Moderation tools

Moderation happens at three levels: what a reader does for themselves, what a moderator does for the community, and what an admin does for the whole instance.

User-level

Tool	Effect	Applies to
Mute	Hides their content from you; they are not notified	Local and remote accounts
Block	Mute, plus severing the follow relationship both ways	Local and remote accounts
Remove follower	Revokes an existing subscription to you	Local and remote
Follower approval	Holds every inbound follow for review	Set in Settings → Privacy
Report	Sends a post or account to the admin queue	Local and remote

Muted and blocked accounts are listed in Settings → Muted and blocked and can be undone at any time.

Moderator-level

Moderators open the same /admin panel as admins, but only two tabs work for them — Reports and Users. The other tabs (Federation, Email, Security, Discoverability, Media, Instance) stay visible and explain that they require the admin role. Within their two tabs moderators can do everything an admin can: work the queue, remove posts, and suspend, edit, verify, delete, or restore regular accounts.

The boundaries, enforced server-side:

• No instance controls. Settings, email, federation, defederation domains, SEO, media keys, and the session secret are admin-only.
• No role grants. Only admins hand out the admin or moderator role.
• No acting on privileged accounts. A moderator cannot suspend, edit, verify, delete, or otherwise touch an admin’s account — or another moderator’s. Admins can act on moderators.

A moderator’s own posts and comments can still be removed like anyone’s, and a moderator can delete any local post or comment from the article page, same as an admin.

Appointing a moderator

An admin opens Admin → Users, expands the account’s More actions menu, and chooses Make moderator…, confirmed with the admin’s own password. The account is notified by email and carries a Moderator badge. Removing the role works the same way. An admin’s account needs no moderator flag — admins implicitly hold every moderator power.

Admin-level

Everything in the moderator section, plus the instance itself. Each subsection below is admin-only.

Reports

The Reports tab is the moderation queue, shared with moderators. For each report you can:

• review the reported post or actor,
• remove the post,
• dismiss the report.

Reports cover remote content too, though your only lever on a remote post is to stop serving it locally.

Users

The Users tab suspends or reinstates local accounts. A suspended account cannot sign in and its content stops being served. Suspended, reinstated and restored accounts are notified by email.

Expanding a row shows the account’s post and follower counts, its latest posts, and every report filed against it or its posts — the context behind a suspend or delete decision. The search box matches handle, display name, or login email; Status, Role, and Email filters narrow the table to either side — active or suspended accounts, admins or non-admins, verified or unverified addresses. Accounts with a role carry an Admin or Moderator badge. The table loads 50 accounts at a time — Load more fetches the next page. Suspend (or Reinstate) sits on the row itself; Edit, role changes, and Delete live in the row’s More actions menu.

An unverified address can be nudged with a fresh verification email, or marked verified by hand when instance mail was broken — the account is told it can sign in.

Admins can grant or revoke the admin or the moderator role from the same table, confirmed with their own password. You cannot change your own role, remove the last admin, or put a moderator flag on an admin (they already have every moderator power); the affected account is notified either way.

Deleting an account goes further: it signs the account out immediately and hides the account, its posts and its profile everywhere. The account is notified by email, with the date until which restoration is possible. Deletion is guarded like deleting a repository — you must type the account’s exact username and re-enter your own password. You cannot delete your own account or another admin’s, and a moderator cannot delete an admin’s or another moderator’s.

A deleted account is kept for 30 days and can be restored from the Recently deleted list on the same page, which shows who deleted it and when the window ends. The list is searchable and pages 50 accounts at a time like the live table. After 30 days the row is erased for good; Erase does the same immediately. Erasing cannot be undone, and it frees the username.

Edit changes how an account appears — photo, display name, bio, public email, custom section, tags, links — or its login email. Profile edits apply immediately and federate like the owner’s own edits. Replacing or removing the photo is the recourse for an abusive avatar; the owner can upload a new one themselves at any time. Changing the login email stores it unverified: a verification link goes to the new address, and a security notice goes to the previous one. Until the new address is confirmed, sign-in is gated the same way as a fresh unverified registration (when email verification is required, which is the default). If the link never arrives, resend it from the same place.

Federation and defederation

Admin → Federation blocks a domain outright — and blocking purges already-cached content from that domain, rather than only filtering what arrives next. Re-federating a domain restores delivery going forward; purged content does not come back on its own. Moderators cannot reach this tab.

AI-scraper protection

Admin → Security enables a proof-of-work challenge on page loads. It is a scraping mitigation rather than a moderation tool, but it lives in the same place. Off by default; see Admin panel for the trade-offs.

What moderation cannot do

• It cannot delete a post from other servers. Removal federates a Delete, which well-behaved servers honour. That is a protocol convention, not an enforcement mechanism.
• It cannot prevent screenshots or archiving. Anything published publicly is public.
• It cannot moderate other instances’ users on their own instances. Your reach ends at what your instance serves and who it delivers to.

A practical policy

1. Publish your instance’s rules somewhere readers can find them.
2. Handle reports promptly — an unattended queue trains people not to report.
3. Prefer the narrowest tool that works: report → remove post → suspend account → delete account → defederate domain.
4. Keep a note of why each domain block was made. Six months later you will not remember.