The worst behaviour in most communities happens where the owner cannot see it: in private messages. A new member posts a friendly introduction, and by the evening they have three messages — a coaching offer, an invitation to someone else's group, and a "quick question" that turns out to be a sales call. They do not report it. They just stop opening the app.
You will never see most of this, and you should not try to read members' messages to find it. What you can do is set the rules, make reporting easy, act fast on what is reported, and give members control of their own inbox. This guide covers each.
The problem you cannot see
Public problems announce themselves. A spam post sits in the feed until someone deals with it; an argument plays out where everyone can watch. Private messages are the opposite. The member on the receiving end is the only witness, and the most common response is not a report but a quiet decision that this community is not a safe place to be visible.
That makes unwanted messages unusually expensive. They land hardest on the newest members, who have the least attachment to lose, and they leave no trace in anything you measure. A member who leaves after a week of pitches looks exactly like a member who simply lost interest.
Who sends them
Not every unexpected message is a problem — helping each other privately is part of what members are there for. The trouble comes from a few recognisable kinds.
| Kind | What it looks like | What to do |
|---|---|---|
| The cold pitch | "Loved your intro! Quick question about your business…" | Warn once, then ban |
| The recruiter | An invitation to their own group, course or server | Warn once, then ban |
| The persistent | Keeps messaging after no reply, or after being asked to stop | Treat it as harassment |
| The harasser | Insults, threats, sexual content | Suspend or ban, immediately |
| The helpful stranger | "Saw your question — happy to share what worked for me" | Nothing. This is what messages are for |
The line is consent, not content. A useful message is one the recipient would have welcomed. A pitch is one they did not ask for, from someone who wants something.
Write the rule down, and say that it covers messages
Most community rules are written about posts, and members reasonably assume the private inbox is outside them. Close that gap explicitly. "No unsolicited messages to sell, recruit or promote" is short enough to remember and specific enough to enforce, and your code of conduct should say in its scope that the rules apply in direct messages as well as in spaces.
A clear rule does two jobs. It gives you something to point to when you act, so enforcement is applying a rule rather than taking a side. And it tells every member that a pitch in their inbox is a breach, not just bad manners they are expected to put up with. Most of the pitching problem is the private version of self-promotion, and it needs the same clarity.
Your introductions thread is a target list
Here is the uncomfortable part: the thing you most want new members to do — introduce themselves, say what they work on, say what they are struggling with — is exactly the information a pitcher is looking for. "I'm launching my first course and I'm stuck on marketing" is a warm lead to the wrong kind of member.
You should not stop asking for introductions. But tell new members what to expect, before it happens: as part of onboarding, one line saying that sales messages break the rules, how to report one, and how to limit who can message them. A member who has been warned reports the first pitch. A member who has not often assumes this is just what the community is like.
Make reporting easy, and close the loop
Members do not report private messages for two reasons: they do not know how, and they assume nothing will happen. Fix both.
Say how to report a message in the welcome material and the code of conduct, in one sentence. Then, when someone reports, reply to them — not with details of what you did to the other person, but with enough to show it was handled: "Thanks for flagging this. We have dealt with it, and you should not hear from them again." A member who gets that reply will report the next one. A member whose report disappears into silence will not.
One report is enough to act on a pitch
With public content, you can see the whole picture before you decide. With private messages you see only what is reported, so the one report you get usually stands for several you did not.
So act on the first credible report of a pitch: a warning that names the rule, and a ban if it happens again. Do not wait for a pattern you will never fully see. Harassment needs no warning at all. Where you are unsure, ask the sender privately — but the benefit of the doubt belongs to the person who received an unwanted message, not the person who sent it. For the slower cases, where a member's behaviour is a pattern rather than an incident, handling difficult members covers the conversation itself.
Give members control of their own inbox
The best protection is the one members can switch on themselves, without having to report anyone or wait for you. Make sure they know three things exist: they can limit who is allowed to message them, they can block a specific person, and they can report a message in one step. Most members never look at their privacy settings unless someone tells them to.
Tell people about these before they need them. A setting discovered after the third unwanted message is much less comforting than one mentioned in the welcome.
When to switch direct messages off
Some communities turn private messages off entirely, and for some it is the right call: a large free community that attracts spammers, a community of young people, or a program where every conversation should happen where moderators can see it.
It has a real cost. Private help between members disappears, and so do the one-to-one conversations that turn acquaintances into the relationships that keep people around. There is also an argument for it beyond safety: private messages are where a community leaks — answers given privately are threads that never existed. For most paid, smaller communities, the better default is messages on, a clear rule, and fast enforcement. Switching them off is for when that is no longer enough.
What the software can and cannot do
In Mateflow, members control their own inbox under Privacy & Safety in their settings: Who Can Message You can be set to Anyone, People I Follow or No One, and they can block someone straight from the conversation, after which neither side can message the other. Any message a member did not send can be reported, with a reason such as spam, harassment or fraud.
Reported messages arrive in the admin Reports queue, where you open the report to read the message and can dismiss it, warn the sender, suspend them or ban them. For the community as a whole, Settings → Communication has a Direct Messaging switch that turns private messages off for everyone, with group conversations controlled separately. Direct messages are available on every plan; group messaging is not.
The honest limits matter here. You cannot browse members' private messages — you see a message only when someone reports it, which is how it should be, and also why reporting has to be easy. The automatic screening — keyword rules and AI moderation — covers posts and replies, not private messages. And the actions on a reported message are about the sender: there is no option to delete the reported message itself, so blocking is still the recipient's fastest way to make it stop.
Three things not to do
Do not leave the rules silent about private messages. If the code of conduct only mentions posts, members will assume their inbox is outside it.
Do not wait for a pattern before acting on a pitch. You only see the messages that get reported; the first credible report is rarely the first message.
Do not let a report go unanswered. One line back to the person who reported decides whether they ever report again.
The bottom line
Unwanted private messages are the part of community safety you cannot see, and they fall hardest on new members who are least likely to complain and most likely to leave.
So handle them with things you can control: a rule that names messages explicitly, a warning to new members before the first pitch arrives, one-step reporting with a reply every time, fast action on the first credible report, and members who know how to limit, block and report on their own. Then judge the community by its inboxes as well as its feed — because that is where a new member decides whether it is safe to be seen.