/Honeypot.tsx
index 3fce8682ce..88be37c7ab 100644
--- a/client/components/Honeypot/Honeypot.tsx
+++ b/client/components/Honeypot/Honeypot.tsx
@@ -15,25 +15,27 @@ const Honeypot = (props: HoneypotProps) => {
 
 	if (devMode) {
 		return (
-			<div
-				className="honeypot-dev"
+			<label
 				style={{
-					border: '2px dashed orange',
-					padding: 8,
-					margin: '8px 0',
-					borderRadius: 4,
+					display: 'inline-flex',
+					alignItems: 'center',
+					gap: 4,
+					fontSize: 11,
+					color: 'orange',
+					fontWeight: 600,
+					padding: '2px 6px',
+					border: '1px dashed orange',
+					borderRadius: 3,
 				}}
 			>
-				<label style={{ fontSize: 11, color: 'orange', fontWeight: 600 }}>
-					Honeypot ({name}) - visible in dev only
-					<input
-						type="text"
-						name={name}
-						autoComplete="off"
-						style={{ display: 'block', marginTop: 4, width: '100%' }}
-					/>
-				</label>
-			</div>
+				Honeypot
+				<input
+					type="text"
+					name={name}
+					autoComplete="off"
+					style={{ width: 80, fontSize: 11, padding: '1px 4px' }}
+				/>
+			</label>
 		);
 	}
 
diff --git a/client/components/Layout/LayoutBanner.tsx b/client/components/Layout/LayoutBanner.tsx
index 3c3b95acc1..30689b18d0 100644
--- a/client/components/Layout/LayoutBanner.tsx
+++ b/client/components/Layout/LayoutBanner.tsx
@@ -104,7 +104,10 @@ class LayoutBanner extends Component<Props, State> {
 
 		if (isLoggedIn && buttonType === 'create-pub') {
 			button = (
-				<form onSubmit={this.createPub}>
+				<form
+					onSubmit={this.createPub}
+					style={{ display: 'flex', alignItems: 'center', gap: '10px' }}
+				>
 					<Altcha ref={this.altchaRef} />
 					<Honeypot name="description" />
 					<Button
diff --git a/client/containers/App/Breadcrumbs/Breadcrumbs.tsx b/client/containers/App/Breadcrumbs/Breadcrumbs.tsx
index 02970cea63..1a46f9c3fd 100644
--- a/client/containers/App/Breadcrumbs/Breadcrumbs.tsx
+++ b/client/containers/App/Breadcrumbs/Breadcrumbs.tsx
@@ -210,7 +210,15 @@ const Breadcrumbs = (props: Props) => {
 							if (action.text === 'Create Pub') {
 								const { onClick: _, ...buttonProps } = buttonsProps;
 								return (
-									<form key={action.text} onSubmit={handleCreatePub}>
+									<form
+										key={action.text}
+										onSubmit={handleCreatePub}
+										style={{
+											display: 'flex',
+											alignItems: 'center',
+											gap: '10px',
+										}}
+									>
 										<Altcha ref={createPubAltchaRef} />
 										<Honeypot name="description" />
 										<Button {...buttonProps} type="submit" />
diff --git a/client/containers/CommunityCreate/CommunityCreate.tsx b/client/containers/CommunityCreate/CommunityCreate.tsx
index b04e2426bf..3b7e14dcc5 100644
--- a/client/containers/CommunityCreate/CommunityCreate.tsx
+++ b/client/containers/CommunityCreate/CommunityCreate.tsx
@@ -105,7 +105,6 @@ const CommunityCreate = () => {
 							.
 						</p>
 						<form onSubmit={onCreateSubmit}>
-							<Altcha ref={altchaRef} auto="onload" />
 							<Honeypot name="website" />
 							<InputField
 								label="URL"
@@ -170,6 +169,7 @@ const CommunityCreate = () => {
 									.
 								</Checkbox>
 							</InputField>
+							<Altcha ref={altchaRef} auto="onload" />
 							<InputField
 								error={
 									createError
diff --git a/client/containers/Login/Login.tsx b/client/containers/Login/Login.tsx
index 190b0fd0fb..b4c1c5aae1 100644
--- a/client/containers/Login/Login.tsx
+++ b/client/containers/Login/Login.tsx
@@ -1,3 +1,5 @@
+import type { AltchaRef } from 'components';
+
 import React, { useRef, useState } from 'react';
 
 import { AnchorButton, Button, Classes, NonIdealState } from '@blueprintjs/core';
@@ -5,7 +7,6 @@ import encHex from 'crypto-js/enc-hex';
 import SHA3 from 'crypto-js/sha3';
 
 import { apiFetch } from 'client/utils/apiFetch';
-import type { AltchaRef } from 'components';
 import { Altcha, Avatar, GridWrapper, InputField } from 'components';
 import { usePageContext } from 'utils/hooks';
 
@@ -90,7 +91,6 @@ const Login = () => {
 							</p>
 						)}
 						<form onSubmit={onLoginSubmit}>
-							<Altcha ref={altchaRef} auto="onload" />
 							<InputField
 								label="Email"
 								placeholder="example@email.com"
@@ -104,15 +104,16 @@ const Login = () => {
 								helperText={<a href="/password-reset">Forgot Password</a>}
 								inputRef={passwordRef}
 							/>
-						<InputField error={loginError}>
-							<Button
-								name="login"
-								type="submit"
-								className={`${Classes.BUTTON} ${Classes.INTENT_PRIMARY}`}
-								text="Login"
-								loading={loginLoading}
-							/>
-						</InputField>
+							<Altcha ref={altchaRef} auto="onload" />
+							<InputField error={loginError}>
+								<Button
+									name="login"
+									type="submit"
+									className={`${Classes.BUTTON} ${Classes.INTENT_PRIMARY}`}
+									text="Login"
+									loading={loginLoading}
+								/>
+							</InputField>
 						</form>
 
 						<a href="/signup" className="switch-message">
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/DiscussionInput.tsx b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/DiscussionInput.tsx
index 1505b3cbe2..580bd21025 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/DiscussionInput.tsx
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/DiscussionInput.tsx
@@ -53,7 +53,6 @@ const DiscussionInput = (props: Props) => {
 	const [didFocus, setDidFocus] = useState(false);
 	const [editorKey, setEditorKey] = useState(Date.now());
 	const [commenterName, setCommenterName] = useState('');
-	// const [authorUrl, _setAuthorUrl] = useState('');
 	const altchaRef = useRef<AltchaRef>(null);
 	const isNewThread = !discussionData.number;
 	const inputView = changeObject?.view;
@@ -96,7 +95,7 @@ const DiscussionInput = (props: Props) => {
 	const handlePostThreadComment = async (evt: React.FormEvent<HTMLFormElement>) => {
 		evt.preventDefault();
 		const formData = new FormData(evt.currentTarget);
-		const honeypot = (formData.get('authorUrl') as string) ?? '';
+		const honeypot = (formData.get('title') as string) ?? '';
 		setIsLoading(true);
 		try {
 			const altchaPayload = await altchaRef.current?.verify();
@@ -123,23 +122,25 @@ const DiscussionInput = (props: Props) => {
 				}),
 			});
 		} finally {
-			if (isPubBottomInput) {
-				setIsLoading(false);
-				setEditorKey(Date.now());
-			}
+			setIsLoading(false);
+			if (isPubBottomInput) setEditorKey(Date.now());
 		}
 	};
 
 	const handlePostDiscussion = async (evt: React.FormEvent<HTMLFormElement>) => {
 		evt.preventDefault();
 		const formData = new FormData(evt.currentTarget);
-		const honeypot = (formData.get('authorUrl') as string) ?? '';
+		const honeypot = (formData.get('title') as string) ?? '';
 		setIsLoading(true);
 		try {
 			const altchaPayload = await altchaRef.current?.verify();
 			const outputData = await apiFetch('/api/discussions/fromForm', {
 				method: 'POST',
-				body: JSON.stringify({ ...postDiscussionBody(), _honeypot: honeypot, altcha: altchaPayload }),
+				body: JSON.stringify({
+					...postDiscussionBody(),
+					_honeypot: honeypot,
+					altcha: altchaPayload,
+				}),
 			});
 			updateLocalData('pub', {
 				discussions: [...pubData.discussions, outputData],
@@ -226,8 +227,7 @@ const DiscussionInput = (props: Props) => {
 					onSubmit={isNewThread ? handlePostDiscussion : handlePostThreadComment}
 					className="content-wrapper"
 				>
-					<Altcha ref={altchaRef} />
-					<Honeypot name="authorUrl" />
+					<Honeypot name="title" />
 					<div className="discussion-body-wrapper editable">
 						<FormattingBar
 							editorChangeObject={changeObject}
@@ -243,18 +243,20 @@ const DiscussionInput = (props: Props) => {
 						/>
 						{renderUserNameInput()}
 					</div>
-				<Button
-					className="discussion-primary-button"
-					intent={Intent.PRIMARY}
-					type="submit"
-					text={isNewThread ? 'Post Discussion' : 'Post Reply'}
-					loading={isLoading}
-					disabled={
-						!getText(changeObject?.view) &&
-						!getTopLevelImages(changeObject?.view).length
-					}
-					small={true}
-				/>
+
+					<Altcha ref={altchaRef} />
+					<Button
+						className="discussion-primary-button"
+						intent={Intent.PRIMARY}
+						type="submit"
+						text={isNewThread ? 'Post Discussion' : 'Post Reply'}
+						loading={isLoading}
+						disabled={
+							!getText(changeObject?.view) &&
+							!getTopLevelImages(changeObject?.view).length
+						}
+						small={true}
+					/>
 					{isNewThread && !isPubBottomInput && (
 						<Button
 							className="discussion-cancel-button"
diff --git a/client/containers/Signup/Signup.tsx b/client/containers/Signup/Signup.tsx
index d56337216a..96ff4bff61 100644
--- a/client/containers/Signup/Signup.tsx
+++ b/client/containers/Signup/Signup.tsx
@@ -27,8 +27,6 @@ const Signup = () => {
 		setPostSignupError(undefined);
 		try {
 			const altchaPayload = await altchaRef.current?.verify();
-			console.log('altchaPayload', altchaPayload);
-			console.log('confirmEmail', confirmEmail);
 			if (!altchaPayload) {
 				throw new Error('Verification failed. Please try again.');
 			}
@@ -60,7 +58,7 @@ const Signup = () => {
 				body: JSON.stringify({
 					email: email.toLowerCase(),
 					communityId: communityData.id,
-					confirmEmail: '',
+					_honeypot: '',
 					altcha: '',
 				}),
 			});
@@ -89,7 +87,6 @@ const Signup = () => {
 							</p>
 						)}
 						<form onSubmit={onSignupSubmit}>
-							<Altcha ref={altchaRef} auto="onload" />
 							<InputField
 								label="Email"
 								placeholder="example@email.com"
@@ -98,6 +95,7 @@ const Signup = () => {
 								error={postSignupError}
 							/>
 							<Honeypot name="confirmEmail" />
+							<Altcha ref={altchaRef} auto="onload" />
 							<Button
 								name="signup"
 								type="submit"
@@ -128,7 +126,6 @@ const Signup = () => {
 						visual="tick-circle"
 						action={
 							<form onSubmit={handleResendEmail}>
-								<Altcha ref={altchaRef} auto="onload" />
 								<Button
 									name="resendEmail"
 									disabled={!altchaRef.current?.value}
@@ -137,6 +134,7 @@ const Signup = () => {
 									text="Resend Email"
 									loading={!altchaRef.current?.value || postSignupIsLoading}
 								/>
+								<Altcha ref={altchaRef} auto="onload" />
 							</form>
 						}
 					/>
diff --git a/client/containers/UserCreate/UserCreate.tsx b/client/containers/UserCreate/UserCreate.tsx
index 3c350a7aa8..b536de7a85 100644
--- a/client/containers/UserCreate/UserCreate.tsx
+++ b/client/containers/UserCreate/UserCreate.tsx
@@ -229,7 +229,6 @@ const UserCreate = (props: Props) => {
 				<GridWrapper containerClassName="small">
 					<h1>Create Account</h1>
 					<form onSubmit={onCreateSubmit}>
-						<Altcha ref={altchaRef} auto="onload" />
 						<InputField label="Email" isDisabled={true} value={signupData.email} />
 						<InputField
 							label="First Name"
@@ -343,6 +342,7 @@ const UserCreate = (props: Props) => {
 								.
 							</Checkbox>
 						</InputField>
+						<Altcha ref={altchaRef} auto="onload" />
 						<InputField error={postUserError && 'Error Creating User'}>
 							<Button
 								name="create"

From 37152292a16a8276bc27fa4d1b687639d27390b5 Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Thu, 12 Feb 2026 20:30:46 +0100
Subject: [PATCH 10/16] fix: lint

---
 client/components/Altcha/index.ts                        | 2 +-
 client/components/index.ts                               | 2 +-
 .../SuperAdminDashboard/UserSpam/UserSpamEntry.tsx       | 4 +++-
 server/apiRoutes.ts                                      | 2 +-
 server/discussion/api.ts                                 | 5 +++--
 server/pub/api.ts                                        | 5 +++--
 server/threadComment/api.ts                              | 9 +++++++--
 server/utils/__tests__/captcha.test.ts                   | 7 ++++++-
 server/utils/__tests__/honeypotIntegration.test.ts       | 3 +--
 9 files changed, 26 insertions(+), 13 deletions(-)

diff --git a/client/components/Altcha/index.ts b/client/components/Altcha/index.ts
index 13dcaca628..236dd78b2e 100644
--- a/client/components/Altcha/index.ts
+++ b/client/components/Altcha/index.ts
@@ -1 +1 @@
-export { default, type AltchaRef } from './Altcha';
+export { type AltchaRef, default } from './Altcha';
diff --git a/client/components/index.ts b/client/components/index.ts
index 8b57d940a5..97b3220fbc 100644
--- a/client/components/index.ts
+++ b/client/components/index.ts
@@ -1,5 +1,5 @@
 export { default as AccentStyle } from './AccentStyle/AccentStyle';
-export { default as Altcha, type AltchaRef } from './Altcha';
+export { type AltchaRef, default as Altcha } from './Altcha';
 export { default as AssignDoi } from './AssignDoi/AssignDoi';
 export { default as AttributionEditor } from './AttributionEditor/AttributionEditor';
 export { default as Avatar } from './Avatar/Avatar';
diff --git a/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx b/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
index 8dd0735432..c9b52d2236 100644
--- a/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
+++ b/client/containers/SuperAdminDashboard/UserSpam/UserSpamEntry.tsx
@@ -31,7 +31,9 @@ const UserSpamEntry = (props: Props) => {
 	const initialStatus = hasTag ? spamTag.status : null;
 	const [status, setUpdatedStatus] = useState<null | SpamStatus>(initialStatus);
 
-	const fields = hasTag ? ((spamTag.fields ?? {}) as UserSpamTagFields) : ({} as UserSpamTagFields);
+	const fields = hasTag
+		? ((spamTag.fields ?? {}) as UserSpamTagFields)
+		: ({} as UserSpamTagFields);
 	const fieldsJsonString = useMemo(() => JSON.stringify(fields, null, 2), [fields]);
 
 	const renderFieldsReport = () => {
diff --git a/server/apiRoutes.ts b/server/apiRoutes.ts
index cac836a1bc..ce67080f9e 100644
--- a/server/apiRoutes.ts
+++ b/server/apiRoutes.ts
@@ -4,8 +4,8 @@ import { isProd } from 'utils/environment';
 
 import { activityItemRouter } from './activityItem/api';
 import { router as apiDocsRouter } from './apiDocs/api';
-import { router as citationRouter } from './citation/api';
 import { router as captchaRouter } from './captcha/api';
+import { router as citationRouter } from './citation/api';
 import { router as communityServicesRouter } from './communityServices/api';
 import { router as customScriptRouter } from './customScript/api';
 import { router as devApiRouter } from './dev/api';
diff --git a/server/discussion/api.ts b/server/discussion/api.ts
index 73e912377a..7c8c62fa38 100644
--- a/server/discussion/api.ts
+++ b/server/discussion/api.ts
@@ -1,8 +1,8 @@
 import { Router } from 'express';
 
 import { verifyCaptchaPayload } from 'server/utils/captcha';
-import { handleHoneypotTriggered, isHoneypotFilled } from 'server/utils/honeypot';
 import { BadRequestError, ForbiddenError } from 'server/utils/errors';
+import { handleHoneypotTriggered, isHoneypotFilled } from 'server/utils/honeypot';
 import { wrap } from 'server/wrap';
 
 import { canReleaseDiscussions, getCreatePermission, getUpdatePermissions } from './permissions';
@@ -48,7 +48,8 @@ router.post(
 			throw new ForbiddenError();
 		}
 		if (isHoneypotFilled(req.body._honeypot)) {
-			if (req.user?.id) await handleHoneypotTriggered(req.user.id, 'create-discussion', req.body._honeypot);
+			if (req.user?.id)
+				await handleHoneypotTriggered(req.user.id, 'create-discussion', req.body._honeypot);
 			throw new BadRequestError(new Error('Invalid submission.'));
 		}
 		const ok = await verifyCaptchaPayload(req.body.altcha);
diff --git a/server/pub/api.ts b/server/pub/api.ts
index b526f920f0..1542da1731 100644
--- a/server/pub/api.ts
+++ b/server/pub/api.ts
@@ -11,10 +11,10 @@ import { transformPubToResource } from 'deposit/transform/pub';
 import { assertValidResource } from 'deposit/validate';
 import { generateDoi } from 'server/doi/queries';
 import { verifyCaptchaPayload } from 'server/utils/captcha';
-import { handleHoneypotTriggered, isHoneypotFilled } from 'server/utils/honeypot';
 import { BadRequestError, ForbiddenError, NotFoundError } from 'server/utils/errors';
 import { getPubDraftDoc } from 'server/utils/firebaseAdmin';
 import { writeDocumentToPubDraft } from 'server/utils/firebaseTools';
+import { handleHoneypotTriggered, isHoneypotFilled } from 'server/utils/honeypot';
 import { getInitialData } from 'server/utils/initData';
 import { contract } from 'utils/api/contract';
 import { indexByProperty } from 'utils/arrays';
@@ -112,7 +112,8 @@ export const pubServer = s.router(contract.pub, {
 	},
 	createFromForm: async ({ body, req }) => {
 		if (isHoneypotFilled(body._honeypot)) {
-			if (req.user?.id) await handleHoneypotTriggered(req.user.id, 'create-pub', body._honeypot as string);
+			if (req.user?.id)
+				await handleHoneypotTriggered(req.user.id, 'create-pub', body._honeypot as string);
 			throw new BadRequestError(new Error('Invalid submission.'));
 		}
 		const altchaPayload = body.altcha;
diff --git a/server/threadComment/api.ts b/server/threadComment/api.ts
index f58a0904f4..a485824c10 100644
--- a/server/threadComment/api.ts
+++ b/server/threadComment/api.ts
@@ -1,8 +1,8 @@
 import { Router } from 'express';
 
 import { verifyCaptchaPayload } from 'server/utils/captcha';
-import { handleHoneypotTriggered, isHoneypotFilled } from 'server/utils/honeypot';
 import { BadRequestError, ForbiddenError } from 'server/utils/errors';
+import { handleHoneypotTriggered, isHoneypotFilled } from 'server/utils/honeypot';
 import { wrap } from 'server/wrap';
 
 import { getPermissions } from './permissions';
@@ -48,7 +48,12 @@ router.post(
 			throw new ForbiddenError();
 		}
 		if (isHoneypotFilled(req.body._honeypot)) {
-			if (req.user?.id) await handleHoneypotTriggered(req.user.id, 'create-thread-comment', req.body._honeypot);
+			if (req.user?.id)
+				await handleHoneypotTriggered(
+					req.user.id,
+					'create-thread-comment',
+					req.body._honeypot,
+				);
 			throw new BadRequestError(new Error('Invalid submission.'));
 		}
 		const ok = await verifyCaptchaPayload(req.body.altcha);
diff --git a/server/utils/__tests__/captcha.test.ts b/server/utils/__tests__/captcha.test.ts
index dd61f9bf2c..055caa8120 100644
--- a/server/utils/__tests__/captcha.test.ts
+++ b/server/utils/__tests__/captcha.test.ts
@@ -5,7 +5,12 @@ import { getAltchaHmacKey, verifyCaptchaPayload } from '../captcha';
 const createValidPayload = async (): Promise<string> => {
 	const hmacKey = getAltchaHmacKey();
 	const challenge = await createChallenge({ hmacKey, maxNumber: 1000 });
-	const { promise } = solveChallenge(challenge.challenge, challenge.salt, challenge.algorithm, challenge.maxnumber);
+	const { promise } = solveChallenge(
+		challenge.challenge,
+		challenge.salt,
+		challenge.algorithm,
+		challenge.maxnumber,
+	);
 	const solution = await promise;
 	if (!solution) throw new Error('failed to solve challenge');
 	return btoa(
diff --git a/server/utils/__tests__/honeypotIntegration.test.ts b/server/utils/__tests__/honeypotIntegration.test.ts
index ba11e437d5..ab261f655d 100644
--- a/server/utils/__tests__/honeypotIntegration.test.ts
+++ b/server/utils/__tests__/honeypotIntegration.test.ts
@@ -1,6 +1,5 @@
-import { modelize, setup, teardown } from 'stubstub';
-
 import { getSpamTagForUser } from 'server/spamTag/userQueries';
+import { modelize, setup, teardown } from 'stubstub';
 
 import { handleHoneypotTriggered, isHoneypotFilled } from '../honeypot';
 

From 31b9f956f6c7c243402a46025d1e1622c579f1bb Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Thu, 12 Feb 2026 20:59:51 +0100
Subject: [PATCH 11/16] fix: send slack message on ban/unban

---
 server/spamTag/userQueries.ts |  12 ++-
 server/utils/email/spam.ts    |   6 +-
 server/utils/slack.ts         | 166 +++++++++++++++++++++++-----------
 3 files changed, 127 insertions(+), 57 deletions(-)

diff --git a/server/spamTag/userQueries.ts b/server/spamTag/userQueries.ts
index 818b75e598..f4ee8a69f3 100644
--- a/server/spamTag/userQueries.ts
+++ b/server/spamTag/userQueries.ts
@@ -6,6 +6,7 @@ import mergeWith from 'lodash.mergewith';
 import { SpamTag, User } from 'server/models';
 import { sendSpamBanEmail, sendSpamLiftedEmail } from 'server/utils/email';
 import { deleteSessionsForUser } from 'server/utils/session';
+import { postToSlackAboutUserBan, postToSlackAboutUserLifted } from 'server/utils/slack';
 import { expect } from 'utils/assert';
 
 import { getSuspectedUserSpamVerdict } from './userScore';
@@ -84,10 +85,10 @@ export const updateSpamTagForUser = async (options: UpdateSpamTagForUserOptions)
 		throw new Error('User is missing a SpamTag');
 	}
 	await spamTag.update({ status, statusUpdatedAt: new Date() });
-	await applySpamStatusSideEffects(userId, status);
+	await applySpamStatusSideEffects(userId, status, spamTag);
 };
 
-const applySpamStatusSideEffects = async (userId: string, status: SpamStatus) => {
+const applySpamStatusSideEffects = async (userId: string, status: SpamStatus, spamTag: SpamTag) => {
 	const user = await User.findOne({
 		where: { id: userId },
 		attributes: ['email', 'fullName'],
@@ -101,8 +102,15 @@ const applySpamStatusSideEffects = async (userId: string, status: SpamStatus) =>
 				console.error('Failed to delete sessions for banned user', userId, err);
 			}
 			await sendSpamBanEmail({ toEmail: user.email, userName: user.fullName ?? '' });
+			await postToSlackAboutUserBan(
+				userId,
+				user.email,
+				user.fullName ?? '',
+				spamTag.fields as UserSpamTagFields,
+			);
 		} else if (status === 'confirmed-not-spam') {
 			await sendSpamLiftedEmail({ toEmail: user.email, userName: user.fullName ?? '' });
+			await postToSlackAboutUserLifted(userId, user.email, user.fullName ?? '');
 		}
 	} catch (err) {
 		console.error('Failed to send spam status email', err);
diff --git a/server/utils/email/spam.ts b/server/utils/email/spam.ts
index f2de76ff9c..202e107ab7 100644
--- a/server/utils/email/spam.ts
+++ b/server/utils/email/spam.ts
@@ -2,12 +2,12 @@ import stripIndent from 'strip-indent';
 
 import { sendEmail } from './reset';
 
-const CC_DEV = ['dev@pubpub.org'];
+// const CC_DEV = ['dev@pubpub.org'];
 
 export const sendSpamBanEmail = ({ toEmail, userName }: { toEmail: string; userName: string }) => {
 	return sendEmail({
 		to: [toEmail],
-		cc: CC_DEV,
+		// cc: CC_DEV,
 		subject: 'PubPub account restriction',
 		text: stripIndent(`
 			Hello${userName ? ` ${userName}` : ''},
@@ -31,7 +31,7 @@ export const sendSpamLiftedEmail = ({
 }) => {
 	return sendEmail({
 		to: [toEmail],
-		cc: CC_DEV,
+		// cc: CC_DEV,
 		subject: 'PubPub account restriction lifted',
 		text: stripIndent(`
 			Hello${userName ? ` ${userName}` : ''},
diff --git a/server/utils/slack.ts b/server/utils/slack.ts
index d1be03c4b2..45979f314e 100644
--- a/server/utils/slack.ts
+++ b/server/utils/slack.ts
@@ -1,3 +1,5 @@
+import type { UserSpamTagFields } from 'types';
+
 import fetch from 'node-fetch';
 
 import { isDangerousSpamScore } from 'server/spamTag/score';
@@ -31,36 +33,36 @@ export const postToSlackAboutNewCommunity = async (
 	adminEmail: string,
 	spamScore: undefined | null | number,
 ) => {
-	if (isProd()) {
-		const url = `https://${subdomain}.pubpub.org`;
-		const spamDashUrl = `https://pubpub.org${getSuperAdminTabUrl('spam')}?q=${url}`;
-		const spamScorePart = typeof spamScore === 'number' ? `\nSpam score: ${spamScore}` : '';
-		await postToSlack({
-			icon_emoji: ':bowtie:',
-			attachments: [
-				{
-					fallback: `*${title}*\n<${url}>\n_${adminName} (${adminEmail})_`,
-					pretext: 'New Community created!',
-					color: 'good',
-					fields: [
-						{
-							title: `${title}`,
-							value: `${url}\n_${adminName} (${adminEmail})_${spamScorePart}`,
-						},
-					],
-					actions: [
-						{
-							type: 'button',
-							text: 'Manage in Spam Dashboard',
-							style:
-								spamScore && isDangerousSpamScore(spamScore) ? 'danger' : 'default',
-							url: spamDashUrl,
-						},
-					],
-				},
-			],
-		});
+	if (process.env.NODE_ENV === 'test') {
+		return;
 	}
+	const url = `https://${subdomain}.pubpub.org`;
+	const spamDashUrl = `https://pubpub.org${getSuperAdminTabUrl('spam')}?q=${url}`;
+	const spamScorePart = typeof spamScore === 'number' ? `\nSpam score: ${spamScore}` : '';
+	await postToSlack({
+		icon_emoji: ':bowtie:',
+		attachments: [
+			{
+				fallback: `*${title}*\n<${url}>\n_${adminName} (${adminEmail})_`,
+				pretext: 'New Community created!',
+				color: 'good',
+				fields: [
+					{
+						title: `${title}`,
+						value: `${url}\n_${adminName} (${adminEmail})_${spamScorePart}`,
+					},
+				],
+				actions: [
+					{
+						type: 'button',
+						text: 'Manage in Spam Dashboard',
+						style: spamScore && isDangerousSpamScore(spamScore) ? 'danger' : 'default',
+						url: spamDashUrl,
+					},
+				],
+			},
+		],
+	});
 };
 
 export const postToSlackAboutSuspiciousUpload = async (
@@ -69,28 +71,88 @@ export const postToSlackAboutSuspiciousUpload = async (
 	userName: string,
 	key: string,
 ) => {
-	if (isProd()) {
-		const spamUsersUrl = `https://pubpub.org${getSuperAdminTabUrl('spamUsers')}?q=${encodeURIComponent(userEmail)}`;
-		await postToSlack({
-			icon_emoji: ':warning:',
-			attachments: [
-				{
-					fallback: `Suspicious upload by ${userName} (${userEmail}): ${key}`,
-					pretext: 'Suspicious upload detected (scam keywords in filename)',
-					color: 'warning',
-					fields: [
-						{ title: 'User', value: `${userName} (${userEmail})` },
-						{ title: 'Object key', value: key },
-					],
-					actions: [
-						{
-							type: 'button',
-							text: 'View in Spam Users Dashboard',
-							url: spamUsersUrl,
-						},
-					],
-				},
-			],
-		});
+	if (process.env.NODE_ENV === 'test') {
+		return;
+	}
+	const spamUsersUrl = `https://pubpub.org${getSuperAdminTabUrl('spamUsers')}?q=${encodeURIComponent(userEmail)}`;
+	await postToSlack({
+		icon_emoji: ':warning:',
+		attachments: [
+			{
+				fallback: `Suspicious upload by ${userName} (${userEmail}): ${key}`,
+				pretext: 'Suspicious upload detected (scam keywords in filename)',
+				color: 'warning',
+				fields: [
+					{ title: 'User', value: `${userName} (${userEmail})` },
+					{ title: 'Object key', value: key },
+				],
+				actions: [
+					{
+						type: 'button',
+						text: 'View in Spam Users Dashboard',
+						url: spamUsersUrl,
+					},
+				],
+			},
+		],
+	});
+};
+
+export const postToSlackAboutUserBan = async (
+	userId: string,
+	userEmail: string,
+	userName: string,
+	reason: UserSpamTagFields,
+) => {
+	if (process.env.NODE_ENV === 'test') {
+		return;
+	}
+	const spamUsersUrl = `https://pubpub.org${getSuperAdminTabUrl('spamUsers')}?q=${encodeURIComponent(userEmail)}`;
+	let reasonText = '';
+	if (reason.suspiciousFiles?.length) {
+		reasonText = 'Uploading suspicious files';
+	} else if (reason.suspiciousComments?.length) {
+		reasonText = 'Posting suspicious comments';
+	} else if (reason.honeypotTriggers?.length) {
+		reasonText = 'Falling for honeypots';
+	}
+	await postToSlack({
+		icon_emoji: ':warning:',
+		attachments: [
+			{
+				fallback: `${userName} (${userEmail}) banned for ${reasonText}`,
+				pretext: `${userName} (${userEmail}) banned for ${reasonText}`,
+				color: 'danger',
+				fields: [{ title: 'User', value: `${userName} (${userEmail})` }],
+				actions: [
+					{
+						type: 'button',
+						text: 'View in Spam Users Dashboard',
+						url: spamUsersUrl,
+					},
+				],
+			},
+		],
+	});
+};
+
+export const postToSlackAboutUserLifted = async (
+	userId: string,
+	userEmail: string,
+	userName: string,
+) => {
+	if (process.env.NODE_ENV === 'test') {
+		return;
 	}
+	await postToSlack({
+		icon_emoji: ':warning:',
+		attachments: [
+			{
+				fallback: `${userName} (${userEmail}) lifted`,
+				pretext: `${userName} (${userEmail}) lifted`,
+				color: 'good',
+				fields: [{ title: 'User', value: `${userName} (${userEmail})` }],
+			},
+		],
+	});
 };

From f7eab427467cbea902d1cf3b0bc1dd58a6975157 Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Thu, 12 Feb 2026 21:42:04 +0100
Subject: [PATCH 12/16] fix: skip captchas in test

---
 .test/setup-env.js      |  1 +
 server/community/api.ts |  5 ++---
 server/pub/api.ts       |  3 +--
 server/utils/captcha.ts | 24 +++++++++++++++++++++---
 4 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/.test/setup-env.js b/.test/setup-env.js
index bdf31b2524..69c2b8ebdf 100644
--- a/.test/setup-env.js
+++ b/.test/setup-env.js
@@ -17,6 +17,7 @@ process.env.ALGOLIA_ID = 'ooo';
 process.env.ALGOLIA_KEY = 'ooo';
 process.env.ALGOLIA_SEARCH_KEY = 'ooo';
 process.env.JWT_SIGNING_SECRET = 'shhhhhh';
+process.env.BYPASS_CAPTCHA = 'true';
 process.env.FIREBASE_TEST_DB_URL = 'http://localhost:9875?ns=pubpub-v6';
 process.env.ZOTERO_CLIENT_KEY = 'abc';
 process.env.ZOTERO_CLIENT_SECRET = 'def';
diff --git a/server/community/api.ts b/server/community/api.ts
index f70d1356f9..49894843b8 100644
--- a/server/community/api.ts
+++ b/server/community/api.ts
@@ -139,7 +139,7 @@ export const communityServer = s.router(contract.community, {
 		};
 	},
 	create: async ({ req }) => {
-		if (!req.user) {
+		if (!req.user || !req.user.isSuperAdmin) {
 			throw new ForbiddenError();
 		}
 		if (isHoneypotFilled(req.body._honeypot)) {
@@ -154,8 +154,7 @@ export const communityServer = s.router(contract.community, {
 				status: 201,
 			};
 		}
-		const altchaPayload = req.body.altcha;
-		if (!altchaPayload || !(await verifyCaptchaPayload(altchaPayload))) {
+		if (!(await verifyCaptchaPayload(req.body.altcha))) {
 			throw new BadRequestError(new Error('Please complete the verification and try again.'));
 		}
 		const body = { ...req.body };
diff --git a/server/pub/api.ts b/server/pub/api.ts
index 1542da1731..1d188021e7 100644
--- a/server/pub/api.ts
+++ b/server/pub/api.ts
@@ -116,8 +116,7 @@ export const pubServer = s.router(contract.pub, {
 				await handleHoneypotTriggered(req.user.id, 'create-pub', body._honeypot as string);
 			throw new BadRequestError(new Error('Invalid submission.'));
 		}
-		const altchaPayload = body.altcha;
-		if (!altchaPayload || !(await verifyCaptchaPayload(altchaPayload))) {
+		if (!(await verifyCaptchaPayload(body.altcha))) {
 			throw new BadRequestError(new Error('Please complete the verification and try again.'));
 		}
 		const { altcha: _altcha, _honeypot, ...bodyStripped } = body;
diff --git a/server/utils/captcha.ts b/server/utils/captcha.ts
index fb3ae9067f..0947e190d3 100644
--- a/server/utils/captcha.ts
+++ b/server/utils/captcha.ts
@@ -2,6 +2,23 @@ import { verifySolution } from 'altcha-lib';
 
 import { isProd } from 'utils/environment';
 
+/**
+ * captcha + honeypot system
+ *
+ * captcha (altcha):
+ *   proof-of-work challenge verified server-side via HMAC. in prod, ALTCHA_HMAC_KEY
+ *   must be set. in dev/test the fallback key is used automatically.
+ *   set BYPASS_CAPTCHA=true to skip verification entirely (useful in tests).
+ *   to test captcha behavior specifically, unset BYPASS_CAPTCHA and use altcha-lib
+ *   to generate a valid payload with getAltchaHmacKey().
+ *
+ * honeypot:
+ *   hidden form fields with natural-looking names (e.g. "title", "description").
+ *   the client maps the value to `_honeypot` in the request body.
+ *   if filled, the user is tagged as confirmed-spam via handleHoneypotTriggered.
+ *   see server/utils/honeypot.ts.
+ */
+
 const DEV_HMAC_KEY = 'dev-altcha-hmac-key-do-not-use-in-production';
 
 export const getAltchaHmacKey = (): string => {
@@ -12,10 +29,11 @@ export const getAltchaHmacKey = (): string => {
 	return key ?? DEV_HMAC_KEY;
 };
 
-export const verifyCaptchaPayload = async (payload: string): Promise<boolean> => {
-	console.log('payload', payload);
+export const isCaptchaBypassed = (): boolean => process.env.BYPASS_CAPTCHA === 'true';
+
+export const verifyCaptchaPayload = async (payload: unknown): Promise<boolean> => {
+	if (isCaptchaBypassed()) return true;
 	if (!payload || typeof payload !== 'string') return false;
 	const hmacKey = getAltchaHmacKey();
-	console.log('hmacKey', hmacKey);
 	return verifySolution(payload, hmacKey);
 };

From e7f7c42937ca98d0a771c621de0eb4a47da6d19f Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Thu, 12 Feb 2026 21:59:04 +0100
Subject: [PATCH 13/16] fix

---
 server/utils/__tests__/captcha.test.ts | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/server/utils/__tests__/captcha.test.ts b/server/utils/__tests__/captcha.test.ts
index 055caa8120..16c0b7acc5 100644
--- a/server/utils/__tests__/captcha.test.ts
+++ b/server/utils/__tests__/captcha.test.ts
@@ -24,12 +24,18 @@ const createValidPayload = async (): Promise<string> => {
 	);
 };
 
+beforeAll(() => {
+	process.env.BYPASS_CAPTCHA = undefined;
+});
+
+afterAll(() => {
+	process.env.BYPASS_CAPTCHA = 'true';
+});
+
 describe('verifyCaptchaPayload', () => {
 	it('returns false for empty or missing payload', async () => {
 		expect(await verifyCaptchaPayload('')).toBe(false);
-		// @ts-expect-error testing invalid input
 		expect(await verifyCaptchaPayload(null)).toBe(false);
-		// @ts-expect-error testing invalid input
 		expect(await verifyCaptchaPayload(undefined)).toBe(false);
 	});
 

From 5cf9d94534275218c640989a48bc04bdfd0bbf42 Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Wed, 25 Feb 2026 19:19:30 +0100
Subject: [PATCH 14/16] fix: typecheck

---
 server/community/queries.ts   |  4 ++--
 server/spamTag/userQueries.ts | 11 -----------
 2 files changed, 2 insertions(+), 13 deletions(-)

diff --git a/server/community/queries.ts b/server/community/queries.ts
index 3d6b8bf50d..40d3663171 100644
--- a/server/community/queries.ts
+++ b/server/community/queries.ts
@@ -84,8 +84,8 @@ export const createCommunity = async (
 			heroTitle: inputValues.heroLogo ? '' : inputValues.title,
 			hideHeaderLogo: true,
 			heroText: description,
-			accentColorLight: inputValues.accentColorLight,
-			accentColorDark: inputValues.accentColorDark,
+			accentColorLight: inputValues.accentColorLight ?? '#ffffff',
+			accentColorDark: inputValues.accentColorDark ?? '#000000',
 			navigation: [{ type: 'page', id: homePageId }],
 			hideCreatePubButton: true,
 		},
diff --git a/server/spamTag/userQueries.ts b/server/spamTag/userQueries.ts
index 5a57369f7b..f4ee8a69f3 100644
--- a/server/spamTag/userQueries.ts
+++ b/server/spamTag/userQueries.ts
@@ -127,14 +127,3 @@ export const removeSpamTagFromUser = async (userId: string) => {
 		await spamTag.destroy();
 	}
 };
-
-export const removeSpamTagFromUser = async (userId: string) => {
-	const spamTag = await getSpamTagForUser(userId);
-	if (spamTag) {
-		await User.update(
-			{ spamTagId: null },
-			{ where: { id: userId }, limit: 1, individualHooks: false },
-		);
-		await spamTag.destroy();
-	}
-};

From d23b55d5a8de5183663a24c29a4d7c5e91e27f01 Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Wed, 25 Feb 2026 21:20:23 +0100
Subject: [PATCH 15/16] fix: allow superadmins to instaban from comments

---
 .../SpamStatusMenu/SpamStatusMenu.tsx         | 78 +++++++++++++++++++
 client/components/SpamStatusMenu/index.ts     |  1 +
 client/components/index.ts                    |  1 +
 .../PubDiscussions/Discussion/Discussion.tsx  |  5 +-
 .../PubDiscussions/Discussion/ManageTools.tsx |  5 +-
 .../Discussion/ThreadComment.tsx              | 11 ++-
 .../PubDiscussions/Discussion/discussion.scss | 17 ++++
 .../Discussion/threadComment.scss             | 17 ++++
 client/containers/User/UserHeader.tsx         | 54 ++++++++++++-
 infra/docker-compose.dev.yml                  |  3 +
 server/routes/user.tsx                        | 10 +++
 server/spamTag/userQueries.ts                 | 29 ++++++-
 server/utils/email/reset.ts                   |  2 +
 server/utils/email/spam.ts                    | 29 ++++++-
 server/utils/queryHelpers/userGet.ts          |  6 +-
 server/utils/slack.ts                         | 35 +++++++++
 16 files changed, 288 insertions(+), 15 deletions(-)
 create mode 100644 client/components/SpamStatusMenu/SpamStatusMenu.tsx
 create mode 100644 client/components/SpamStatusMenu/index.ts

diff --git a/client/components/SpamStatusMenu/SpamStatusMenu.tsx b/client/components/SpamStatusMenu/SpamStatusMenu.tsx
new file mode 100644
index 0000000000..ea02c2f90c
--- /dev/null
+++ b/client/components/SpamStatusMenu/SpamStatusMenu.tsx
@@ -0,0 +1,78 @@
+import type { SpamStatus } from 'types';
+
+import React, { useCallback, useState } from 'react';
+
+import { apiFetch } from 'client/utils/apiFetch';
+import { Icon } from 'components';
+import { MenuButton, MenuItem, MenuItemDivider } from 'components/Menu';
+
+type Props = {
+	userId: string;
+	currentStatus?: SpamStatus | null;
+	onStatusChanged?: (status: SpamStatus | null) => void;
+	small?: boolean;
+};
+
+const statusLabels: Record<SpamStatus, { label: string; icon: string }> = {
+	'confirmed-spam': { label: 'Mark as spam', icon: 'cross' },
+	'confirmed-not-spam': { label: 'Mark as not spam', icon: 'tick' },
+	unreviewed: { label: 'Mark as unreviewed', icon: 'undo' },
+};
+
+const SpamStatusMenu = (props: Props) => {
+	const { userId, currentStatus = null, onStatusChanged, small = true } = props;
+	const [isLoading, setIsLoading] = useState(false);
+
+	const handleSetStatus = useCallback(
+		async (status: SpamStatus) => {
+			setIsLoading(true);
+			try {
+				await apiFetch.put('/api/spamTags/user', { status, userId });
+				onStatusChanged?.(status);
+			} finally {
+				setIsLoading(false);
+			}
+		},
+		[userId, onStatusChanged],
+	);
+
+	const handleRemoveTag = useCallback(async () => {
+		setIsLoading(true);
+		try {
+			await apiFetch.delete('/api/spamTags/user', { userId });
+			onStatusChanged?.(null);
+		} finally {
+			setIsLoading(false);
+		}
+	}, [userId, onStatusChanged]);
+
+	return (
+		<MenuButton
+			aria-label="Spam actions"
+			buttonContent="Spam"
+			buttonProps={{
+				icon: <Icon icon="flag" iconSize={small ? 12 : 14} />,
+				minimal: true,
+				small,
+				loading: isLoading,
+			}}
+		>
+			{(Object.keys(statusLabels) as SpamStatus[]).map((status) => (
+				<MenuItem
+					key={status}
+					text={statusLabels[status].label}
+					icon={status === currentStatus ? 'tick' : 'blank'}
+					onClick={() => handleSetStatus(status)}
+				/>
+			))}
+			{currentStatus && (
+				<>
+					<MenuItemDivider />
+					<MenuItem text="Remove spam tag" icon="trash" onClick={handleRemoveTag} />
+				</>
+			)}
+		</MenuButton>
+	);
+};
+
+export default SpamStatusMenu;
diff --git a/client/components/SpamStatusMenu/index.ts b/client/components/SpamStatusMenu/index.ts
new file mode 100644
index 0000000000..fdf93533b8
--- /dev/null
+++ b/client/components/SpamStatusMenu/index.ts
@@ -0,0 +1 @@
+export { default } from './SpamStatusMenu';
diff --git a/client/components/index.ts b/client/components/index.ts
index 97b3220fbc..b7b76b8f0e 100644
--- a/client/components/index.ts
+++ b/client/components/index.ts
@@ -102,6 +102,7 @@ export { default as SettingsSection } from './SettingsSection/SettingsSection';
 export { default as SharingCard } from './SharingCard/SharingCard';
 export { default as SimpleEditor } from './SimpleEditor/SimpleEditor';
 export { default as SkipLink } from './SkipLink/SkipLink';
+export { default as SpamStatusMenu } from './SpamStatusMenu';
 export { default as SliderInput } from './SliderInput/SliderInput';
 export { default as SubmissionEmail } from './SubmissionEmail/SubmissionEmail';
 export { default as SubscriptionButton } from './SubscriptionButton/SubscriptionButton';
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx
index aec5c27d6c..92dec20824 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx
@@ -221,7 +221,10 @@ const Discussion = (props: Props) => {
 				/>
 			)}
 			<LabelList pubData={pubData} discussionData={discussionData} />
-			{!isPreview && isAuthorSpam && (
+			{isAuthorSpam && isPreview && (
+				<span className="spam-badge">Spam</span>
+			)}
+			{isAuthorSpam && !isPreview && (
 				<div className="discussion-spam-banner">
 					This user has been banned. Only you and other admins of this community can see
 					this discussion. You can safely remove it.
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ManageTools.tsx b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ManageTools.tsx
index 0de5acc71a..b46e62d488 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ManageTools.tsx
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ManageTools.tsx
@@ -2,7 +2,7 @@ import React, { useState } from 'react';
 
 import { Button } from '@blueprintjs/core';
 
-import { ConfirmDialog, Icon } from 'components';
+import { ConfirmDialog, Icon, SpamStatusMenu } from 'components';
 import { MenuButton, MenuItem } from 'components/Menu';
 import { usePageContext } from 'utils/hooks';
 
@@ -107,6 +107,9 @@ const ManageTools = (props: Props) => {
 			{renderArchiveButton()}
 			{renderSortMenu()}
 			{isSuperAdmin && <DiscussionReanchor discussionData={discussionData} />}
+			{isSuperAdmin && discussionData.userId && (
+				<SpamStatusMenu userId={discussionData.userId} />
+			)}
 		</div>
 	);
 };
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx
index 573441dd75..7cc05fe70c 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx
@@ -7,7 +7,7 @@ import classNames from 'classnames';
 import TimeAgo from 'react-timeago';
 
 import { apiFetch } from 'client/utils/apiFetch';
-import { Avatar, Icon } from 'components';
+import { Avatar, Icon, SpamStatusMenu } from 'components';
 import Editor, { type EditorChangeObject, getJSON, getText, viewIsEmpty } from 'components/Editor';
 import { buttons, FormattingBar } from 'components/FormattingBar';
 import { usePageContext } from 'utils/hooks';
@@ -31,7 +31,8 @@ const ThreadComment = (props: Props) => {
 		updateLocalData,
 		isPreview = false,
 	} = props;
-	const { loginData, communityData, locationData } = usePageContext();
+	const { loginData, communityData, locationData, scopeData } = usePageContext();
+	const { isSuperAdmin } = scopeData.activePermissions;
 	const [isEditing, setIsEditing] = useState(false);
 	const [changeObject, setChangeObject] = useState<null | EditorChangeObject>(null);
 	const [isLoadingEdit, setIsLoadingEdit] = useState(false);
@@ -114,6 +115,9 @@ const ThreadComment = (props: Props) => {
 						{threadCommentData.author
 							? threadCommentData.author.fullName
 							: (commenterName ?? 'anonymous')}
+						{isAuthorSpam && isPreview && (
+							<span className="spam-badge">Spam</span>
+						)}
 						{isPreview ? ': ' : ''}
 					</span>
 
@@ -155,6 +159,9 @@ const ThreadComment = (props: Props) => {
 								}}
 							/>
 						)}
+						{!isPreview && isSuperAdmin && threadCommentData.userId && (
+							<SpamStatusMenu userId={threadCommentData.userId} />
+						)}
 					</span>
 				</div>
 				{!isPreview && isAuthorSpam && (
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/discussion.scss b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/discussion.scss
index 9cd916f21f..82af59b299 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/discussion.scss
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/discussion.scss
@@ -12,6 +12,23 @@ $bp: vendor.$bp-namespace;
 	text-align: left;
 	&.is-author-spam {
 		opacity: 0.9;
+		border-left: 3px solid #d9534f;
+		padding-left: calc(1em - 3px);
+		background: rgba(217, 83, 79, 0.03);
+	}
+	.spam-badge {
+		display: inline-block;
+		font-size: 10px;
+		font-weight: 600;
+		line-height: 1;
+		padding: 2px 5px;
+		margin-left: 6px;
+		background: #d9534f;
+		color: white;
+		border-radius: 2px;
+		vertical-align: middle;
+		text-transform: uppercase;
+		letter-spacing: 0.5px;
 	}
 	.discussion-spam-banner {
 		margin-bottom: 0.75em;
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/threadComment.scss b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/threadComment.scss
index 66165dfb3d..f25ff63fb1 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/threadComment.scss
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/threadComment.scss
@@ -12,6 +12,23 @@
 		.discussion-body-wrapper {
 			opacity: 0.85;
 		}
+		border-left: 3px solid #d9534f;
+		padding-left: 0.5em;
+		background: rgba(217, 83, 79, 0.03);
+	}
+	.spam-badge {
+		display: inline-block;
+		font-size: 10px;
+		font-weight: 600;
+		line-height: 1;
+		padding: 2px 5px;
+		margin-left: 4px;
+		background: #d9534f;
+		color: white;
+		border-radius: 2px;
+		vertical-align: middle;
+		text-transform: uppercase;
+		letter-spacing: 0.5px;
 	}
 	.thread-comment-spam-banner {
 		width: 100%;
diff --git a/client/containers/User/UserHeader.tsx b/client/containers/User/UserHeader.tsx
index ae1c836065..672cbe46c3 100644
--- a/client/containers/User/UserHeader.tsx
+++ b/client/containers/User/UserHeader.tsx
@@ -1,12 +1,15 @@
+import type { SpamStatus } from 'types';
 import type { SocialItem } from 'client/utils/navigation';
 
-import React from 'react';
+import React, { useCallback, useState } from 'react';
 
-import { Classes } from '@blueprintjs/core';
+import { Callout, Classes, Tag } from '@blueprintjs/core';
 import PropTypes from 'prop-types';
 
 import Avatar from 'components/Avatar/Avatar';
 import Icon from 'components/Icon/Icon';
+import SpamStatusMenu from 'components/SpamStatusMenu';
+import { usePageContext } from 'utils/hooks';
 
 import './userHeader.scss';
 
@@ -19,7 +22,22 @@ const defaultProps = {
 	isUser: false,
 };
 
+const spamStatusDisplay: Record<SpamStatus, { label: string; intent: 'danger' | 'warning' | 'success' }> = {
+	'confirmed-spam': { label: 'Confirmed spam', intent: 'danger' },
+	unreviewed: { label: 'Unreviewed', intent: 'warning' },
+	'confirmed-not-spam': { label: 'Not spam', intent: 'success' },
+};
+
 const UserHeader = function (props) {
+	const { loginData } = usePageContext();
+	const isSuperAdmin = !!loginData.isSuperAdmin;
+	const spamTag = props.userData.spamTag;
+	const [spamStatus, setSpamStatus] = useState<SpamStatus | null>(spamTag?.status ?? null);
+
+	const handleSpamStatusChanged = useCallback((status: SpamStatus | null) => {
+		setSpamStatus(status);
+	}, []);
+
 	const links = [
 		{ value: props.userData.location, icon: 'map-marker' as const, url: '' },
 		{
@@ -96,9 +114,39 @@ const UserHeader = function (props) {
 				)}
 			</div>
 			<div className="details">
-				<h1>{props.userData.fullName}</h1>
+				<h1>
+					{props.userData.fullName}
+					{isSuperAdmin && spamStatus && (
+						<Tag
+							intent={spamStatusDisplay[spamStatus].intent}
+							minimal
+							style={{ marginLeft: 10, verticalAlign: 'middle', fontSize: 12 }}
+						>
+							{spamStatusDisplay[spamStatus].label}
+						</Tag>
+					)}
+				</h1>
 				{props.userData.title && <div className="title">{props.userData.title}</div>}
 				{props.userData.bio && <div className="bio">{props.userData.bio}</div>}
+				{isSuperAdmin && (
+					<Callout
+						intent={spamStatus === 'confirmed-spam' ? 'danger' : 'none'}
+						icon="shield"
+						style={{ marginTop: 12, marginBottom: 12 }}
+					>
+						<div style={{ display: 'flex', alignItems: 'center', gap: 8 }}>
+							<span style={{ fontWeight: 500 }}>
+								Spam status: {spamStatus ? spamStatusDisplay[spamStatus].label : 'None'}
+							</span>
+							<SpamStatusMenu
+								userId={props.userData.id}
+								currentStatus={spamStatus}
+								onStatusChanged={handleSpamStatusChanged}
+								small={false}
+							/>
+						</div>
+					</Callout>
+				)}
 				<div className="links">
 					{links
 						.filter((link) => {
diff --git a/infra/docker-compose.dev.yml b/infra/docker-compose.dev.yml
index 1994d3ee0e..c6ee5fc451 100644
--- a/infra/docker-compose.dev.yml
+++ b/infra/docker-compose.dev.yml
@@ -12,6 +12,8 @@ services:
         environment:
             NODE_ENV: development
             PORT: 3000
+            # disable this
+            IS_DUQDUQ: ""
             DATABASE_URL: postgres://appuser:apppassword@db:5432/appdb
             CLOUDAMQP_URL: amqp://appuser:apppassword@rabbitmq:5672/appvhost
         depends_on:
@@ -39,6 +41,7 @@ services:
         depends_on:
             - db
             - rabbitmq
+            - app
         networks: [appnet]
         volumes:
             - ..:/app
diff --git a/server/routes/user.tsx b/server/routes/user.tsx
index b827738f40..adbb309dcd 100644
--- a/server/routes/user.tsx
+++ b/server/routes/user.tsx
@@ -7,6 +7,7 @@ import { Router } from 'express';
 import { isUserAffiliatedWithCommunity } from 'server/community/queries';
 import { getCustomScriptsForCommunity } from 'server/customScript/queries';
 import Html from 'server/Html';
+import { getSpamTagForUser } from 'server/spamTag/userQueries';
 import { handleErrors } from 'server/utils/errors';
 import { getInitialData } from 'server/utils/initData';
 import { getUser } from 'server/utils/queryHelpers';
@@ -61,6 +62,15 @@ router.get(['/user/:slug', '/user/:slug/:mode'], async (req, res, next) => {
 			? await getCustomScriptsForCommunity(initialData.communityData.id)
 			: undefined;
 		const userData = expect(await getUser(req.params.slug, initialData));
+		const isSuperAdmin = !!initialData.loginData?.isSuperAdmin;
+
+		if (!isSuperAdmin) {
+			const spamTag = await getSpamTagForUser(userData.id);
+			if (spamTag?.status === 'confirmed-spam') {
+				throw new Error('User Not Found');
+			}
+		}
+
 		const isNewishUser = Date.now() - Number(userData.createdAt.valueOf()) < 1000 * 86400 * 30;
 
 		if (!initialData.locationData.isBasePubPub) {
diff --git a/server/spamTag/userQueries.ts b/server/spamTag/userQueries.ts
index f4ee8a69f3..710ef86347 100644
--- a/server/spamTag/userQueries.ts
+++ b/server/spamTag/userQueries.ts
@@ -4,9 +4,13 @@ import type { SpamStatus, UserSpamTagFields } from 'types';
 import mergeWith from 'lodash.mergewith';
 
 import { SpamTag, User } from 'server/models';
-import { sendSpamBanEmail, sendSpamLiftedEmail } from 'server/utils/email';
+import { sendNewSpamTagDevEmail, sendSpamBanEmail, sendSpamLiftedEmail } from 'server/utils/email';
 import { deleteSessionsForUser } from 'server/utils/session';
-import { postToSlackAboutUserBan, postToSlackAboutUserLifted } from 'server/utils/slack';
+import {
+	postToSlackAboutNewUserSpamTag,
+	postToSlackAboutUserBan,
+	postToSlackAboutUserLifted,
+} from 'server/utils/slack';
 import { expect } from 'utils/assert';
 
 import { getSuspectedUserSpamVerdict } from './userScore';
@@ -60,9 +64,20 @@ export const addSpamTagToUser = async (userId: string, fields?: UserSpamTagField
 			individualHooks: false,
 		},
 	);
+	notifyNewSpamTag(userId, user, newSpamTag).catch((err) =>
+		console.error('Failed to send new spam tag notifications', err),
+	);
 	return newSpamTag;
 };
 
+const notifyNewSpamTag = async (userId: string, user: User, spamTag: SpamTag) => {
+	const email = user.email ?? '';
+	const name = user.fullName ?? '';
+	if (!email) return;
+	await postToSlackAboutNewUserSpamTag(userId, email, name, spamTag.spamScore);
+	await sendNewSpamTagDevEmail({ userEmail: email, userName: name });
+};
+
 type UpdateSpamTagForUserOptions = {
 	userId: string;
 	status: SpamStatus;
@@ -101,7 +116,10 @@ const applySpamStatusSideEffects = async (userId: string, status: SpamStatus, sp
 			} catch (err) {
 				console.error('Failed to delete sessions for banned user', userId, err);
 			}
-			await sendSpamBanEmail({ toEmail: user.email, userName: user.fullName ?? '' });
+			// uncomment to test the email
+			if (process.env.NODE_ENV === 'production') {
+				await sendSpamBanEmail({ toEmail: user.email, userName: user.fullName ?? '' });
+			}
 			await postToSlackAboutUserBan(
 				userId,
 				user.email,
@@ -109,7 +127,10 @@ const applySpamStatusSideEffects = async (userId: string, status: SpamStatus, sp
 				spamTag.fields as UserSpamTagFields,
 			);
 		} else if (status === 'confirmed-not-spam') {
-			await sendSpamLiftedEmail({ toEmail: user.email, userName: user.fullName ?? '' });
+			// uncomment to test the email
+			if (process.env.NODE_ENV === 'production') {
+				await sendSpamLiftedEmail({ toEmail: user.email, userName: user.fullName ?? '' });
+			}
 			await postToSlackAboutUserLifted(userId, user.email, user.fullName ?? '');
 		}
 	} catch (err) {
diff --git a/server/utils/email/reset.ts b/server/utils/email/reset.ts
index 6d809a4a39..8c3d0b2ac6 100644
--- a/server/utils/email/reset.ts
+++ b/server/utils/email/reset.ts
@@ -14,6 +14,7 @@ type SendEmailOptions = {
 	replyTo?: string;
 	to: string[];
 	cc?: string[];
+	bcc?: string[];
 	subject: string;
 } & Body;
 
@@ -31,6 +32,7 @@ export const sendEmail = (options: SendEmailOptions) => {
 		subject,
 		...('replyTo' in options && { 'h:Reply-To': options.replyTo }),
 		...('cc' in options && { cc: options.cc }),
+		...('bcc' in options && { bcc: options.bcc }),
 		...body,
 	});
 };
diff --git a/server/utils/email/spam.ts b/server/utils/email/spam.ts
index 202e107ab7..6712c324a9 100644
--- a/server/utils/email/spam.ts
+++ b/server/utils/email/spam.ts
@@ -1,13 +1,15 @@
 import stripIndent from 'strip-indent';
 
+import { getSuperAdminTabUrl } from 'utils/superAdmin';
+
 import { sendEmail } from './reset';
 
-// const CC_DEV = ['dev@pubpub.org'];
+export const DEV_TEAM_EMAIL = 'dev@pubpub.org';
 
 export const sendSpamBanEmail = ({ toEmail, userName }: { toEmail: string; userName: string }) => {
 	return sendEmail({
 		to: [toEmail],
-		// cc: CC_DEV,
+		bcc: [DEV_TEAM_EMAIL],
 		subject: 'PubPub account restriction',
 		text: stripIndent(`
 			Hello${userName ? ` ${userName}` : ''},
@@ -31,7 +33,7 @@ export const sendSpamLiftedEmail = ({
 }) => {
 	return sendEmail({
 		to: [toEmail],
-		// cc: CC_DEV,
+		bcc: [DEV_TEAM_EMAIL],
 		subject: 'PubPub account restriction lifted',
 		text: stripIndent(`
 			Hello${userName ? ` ${userName}` : ''},
@@ -43,3 +45,24 @@ export const sendSpamLiftedEmail = ({
 		`),
 	});
 };
+
+export const sendNewSpamTagDevEmail = ({
+	userEmail,
+	userName,
+}: {
+	userEmail: string;
+	userName: string;
+}) => {
+	const reviewUrl = `https://pubpub.org${getSuperAdminTabUrl('spamUsers')}?q=${encodeURIComponent(userEmail)}`;
+	return sendEmail({
+		to: [DEV_TEAM_EMAIL],
+		subject: `New spam tag: ${userName} (${userEmail})`,
+		text: stripIndent(`
+			A new spam tag has been created for ${userName} (${userEmail}).
+
+			Review: ${reviewUrl}
+
+			-- PubPub Spam System
+		`),
+	});
+};
diff --git a/server/utils/queryHelpers/userGet.ts b/server/utils/queryHelpers/userGet.ts
index bed4c701b2..ce487d61bd 100644
--- a/server/utils/queryHelpers/userGet.ts
+++ b/server/utils/queryHelpers/userGet.ts
@@ -1,10 +1,11 @@
-import { Pub, PubAttribution, User } from 'server/models';
+import { Pub, PubAttribution, SpamTag, User } from 'server/models';
 
 import buildPubOptions from './pubOptions';
 import sanitizePub from './pubSanitize';
 
 export default async (slug, initialData) => {
 	const sanitizedSlug = slug.toLowerCase();
+	const isSuperAdmin = !!initialData.loginData?.isSuperAdmin;
 	const userData = await User.findOne({
 		where: {
 			slug: sanitizedSlug,
@@ -30,6 +31,9 @@ export default async (slug, initialData) => {
 					},
 				],
 			},
+			...(isSuperAdmin
+				? [{ model: SpamTag, as: 'spamTag', required: false }]
+				: []),
 		],
 	});
 
diff --git a/server/utils/slack.ts b/server/utils/slack.ts
index 80fdaa5bf9..458cfd015d 100644
--- a/server/utils/slack.ts
+++ b/server/utils/slack.ts
@@ -284,3 +284,38 @@ export const postToSlackAboutUserLifted = async (
 		],
 	});
 };
+
+export const postToSlackAboutNewUserSpamTag = async (
+	userId: string,
+	userEmail: string,
+	userName: string,
+	spamScore: number | null,
+) => {
+	if (process.env.NODE_ENV === 'test') {
+		return;
+	}
+	const spamUsersUrl = `https://pubpub.org${getSuperAdminTabUrl('spamUsers')}?q=${encodeURIComponent(userEmail)}`;
+	const scorePart = spamScore != null ? ` (score: ${spamScore})` : '';
+	const notificationText = `New user spam tag: ${userName} (${userEmail})${scorePart}`;
+	await postToSlack({
+		icon_emoji: ':mag:',
+		attachments: [
+			{
+				fallback: notificationText,
+				pretext: notificationText,
+				color: 'warning',
+				fields: [
+					{ title: 'User', value: `${userName} (${userEmail})` },
+					...(spamScore != null ? [{ title: 'Spam score', value: `${spamScore}` }] : []),
+				],
+				actions: [
+					{
+						type: 'button',
+						text: 'Review in Spam Dashboard',
+						url: spamUsersUrl,
+					},
+				],
+			},
+		],
+	});
+};

From 6127ddb396a75e3279f54a990d3bdd2d14be3bf3 Mon Sep 17 00:00:00 2001
From: "Thomas F. K. Jorna" <hello@tefkah.com>
Date: Wed, 25 Feb 2026 23:01:00 +0100
Subject: [PATCH 16/16] fix: improve messages

---
 .../GlobalControls/CreatePubButton.tsx        |  11 +-
 client/components/index.ts                    |   2 +-
 .../PubDiscussions/Discussion/Discussion.tsx  |  35 ++-
 .../PubDiscussions/Discussion/ManageTools.tsx |  15 +-
 .../Discussion/ThreadComment.tsx              |  38 ++-
 client/containers/User/UserHeader.tsx         |  10 +-
 server/community/api.ts                       |   5 +
 server/community/hooks.ts                     |   2 +-
 server/community/queries.ts                   |   2 +-
 server/discussion/api.ts                      |  14 +-
 server/pub/api.ts                             |   4 +-
 server/routes/superAdminDashboard.tsx         |   4 +-
 server/spamTag/__tests__/api.test.ts          |   2 +-
 server/spamTag/api.ts                         |  21 +-
 .../{communities.ts => communityDashboard.ts} |   0
 .../{queries.ts => communityQueries.ts}       |   2 +-
 .../spamTag/{score.ts => communityScore.ts}   |   0
 server/spamTag/{users.ts => userDashboard.ts} |   0
 server/spamTag/userQueries.ts                 |  50 ++--
 server/threadComment/api.ts                   |   8 +
 server/user/api.ts                            |   8 +-
 server/utils/honeypot.ts                      |  29 ++-
 server/utils/queryHelpers/userGet.ts          |   4 +-
 server/utils/slack.ts                         | 242 ++++++++++++------
 .../migrations/data/2022_11_29_addSpamTags.js |   2 +-
 types/spam.ts                                 |  16 +-
 26 files changed, 397 insertions(+), 129 deletions(-)
 rename server/spamTag/{communities.ts => communityDashboard.ts} (100%)
 rename server/spamTag/{queries.ts => communityQueries.ts} (97%)
 rename server/spamTag/{score.ts => communityScore.ts} (100%)
 rename server/spamTag/{users.ts => userDashboard.ts} (100%)

diff --git a/client/components/GlobalControls/CreatePubButton.tsx b/client/components/GlobalControls/CreatePubButton.tsx
index 1e3cb396c7..0329167eca 100644
--- a/client/components/GlobalControls/CreatePubButton.tsx
+++ b/client/components/GlobalControls/CreatePubButton.tsx
@@ -20,9 +20,7 @@ const CreatePubButton = () => {
 			const honeypot = (formData.get('description') as string) ?? '';
 			setIsLoading(true);
 			try {
-				console.log('trying to verify');
 				const altchaPayload = await altchaRef.current?.verify();
-				console.log('altchaPayload', altchaPayload);
 				if (!altchaPayload) return;
 				const newPub = await apiFetch.post<types.Pub>('/api/pubs/fromForm', {
 					communityId: communityData.id,
@@ -30,6 +28,8 @@ const CreatePubButton = () => {
 					_honeypot: honeypot,
 				});
 				window.location.href = `/pub/${newPub.slug}`;
+			} catch (error) {
+				console.error('Error in handleCreatePub', error);
 			} finally {
 				setIsLoading(false);
 			}
@@ -37,9 +37,12 @@ const CreatePubButton = () => {
 		[communityData.id],
 	);
 
+	const formRef = useRef<HTMLFormElement>(null);
+
 	return (
 		<form
 			onSubmit={handleCreatePub}
+			ref={formRef}
 			// only relevant in dev
 			style={{ display: 'flex', alignItems: 'center', gap: '10px' }}
 		>
@@ -49,6 +52,10 @@ const CreatePubButton = () => {
 					if (!isLoading) {
 						setIsLoading(true);
 					}
+					// 	@ts-ignore
+					if (state.detail.state === 'verified') {
+						setIsLoading(false);
+					}
 				}}
 			/>
 			<Honeypot name="description" />
diff --git a/client/components/index.ts b/client/components/index.ts
index b7b76b8f0e..5a79c48567 100644
--- a/client/components/index.ts
+++ b/client/components/index.ts
@@ -102,8 +102,8 @@ export { default as SettingsSection } from './SettingsSection/SettingsSection';
 export { default as SharingCard } from './SharingCard/SharingCard';
 export { default as SimpleEditor } from './SimpleEditor/SimpleEditor';
 export { default as SkipLink } from './SkipLink/SkipLink';
-export { default as SpamStatusMenu } from './SpamStatusMenu';
 export { default as SliderInput } from './SliderInput/SliderInput';
+export { default as SpamStatusMenu } from './SpamStatusMenu';
 export { default as SubmissionEmail } from './SubmissionEmail/SubmissionEmail';
 export { default as SubscriptionButton } from './SubscriptionButton/SubscriptionButton';
 export { default as TabToShow } from './TabToShow/TabToShow';
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx
index 92dec20824..d7a4632791 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/Discussion.tsx
@@ -1,6 +1,6 @@
-import type { PubPageData, PubPageDiscussion } from 'types';
+import type { PubPageData, PubPageDiscussion, SpamStatus } from 'types';
 
-import React, { useEffect, useState } from 'react';
+import React, { useCallback, useEffect, useState } from 'react';
 
 import { Button } from '@blueprintjs/core';
 import classNames from 'classnames';
@@ -111,6 +111,32 @@ const Discussion = (props: Props) => {
 		return elements;
 	};
 
+	const handleSpamStatusChanged = useCallback(
+		(status: SpamStatus | null) => {
+			const isNowSpam = status === 'confirmed-spam';
+			const authorUserId = discussionData.userId;
+			updateLocalData('pub', {
+				discussions: pubData.discussions.map((discussion) => {
+					const authorMatch = discussion.userId === authorUserId;
+					return {
+						...discussion,
+						...(authorMatch && { isAuthorSpam: isNowSpam || undefined }),
+						thread: {
+							...discussion.thread,
+							comments: discussion.thread.comments.map((comment) => {
+								if (comment.userId === authorUserId) {
+									return { ...comment, isAuthorSpam: isNowSpam || undefined };
+								}
+								return comment;
+							}),
+						},
+					};
+				}),
+			});
+		},
+		[discussionData.userId, pubData.discussions, updateLocalData],
+	);
+
 	const handleUpdateDiscussion = (discussionUpdates) => {
 		return apiFetch('/api/discussions', {
 			method: 'PUT',
@@ -221,9 +247,7 @@ const Discussion = (props: Props) => {
 				/>
 			)}
 			<LabelList pubData={pubData} discussionData={discussionData} />
-			{isAuthorSpam && isPreview && (
-				<span className="spam-badge">Spam</span>
-			)}
+			{isAuthorSpam && isPreview && <span className="spam-badge">Spam</span>}
 			{isAuthorSpam && !isPreview && (
 				<div className="discussion-spam-banner">
 					This user has been banned. Only you and other admins of this community can see
@@ -239,6 +263,7 @@ const Discussion = (props: Props) => {
 							onUpdateDiscussion={handleUpdateDiscussion}
 							sortType={sortType}
 							setSortType={setSortType}
+							onSpamStatusChanged={handleSpamStatusChanged}
 						/>
 					)}
 					{renderAnchorText()}
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ManageTools.tsx b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ManageTools.tsx
index b46e62d488..0fd7c9dcdb 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ManageTools.tsx
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ManageTools.tsx
@@ -29,10 +29,18 @@ type Props = {
 	setSortType: (s: SortType) => any;
 	sortType: SortType;
 	onUpdateDiscussion: (...args: any[]) => any;
+	onSpamStatusChanged?: (status: import('types').SpamStatus | null) => void;
 };
 
 const ManageTools = (props: Props) => {
-	const { pubData, discussionData, onUpdateDiscussion, sortType, setSortType } = props;
+	const {
+		pubData,
+		discussionData,
+		onUpdateDiscussion,
+		sortType,
+		setSortType,
+		onSpamStatusChanged,
+	} = props;
 	const { scopeData } = usePageContext();
 	const { canAdmin, isSuperAdmin } = scopeData.activePermissions;
 	const { isClosed } = discussionData;
@@ -108,7 +116,10 @@ const ManageTools = (props: Props) => {
 			{renderSortMenu()}
 			{isSuperAdmin && <DiscussionReanchor discussionData={discussionData} />}
 			{isSuperAdmin && discussionData.userId && (
-				<SpamStatusMenu userId={discussionData.userId} />
+				<SpamStatusMenu
+					userId={discussionData.userId}
+					onStatusChanged={onSpamStatusChanged}
+				/>
 			)}
 		</div>
 	);
diff --git a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx
index 7cc05fe70c..cd21b75076 100644
--- a/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx
+++ b/client/containers/Pub/PubDocument/PubDiscussions/Discussion/ThreadComment.tsx
@@ -1,6 +1,6 @@
-import type { Callback } from 'types';
+import type { Callback, SpamStatus } from 'types';
 
-import React, { useState } from 'react';
+import React, { useCallback, useState } from 'react';
 
 import { Button, Intent } from '@blueprintjs/core';
 import classNames from 'classnames';
@@ -71,6 +71,31 @@ const ThreadComment = (props: Props) => {
 		});
 	};
 
+	const handleSpamStatusChanged = useCallback(
+		(status: SpamStatus | null) => {
+			const isNowSpam = status === 'confirmed-spam';
+			const targetUserId = threadCommentData.userId;
+			updateLocalData('pub', {
+				discussions: pubData.discussions.map((discussion) => ({
+					...discussion,
+					...(discussion.userId === targetUserId && {
+						isAuthorSpam: isNowSpam || undefined,
+					}),
+					thread: {
+						...discussion.thread,
+						comments: discussion.thread.comments.map((comment) => {
+							if (comment.userId === targetUserId) {
+								return { ...comment, isAuthorSpam: isNowSpam || undefined };
+							}
+							return comment;
+						}),
+					},
+				})),
+			});
+		},
+		[threadCommentData.userId, pubData.discussions, updateLocalData],
+	);
+
 	const isAuthor = loginData.id === threadCommentData.userId;
 	const renderText = (
 		key: string,
@@ -115,9 +140,7 @@ const ThreadComment = (props: Props) => {
 						{threadCommentData.author
 							? threadCommentData.author.fullName
 							: (commenterName ?? 'anonymous')}
-						{isAuthorSpam && isPreview && (
-							<span className="spam-badge">Spam</span>
-						)}
+						{isAuthorSpam && isPreview && <span className="spam-badge">Spam</span>}
 						{isPreview ? ': ' : ''}
 					</span>
 
@@ -160,7 +183,10 @@ const ThreadComment = (props: Props) => {
 							/>
 						)}
 						{!isPreview && isSuperAdmin && threadCommentData.userId && (
-							<SpamStatusMenu userId={threadCommentData.userId} />
+							<SpamStatusMenu
+								userId={threadCommentData.userId}
+								onStatusChanged={handleSpamStatusChanged}
+							/>
 						)}
 					</span>
 				</div>
diff --git a/client/containers/User/UserHeader.tsx b/client/containers/User/UserHeader.tsx
index 672cbe46c3..30f71586ff 100644
--- a/client/containers/User/UserHeader.tsx
+++ b/client/containers/User/UserHeader.tsx
@@ -1,5 +1,5 @@
-import type { SpamStatus } from 'types';
 import type { SocialItem } from 'client/utils/navigation';
+import type { SpamStatus } from 'types';
 
 import React, { useCallback, useState } from 'react';
 
@@ -22,7 +22,10 @@ const defaultProps = {
 	isUser: false,
 };
 
-const spamStatusDisplay: Record<SpamStatus, { label: string; intent: 'danger' | 'warning' | 'success' }> = {
+const spamStatusDisplay: Record<
+	SpamStatus,
+	{ label: string; intent: 'danger' | 'warning' | 'success' }
+> = {
 	'confirmed-spam': { label: 'Confirmed spam', intent: 'danger' },
 	unreviewed: { label: 'Unreviewed', intent: 'warning' },
 	'confirmed-not-spam': { label: 'Not spam', intent: 'success' },
@@ -136,7 +139,8 @@ const UserHeader = function (props) {
 					>
 						<div style={{ display: 'flex', alignItems: 'center', gap: 8 }}>
 							<span style={{ fontWeight: 500 }}>
-								Spam status: {spamStatus ? spamStatusDisplay[spamStatus].label : 'None'}
+								Spam status:{' '}
+								{spamStatus ? spamStatusDisplay[spamStatus].label : 'None'}
 							</span>
 							<SpamStatusMenu
 								userId={props.userData.id}
diff --git a/server/community/api.ts b/server/community/api.ts
index 18e136fe69..3446921e89 100644
--- a/server/community/api.ts
+++ b/server/community/api.ts
@@ -150,6 +150,11 @@ export const communityServer = s.router(contract.community, {
 				expect(req.user).id,
 				'create-community',
 				String(req.body._honeypot),
+				{
+					content: req.body.title
+						? `title: ${req.body.title}, subdomain: ${req.body.subdomain}`
+						: undefined,
+				},
 			);
 			const subdomain = req.body.subdomain ?? 'community';
 			return {
diff --git a/server/community/hooks.ts b/server/community/hooks.ts
index a9dace46a5..28c43321fd 100644
--- a/server/community/hooks.ts
+++ b/server/community/hooks.ts
@@ -3,7 +3,7 @@ import {
 	createCommunityUpdatedActivityItem,
 } from 'server/activityItem/queries';
 import { Community } from 'server/models';
-import { addSpamTagToCommunity } from 'server/spamTag/queries';
+import { addSpamTagToCommunity } from 'server/spamTag/communityQueries';
 import { createActivityHooks } from 'server/utils/activityHooks';
 import { defer } from 'server/utils/deferred';
 
diff --git a/server/community/queries.ts b/server/community/queries.ts
index 40d3663171..402bc209d8 100644
--- a/server/community/queries.ts
+++ b/server/community/queries.ts
@@ -16,7 +16,7 @@ import {
 	type User,
 	WorkerTask,
 } from 'server/models';
-import { getSpamTagForCommunity } from 'server/spamTag/queries';
+import { getSpamTagForCommunity } from 'server/spamTag/communityQueries';
 import { defer } from 'server/utils/deferred';
 import { sendCommunityAwaitingApprovalEmail } from 'server/utils/email/communitySpam';
 import { subscribeUser } from 'server/utils/mailchimp';
diff --git a/server/discussion/api.ts b/server/discussion/api.ts
index 7c8c62fa38..5aea913c92 100644
--- a/server/discussion/api.ts
+++ b/server/discussion/api.ts
@@ -49,7 +49,19 @@ router.post(
 		}
 		if (isHoneypotFilled(req.body._honeypot)) {
 			if (req.user?.id)
-				await handleHoneypotTriggered(req.user.id, 'create-discussion', req.body._honeypot);
+				await handleHoneypotTriggered(
+					req.user.id,
+					'create-discussion',
+					req.body._honeypot,
+					{
+						communityId: req.body.communityId,
+						pubId: req.body.pubId,
+						content:
+							typeof req.body.text === 'string'
+								? req.body.text.slice(0, 500)
+								: undefined,
+					},
+				);
 			throw new BadRequestError(new Error('Invalid submission.'));
 		}
 		const ok = await verifyCaptchaPayload(req.body.altcha);
diff --git a/server/pub/api.ts b/server/pub/api.ts
index 1d188021e7..edaecb8e2c 100644
--- a/server/pub/api.ts
+++ b/server/pub/api.ts
@@ -113,7 +113,9 @@ export const pubServer = s.router(contract.pub, {
 	createFromForm: async ({ body, req }) => {
 		if (isHoneypotFilled(body._honeypot)) {
 			if (req.user?.id)
-				await handleHoneypotTriggered(req.user.id, 'create-pub', body._honeypot as string);
+				await handleHoneypotTriggered(req.user.id, 'create-pub', body._honeypot as string, {
+					communityId: body.communityId as string | undefined,
+				});
 			throw new BadRequestError(new Error('Invalid submission.'));
 		}
 		if (!(await verifyCaptchaPayload(body.altcha))) {
diff --git a/server/routes/superAdminDashboard.tsx b/server/routes/superAdminDashboard.tsx
index 59512adbf6..c4e8976c25 100644
--- a/server/routes/superAdminDashboard.tsx
+++ b/server/routes/superAdminDashboard.tsx
@@ -8,8 +8,8 @@ import { filtersById as spamFiltersById } from 'client/containers/SuperAdminDash
 import { filtersById as spamUsersFiltersById } from 'client/containers/SuperAdminDashboard/UserSpam/filters';
 import Html from 'server/Html';
 import { getLandingPageFeatures } from 'server/landingPageFeature/queries';
-import { queryCommunitiesForSpamManagement } from 'server/spamTag/communities';
-import { queryUsersForSpamManagement } from 'server/spamTag/users';
+import { queryCommunitiesForSpamManagement } from 'server/spamTag/communityDashboard';
+import { queryUsersForSpamManagement } from 'server/spamTag/userDashboard';
 import { ForbiddenError, handleErrors, NotFoundError } from 'server/utils/errors';
 import { getInitialData } from 'server/utils/initData';
 import { generateMetaComponents, renderToNodeStream } from 'server/utils/ssr';
diff --git a/server/spamTag/__tests__/api.test.ts b/server/spamTag/__tests__/api.test.ts
index 85b785559a..38cd144d9a 100644
--- a/server/spamTag/__tests__/api.test.ts
+++ b/server/spamTag/__tests__/api.test.ts
@@ -3,7 +3,7 @@ import { vi } from 'vitest';
 import { SpamTag } from 'server/models';
 import { login, modelize, setup, teardown } from 'stubstub';
 
-import { addSpamTagToCommunity } from '../queries';
+import { addSpamTagToCommunity } from '../communityQueries';
 
 const {
 	sendCommunityApprovedEmail,
diff --git a/server/spamTag/api.ts b/server/spamTag/api.ts
index 5a7140d852..914dd986e9 100644
--- a/server/spamTag/api.ts
+++ b/server/spamTag/api.ts
@@ -4,16 +4,16 @@ import { ForbiddenError } from 'server/utils/errors';
 import { wrap } from 'server/wrap';
 import { expect } from 'utils/assert';
 
-import { queryCommunitiesForSpamManagement } from './communities';
+import { queryCommunitiesForSpamManagement } from './communityDashboard';
+import { updateSpamTagForCommunity } from './communityQueries';
 import { canManipulateSpamTags } from './permissions';
-import { updateSpamTagForCommunity } from './queries';
+import { queryUsersForSpamManagement } from './userDashboard';
 import {
 	addSpamTagToUser,
 	getSpamTagForUser,
 	removeSpamTagFromUser,
 	updateSpamTagForUser,
 } from './userQueries';
-import { queryUsersForSpamManagement } from './users';
 
 export const router = Router();
 
@@ -38,11 +38,24 @@ router.put(
 		if (!canUpdate) {
 			throw new ForbiddenError();
 		}
+		const actorId = req.user?.id;
+		const actorName = (req.user as any)?.fullName ?? 'Unknown';
 		const existingTag = await getSpamTagForUser(userId);
 		if (!existingTag) {
 			await addSpamTagToUser(userId);
 		}
-		await updateSpamTagForUser({ userId, status });
+		if (status === 'confirmed-spam' && actorId) {
+			await addSpamTagToUser(userId, {
+				manuallyMarkedBy: [
+					{
+						userId: actorId,
+						userName: actorName,
+						at: new Date().toISOString(),
+					},
+				],
+			});
+		}
+		await updateSpamTagForUser({ userId, status, actorId, actorName });
 		return res.status(200).send({});
 	}),
 );
diff --git a/server/spamTag/communities.ts b/server/spamTag/communityDashboard.ts
similarity index 100%
rename from server/spamTag/communities.ts
rename to server/spamTag/communityDashboard.ts
diff --git a/server/spamTag/queries.ts b/server/spamTag/communityQueries.ts
similarity index 97%
rename from server/spamTag/queries.ts
rename to server/spamTag/communityQueries.ts
index ad25e8db5a..bcb630bf77 100644
--- a/server/spamTag/queries.ts
+++ b/server/spamTag/communityQueries.ts
@@ -9,7 +9,7 @@ import {
 import { postToSlackAboutCommunityStatusChange } from 'server/utils/slack';
 import { expect } from 'utils/assert';
 
-import { getSuspectedCommunitySpamVerdict } from './score';
+import { getSuspectedCommunitySpamVerdict } from './communityScore';
 
 // Adding a spam tag doesn't imply that the Community _is_ spam, only that we have a score for it.
 export const addSpamTagToCommunity = async (communityId: string) => {
diff --git a/server/spamTag/score.ts b/server/spamTag/communityScore.ts
similarity index 100%
rename from server/spamTag/score.ts
rename to server/spamTag/communityScore.ts
diff --git a/server/spamTag/users.ts b/server/spamTag/userDashboard.ts
similarity index 100%
rename from server/spamTag/users.ts
rename to server/spamTag/userDashboard.ts
diff --git a/server/spamTag/userQueries.ts b/server/spamTag/userQueries.ts
index 710ef86347..8714a07f5e 100644
--- a/server/spamTag/userQueries.ts
+++ b/server/spamTag/userQueries.ts
@@ -73,14 +73,22 @@ export const addSpamTagToUser = async (userId: string, fields?: UserSpamTagField
 const notifyNewSpamTag = async (userId: string, user: User, spamTag: SpamTag) => {
 	const email = user.email ?? '';
 	const name = user.fullName ?? '';
+	const slug = user.slug ?? '';
 	if (!email) return;
-	await postToSlackAboutNewUserSpamTag(userId, email, name, spamTag.spamScore);
+	await postToSlackAboutNewUserSpamTag({
+		userId,
+		userName: name,
+		userSlug: slug,
+		spamScore: spamTag.spamScore,
+	});
 	await sendNewSpamTagDevEmail({ userEmail: email, userName: name });
 };
 
 type UpdateSpamTagForUserOptions = {
 	userId: string;
 	status: SpamStatus;
+	actorId?: string;
+	actorName?: string;
 };
 
 export const getSpamTagForUser = async (userId: string) => {
@@ -94,21 +102,28 @@ export const getSpamTagForUser = async (userId: string) => {
 };
 
 export const updateSpamTagForUser = async (options: UpdateSpamTagForUserOptions) => {
-	const { userId, status } = options;
+	const { userId, status, actorId, actorName } = options;
 	const spamTag = await getSpamTagForUser(userId);
 	if (!spamTag) {
 		throw new Error('User is missing a SpamTag');
 	}
 	await spamTag.update({ status, statusUpdatedAt: new Date() });
-	await applySpamStatusSideEffects(userId, status, spamTag);
+	await applySpamStatusSideEffects(userId, status, spamTag, actorId, actorName);
 };
 
-const applySpamStatusSideEffects = async (userId: string, status: SpamStatus, spamTag: SpamTag) => {
+const applySpamStatusSideEffects = async (
+	userId: string,
+	status: SpamStatus,
+	spamTag: SpamTag,
+	actorId?: string,
+	actorName?: string,
+) => {
 	const user = await User.findOne({
 		where: { id: userId },
-		attributes: ['email', 'fullName'],
+		attributes: ['email', 'fullName', 'slug', 'avatar'],
 	});
 	if (!user?.email) return;
+	const userName = user.fullName ?? '';
 	try {
 		if (status === 'confirmed-spam') {
 			try {
@@ -116,22 +131,27 @@ const applySpamStatusSideEffects = async (userId: string, status: SpamStatus, sp
 			} catch (err) {
 				console.error('Failed to delete sessions for banned user', userId, err);
 			}
-			// uncomment to test the email
 			if (process.env.NODE_ENV === 'production') {
-				await sendSpamBanEmail({ toEmail: user.email, userName: user.fullName ?? '' });
+				await sendSpamBanEmail({ toEmail: user.email, userName });
 			}
-			await postToSlackAboutUserBan(
+			await postToSlackAboutUserBan({
 				userId,
-				user.email,
-				user.fullName ?? '',
-				spamTag.fields as UserSpamTagFields,
-			);
+				userName,
+				userSlug: user.slug,
+				userAvatar: user.avatar,
+				reason: spamTag.fields as UserSpamTagFields,
+				actorName,
+			});
 		} else if (status === 'confirmed-not-spam') {
-			// uncomment to test the email
 			if (process.env.NODE_ENV === 'production') {
-				await sendSpamLiftedEmail({ toEmail: user.email, userName: user.fullName ?? '' });
+				await sendSpamLiftedEmail({ toEmail: user.email, userName });
 			}
-			await postToSlackAboutUserLifted(userId, user.email, user.fullName ?? '');
+			await postToSlackAboutUserLifted({
+				userId,
+				userName,
+				userSlug: user.slug,
+				actorName,
+			});
 		}
 	} catch (err) {
 		console.error('Failed to send spam status email', err);
diff --git a/server/threadComment/api.ts b/server/threadComment/api.ts
index a485824c10..4eee1e9b58 100644
--- a/server/threadComment/api.ts
+++ b/server/threadComment/api.ts
@@ -53,6 +53,14 @@ router.post(
 					req.user.id,
 					'create-thread-comment',
 					req.body._honeypot,
+					{
+						communityId: req.body.communityId,
+						pubId: req.body.pubId,
+						content:
+							typeof req.body.text === 'string'
+								? req.body.text.slice(0, 500)
+								: undefined,
+					},
 				);
 			throw new BadRequestError(new Error('Invalid submission.'));
 		}
diff --git a/server/user/api.ts b/server/user/api.ts
index a4772acf38..59b6bb58ac 100644
--- a/server/user/api.ts
+++ b/server/user/api.ts
@@ -40,7 +40,9 @@ router.post('/api/users', async (req, res) => {
 		delete body._honeypot;
 		const newUser = await createUser(body);
 		if (isHoneypotFilled(req.body._honeypot)) {
-			await handleHoneypotTriggered(newUser.id, 'create-user', req.body._honeypot);
+			await handleHoneypotTriggered(newUser.id, 'create-user', req.body._honeypot, {
+				content: req.body.fullName ? `name: ${req.body.fullName}` : undefined,
+			});
 		}
 		passport.authenticate('local')(req, res, () => {
 			const hashedUserId = getHashedUserId(newUser);
@@ -101,7 +103,9 @@ router.put('/api/users/fromForm', async (req, res) => {
 		}
 		if (isHoneypotFilled(req.body._honeypot)) {
 			if (req.user?.id)
-				await handleHoneypotTriggered(req.user.id, 'edit-user', req.body._honeypot);
+				await handleHoneypotTriggered(req.user.id, 'edit-user', req.body._honeypot, {
+					content: req.body.fullName ? `name: ${req.body.fullName}` : undefined,
+				});
 		}
 		const body = { ...req.body };
 		delete body._honeypot;
diff --git a/server/utils/honeypot.ts b/server/utils/honeypot.ts
index 5a89a33304..338f7663bc 100644
--- a/server/utils/honeypot.ts
+++ b/server/utils/honeypot.ts
@@ -1,5 +1,6 @@
-import type { HoneypotTrigger } from 'types';
+import type { HoneypotContext, HoneypotTrigger } from 'types';
 
+import { Community, Pub } from 'server/models';
 import { addSpamTagToUser, updateSpamTagForUser } from 'server/spamTag/userQueries';
 
 export const isHoneypotFilled = (value: unknown): boolean => {
@@ -8,12 +9,36 @@ export const isHoneypotFilled = (value: unknown): boolean => {
 	return true;
 };
 
+const resolveHoneypotContext = async (
+	ctx?: HoneypotContext,
+): Promise<HoneypotContext | undefined> => {
+	if (!ctx) return undefined;
+	const resolved = { ...ctx };
+	if (ctx.communityId && !ctx.communitySubdomain) {
+		const community = await Community.findByPk(ctx.communityId, { attributes: ['subdomain'] });
+		if (community) resolved.communitySubdomain = community.subdomain;
+	}
+	if (ctx.pubId && !ctx.pubSlug) {
+		const pub = await Pub.findByPk(ctx.pubId, { attributes: ['slug'] });
+		if (pub) resolved.pubSlug = pub.slug;
+	}
+	delete resolved.communityId;
+	delete resolved.pubId;
+	return resolved;
+};
+
 export const handleHoneypotTriggered = async (
 	userId: string | null,
 	honeypot: HoneypotTrigger,
 	value: string,
+	context?: HoneypotContext,
 ): Promise<void> => {
 	if (!userId) return;
-	await addSpamTagToUser(userId, { honeypotTriggers: [{ honeypot, value }] });
+	const resolved = await resolveHoneypotContext(context);
+	await addSpamTagToUser(userId, {
+		honeypotTriggers: [
+			{ honeypot, value, context: resolved, triggeredAt: new Date().toISOString() },
+		],
+	});
 	await updateSpamTagForUser({ userId, status: 'confirmed-spam' });
 };
diff --git a/server/utils/queryHelpers/userGet.ts b/server/utils/queryHelpers/userGet.ts
index ce487d61bd..05ed06e014 100644
--- a/server/utils/queryHelpers/userGet.ts
+++ b/server/utils/queryHelpers/userGet.ts
@@ -31,9 +31,7 @@ export default async (slug, initialData) => {
 					},
 				],
 			},
-			...(isSuperAdmin
-				? [{ model: SpamTag, as: 'spamTag', required: false }]
-				: []),
+			...(isSuperAdmin ? [{ model: SpamTag, as: 'spamTag', required: false }] : []),
 		],
 	});
 
diff --git a/server/utils/slack.ts b/server/utils/slack.ts
index 458cfd015d..255c3fa00a 100644
--- a/server/utils/slack.ts
+++ b/server/utils/slack.ts
@@ -2,7 +2,7 @@ import type { SpamStatus, UserSpamTagFields } from 'types';
 
 import fetch from 'node-fetch';
 
-import { isDangerousSpamScore } from 'server/spamTag/score';
+import { isDangerousSpamScore } from 'server/spamTag/communityScore';
 import { isProd } from 'utils/environment';
 import { getSuperAdminTabUrl } from 'utils/superAdmin';
 
@@ -199,26 +199,24 @@ export const postToSlackAboutSuspiciousUpload = async (
 	userName: string,
 	key: string,
 ) => {
-	if (process.env.NODE_ENV === 'test') {
-		return;
-	}
-	const spamUsersUrl = `https://pubpub.org${getSuperAdminTabUrl('spamUsers')}?q=${encodeURIComponent(userEmail)}`;
+	if (process.env.NODE_ENV === 'test') return;
+	const dashUrl = getSpamDashUrl(userName);
 	await postToSlack({
 		icon_emoji: ':warning:',
 		attachments: [
 			{
-				fallback: `Suspicious upload by ${userName} (${userEmail}): ${key}`,
+				fallback: `Suspicious upload by ${userName}: ${key}`,
 				pretext: 'Suspicious upload detected (scam keywords in filename)',
 				color: 'warning',
 				fields: [
-					{ title: 'User', value: `${userName} (${userEmail})` },
+					{ title: 'User', value: userName },
 					{ title: 'Object key', value: key },
 				],
 				actions: [
 					{
 						type: 'button',
 						text: 'View in Spam Users Dashboard',
-						url: spamUsersUrl,
+						url: dashUrl,
 					},
 				],
 			},
@@ -226,37 +224,144 @@ export const postToSlackAboutSuspiciousUpload = async (
 	});
 };
 
-export const postToSlackAboutUserBan = async (
-	userId: string,
-	userEmail: string,
-	userName: string,
-	reason: UserSpamTagFields,
-) => {
-	if (process.env.NODE_ENV === 'test') {
-		return;
+const getUserProfileUrl = (userSlug: string) => `https://www.pubpub.org/user/${userSlug}`;
+
+const getSpamDashUrl = (userName: string) =>
+	`https://pubpub.org${getSuperAdminTabUrl('spamUsers')}?q=${encodeURIComponent(userName)}`;
+
+const buildReasonText = (reason?: UserSpamTagFields): string => {
+	if (!reason) return '';
+	if (reason.manuallyMarkedBy?.length) {
+		const last = reason.manuallyMarkedBy[reason.manuallyMarkedBy.length - 1];
+		return `Manually marked by ${last.userName}`;
+	}
+	if (reason.suspiciousFiles?.length) return 'Uploading suspicious files';
+	if (reason.suspiciousComments?.length) return 'Posting suspicious comments';
+	if (reason.honeypotTriggers?.length) {
+		const last = reason.honeypotTriggers[reason.honeypotTriggers.length - 1];
+		const parts: string[] = [last.honeypot];
+		if (last.context?.communitySubdomain)
+			parts.push(`community: ${last.context.communitySubdomain}`);
+		if (last.context?.pubSlug) parts.push(`pub: ${last.context.pubSlug}`);
+		return `Honeypot triggered (${parts.join(', ')})`;
 	}
-	const spamUsersUrl = `https://pubpub.org${getSuperAdminTabUrl('spamUsers')}?q=${encodeURIComponent(userEmail)}`;
-	let reasonText = '';
-	if (reason.suspiciousFiles?.length) {
-		reasonText = 'Uploading suspicious files';
-	} else if (reason.suspiciousComments?.length) {
-		reasonText = 'Posting suspicious comments';
-	} else if (reason.honeypotTriggers?.length) {
-		reasonText = 'Falling for honeypots';
+	return '';
+};
+
+const buildHoneypotContextLine = (reason?: UserSpamTagFields): string | null => {
+	if (!reason?.honeypotTriggers?.length) return null;
+	const last = reason.honeypotTriggers[reason.honeypotTriggers.length - 1];
+	if (!last.context) return null;
+	const parts: string[] = [];
+	if (last.context.communitySubdomain) {
+		const communityUrl = `https://${last.context.communitySubdomain}.pubpub.org`;
+		parts.push(`Community: <${communityUrl}|${last.context.communitySubdomain}>`);
+	}
+	if (last.context.pubSlug && last.context.communitySubdomain) {
+		const pubUrl = `https://${last.context.communitySubdomain}.pubpub.org/pub/${last.context.pubSlug}`;
+		parts.push(`Pub: <${pubUrl}|${last.context.pubSlug}>`);
+	} else if (last.context.pubSlug) {
+		parts.push(`Pub: ${last.context.pubSlug}`);
 	}
+	if (last.context.content) {
+		const truncated =
+			last.context.content.length > 200
+				? last.context.content.slice(0, 200) + '...'
+				: last.context.content;
+		parts.push(`Content: ${truncated}`);
+	}
+	return parts.length > 0 ? parts.join('  |  ') : null;
+};
+
+type UserBanSlackOptions = {
+	userId: string;
+	userName: string;
+	userSlug: string;
+	userAvatar?: string | null;
+	reason?: UserSpamTagFields;
+	actorName?: string;
+};
+
+export const postToSlackAboutUserBan = async (opts: UserBanSlackOptions) => {
+	if (process.env.NODE_ENV === 'test') return;
+	const { userName, userSlug, userAvatar, reason, actorName } = opts;
+	const profileUrl = getUserProfileUrl(userSlug);
+	const dashUrl = getSpamDashUrl(userName);
+	const reasonText = buildReasonText(reason);
+	const byText = actorName ? ` by ${actorName}` : '';
+	const reasonSuffix = reasonText ? ` -- ${reasonText}` : '';
+	const headline = `*<${profileUrl}|${userName}>* banned${byText}${reasonSuffix}`;
+	const fallback = `${userName} banned${byText}${reasonSuffix}`;
+
+	const headerSection: Record<string, any> = {
+		type: 'section',
+		text: { type: 'mrkdwn', text: headline },
+	};
+	if (userAvatar) {
+		headerSection.accessory = {
+			type: 'image',
+			image_url: userAvatar,
+			alt_text: userName,
+		};
+	}
+
+	const blocks: Record<string, any>[] = [headerSection];
+
+	const honeypotLine = buildHoneypotContextLine(reason);
+	if (honeypotLine) {
+		blocks.push({
+			type: 'context',
+			elements: [{ type: 'mrkdwn', text: honeypotLine }],
+		});
+	}
+
+	blocks.push({
+		type: 'actions',
+		elements: [
+			{ type: 'button', text: { type: 'plain_text', text: 'Profile' }, url: profileUrl },
+			{ type: 'button', text: { type: 'plain_text', text: 'Spam Dashboard' }, url: dashUrl },
+		],
+	});
+
 	await postToSlack({
-		icon_emoji: ':warning:',
+		icon_emoji: ':no_entry:',
+		text: fallback,
+		attachments: [{ fallback, color: 'danger', blocks }],
+	});
+};
+
+type UserLiftedSlackOptions = {
+	userId: string;
+	userName: string;
+	userSlug: string;
+	actorName?: string;
+};
+
+export const postToSlackAboutUserLifted = async (opts: UserLiftedSlackOptions) => {
+	if (process.env.NODE_ENV === 'test') return;
+	const { userName, userSlug, actorName } = opts;
+	const profileUrl = getUserProfileUrl(userSlug);
+	const byText = actorName ? ` by ${actorName}` : '';
+	const headline = `*<${profileUrl}|${userName}>* restriction lifted${byText}`;
+	const fallback = `${userName} restriction lifted${byText}`;
+	await postToSlack({
+		icon_emoji: ':white_check_mark:',
+		text: fallback,
 		attachments: [
 			{
-				fallback: `${userName} (${userEmail}) banned for ${reasonText}`,
-				pretext: `${userName} (${userEmail}) banned for ${reasonText}`,
-				color: 'danger',
-				fields: [{ title: 'User', value: `${userName} (${userEmail})` }],
-				actions: [
+				fallback,
+				color: '#5cb85c',
+				blocks: [
+					{ type: 'section', text: { type: 'mrkdwn', text: headline } },
 					{
-						type: 'button',
-						text: 'View in Spam Users Dashboard',
-						url: spamUsersUrl,
+						type: 'actions',
+						elements: [
+							{
+								type: 'button',
+								text: { type: 'plain_text', text: 'Profile' },
+								url: profileUrl,
+							},
+						],
 					},
 				],
 			},
@@ -264,55 +369,44 @@ export const postToSlackAboutUserBan = async (
 	});
 };
 
-export const postToSlackAboutUserLifted = async (
-	userId: string,
-	userEmail: string,
-	userName: string,
-) => {
-	if (process.env.NODE_ENV === 'test') {
-		return;
-	}
-	await postToSlack({
-		icon_emoji: ':warning:',
-		attachments: [
-			{
-				fallback: `${userName} (${userEmail}) lifted`,
-				pretext: `${userName} (${userEmail}) lifted`,
-				color: 'good',
-				fields: [{ title: 'User', value: `${userName} (${userEmail})` }],
-			},
-		],
-	});
+type NewSpamTagSlackOptions = {
+	userId: string;
+	userName: string;
+	userSlug: string;
+	spamScore: number | null;
 };
 
-export const postToSlackAboutNewUserSpamTag = async (
-	userId: string,
-	userEmail: string,
-	userName: string,
-	spamScore: number | null,
-) => {
-	if (process.env.NODE_ENV === 'test') {
-		return;
-	}
-	const spamUsersUrl = `https://pubpub.org${getSuperAdminTabUrl('spamUsers')}?q=${encodeURIComponent(userEmail)}`;
+export const postToSlackAboutNewUserSpamTag = async (opts: NewSpamTagSlackOptions) => {
+	if (process.env.NODE_ENV === 'test') return;
+	const { userName, userSlug, spamScore } = opts;
+	const profileUrl = getUserProfileUrl(userSlug);
+	const dashUrl = getSpamDashUrl(userName);
 	const scorePart = spamScore != null ? ` (score: ${spamScore})` : '';
-	const notificationText = `New user spam tag: ${userName} (${userEmail})${scorePart}`;
+	const headline = `New spam tag for *<${profileUrl}|${userName}>*${scorePart}`;
+	const fallback = `New spam tag: ${userName}${scorePart}`;
 	await postToSlack({
 		icon_emoji: ':mag:',
+		text: fallback,
 		attachments: [
 			{
-				fallback: notificationText,
-				pretext: notificationText,
-				color: 'warning',
-				fields: [
-					{ title: 'User', value: `${userName} (${userEmail})` },
-					...(spamScore != null ? [{ title: 'Spam score', value: `${spamScore}` }] : []),
-				],
-				actions: [
+				fallback,
+				color: '#f0ad4e',
+				blocks: [
+					{ type: 'section', text: { type: 'mrkdwn', text: headline } },
 					{
-						type: 'button',
-						text: 'Review in Spam Dashboard',
-						url: spamUsersUrl,
+						type: 'actions',
+						elements: [
+							{
+								type: 'button',
+								text: { type: 'plain_text', text: 'Profile' },
+								url: profileUrl,
+							},
+							{
+								type: 'button',
+								text: { type: 'plain_text', text: 'Review in Dashboard' },
+								url: dashUrl,
+							},
+						],
 					},
 				],
 			},
diff --git a/tools/migrations/data/2022_11_29_addSpamTags.js b/tools/migrations/data/2022_11_29_addSpamTags.js
index e493db5940..7784dc8745 100644
--- a/tools/migrations/data/2022_11_29_addSpamTags.js
+++ b/tools/migrations/data/2022_11_29_addSpamTags.js
@@ -1,5 +1,5 @@
 import { Community } from 'server/models';
-import { addSpamTagToCommunity } from 'server/spamTag/queries';
+import { addSpamTagToCommunity } from 'server/spamTag/communityQueries';
 
 import { forEachInstance } from '../util';
 
diff --git a/types/spam.ts b/types/spam.ts
index 563c4a066f..eea7a61421 100644
--- a/types/spam.ts
+++ b/types/spam.ts
@@ -62,12 +62,26 @@ export type HoneypotTrigger =
 	| 'create-discussion'
 	| 'create-thread-comment';
 
+export type HoneypotContext = {
+	communityId?: string;
+	communitySubdomain?: string;
+	pubId?: string;
+	pubSlug?: string;
+	content?: string;
+};
+
 export type UserSpamTagFields = {
 	suspiciousFiles?: string[];
-	// not used yet
 	suspiciousComments?: string[];
 	honeypotTriggers?: {
 		honeypot: HoneypotTrigger;
 		value: string;
+		context?: HoneypotContext;
+		triggeredAt?: string;
+	}[];
+	manuallyMarkedBy?: {
+		userId: string;
+		userName: string;
+		at: string;
 	}[];
 };