# Moderation

Every embed ships with a built-in moderation layer you configure in the editor's **Moderation** tab (open the embed in the [dashboard](https://portal.cherry.fun/dashboard), then **Moderation**). The rules are enforced by Cherry's servers on the message send path, not in the browser, so a visitor cannot bypass them by editing client code or calling the API directly.

Moderation is off by default: a new embed allows everything. Turn on only the rules you need, then **Save** (moderation is stored with the rest of the embed's settings).

> **Note:** This is different from the read-only **Embed policy** card in the editor. The Moderation tab is your own self-serve setting. The separate Embed policy (whether embed users can perform moderation actions like kick, ban, or mute, plus rate and message-length limits) is set by Cherry and shown read-only. See [Authentication](https://portal.cherry.fun/docs/embed/authentication.md) for the policy limits.

## Minimum wallet age

Require a visitor's Solana wallet to be at least a given number of days old, measured from its first on-chain transaction, before they can post. It is a low-friction filter against throwaway wallets and freshly minted bots.

- Range: **0 to 365 days**. `0` turns the check off (the default).
- A wallet with no transactions has an age of zero, so any non-zero threshold blocks it.

## Blocked words

A list of words that silently hide a message. When a posted message contains a blocked word, it is shadow-dropped: the **sender still sees their own message**, but no one else receives it. There is no visible rejection, so a spammer gets no signal to adjust and retry.

- Matching is **case-insensitive** (words are stored lowercased and de-duplicated).
- Up to **200 words**, each **1 to 100 characters**.

## Links

Choose how links posted in the chat are handled:

| Policy | Behavior |
|---|---|
| **Allow all** (default) | Links are never touched. |
| **Allowlist** | Only links whose host is in your allowed-domains list pass; every other link is blocked. An empty allowlist blocks every link. |
| **Block all** | Every link is blocked. |

When you pick **Allowlist**, add the domains you trust:

- Enter **bare hosts** like `example.com`, lowercased, with no scheme, port, or path (`https://example.com/path` is rejected).
- Each host is a valid domain (labels of `a-z`, `0-9`, and `-`), up to 253 characters.
- Up to **100 domains**.

## Images and GIFs

Two independent toggles, both **on** by default. Turn **Images** off to block image messages, or **GIFs** off to block GIFs. They are separate switches, so you can allow one and block the other.

## Limits at a glance

| Rule | Limit |
|---|---|
| Minimum wallet age | 0 to 365 days |
| Blocked words | up to 200, each 1 to 100 characters |
| Allowlist domains | up to 100 bare hosts, each up to 253 characters |

The portal rejects values outside these bounds before saving, and the server enforces the same limits, so an out-of-range value never reaches a live embed.

## Next steps

- [Configuration](https://portal.cherry.fun/docs/embed/configuration.md) · [Authentication](https://portal.cherry.fun/docs/embed/authentication.md) · [Theming](https://portal.cherry.fun/docs/embed/theming.md)
- [SDK API reference](https://portal.cherry.fun/docs/embed/api-reference.md)