How to stop spam in a Telegram group

Why your group gets spam

Spammers want an audience they don't have to build. A group with a few hundred or a few thousand members is exactly that. They usually work at scale: one person runs many accounts, joins many groups and posts the same message everywhere. Common examples are crypto "investment" offers, fake job ads, adult links and invitations to other groups.

Two things make a group an easy target:

• Anyone can join instantly. A public group, or a private one with an invite link that's been posted widely, lets an account walk in and post in seconds.
• New members can post anything. If a brand-new account can send links, photos and forwarded messages right away, a spammer gets everything they need on the first try.

Every fix below closes one of those two doors. You don't need all of them. A small, friendly group might only need join requests. A big public group usually needs several layers.

Start with Telegram's built-in tools

These settings live in the group's settings under the group name. They cost nothing, need no bot, and spammers can't get around them by sending a different message.

Join requests

With join requests turned on, people who tap your link don't enter the group straight away. They send a request, and an admin approves or declines it. Before you approve, you can open the person's profile and check for warning signs: no profile photo, a name full of emoji or random letters, or a username that looks generated.

The trade-off is effort. Someone has to review requests, and real people wait until you do. For most community groups that's worth it, because it stops drive-by spam almost completely.

Invite links that need approval

You can create extra invite links and set each one to require approval, or to expire. This is useful when you share the group in several places. Give each place its own link. If one link starts bringing in spam, revoke that link and the others keep working. An expiring link is good for events: share it for the day, and it stops working after.

Slow mode

Slow mode limits how often each member can send a message. It doesn't stop a spammer from posting once, but it stops one account from flooding the chat with ten messages in a row. It also calms down heated discussions. The downside is that fast, friendly back-and-forth slows down for everyone, so many admins turn it on only when they need it.

Member permissions

The permissions screen controls what regular members are allowed to send. You can switch off types of content, such as media or links, for everyone who isn't an admin. If your group is for questions and answers, text-only might be all members need, and most spam relies on links or images.

Be aware that these permissions apply to every regular member, not only new ones. Telegram doesn't have a built-in rule like "new members can't post links for their first day". You can restrict a single person by hand from their profile, but a timed rule for newcomers needs a bot.

Deal with links on purpose

Links are the main thing spammers want to post. Decide what your group needs:

• No links at all. Turn off links in member permissions. Admins can still post them. This is the simplest option for chat and support groups.
• Some links. Keep links on, but write a pinned rule that says which links are allowed, and remove anything else quickly. This works if your admins are active.
• Links are the point. In a group for sharing articles or products, you can't block them, so lean on join requests to control who gets in.

Also watch for "links" that aren't clickable, like a username written as text or a QR code in a photo. Permissions won't catch those. Only people, or a bot that checks something other than content, will.

What bots can and can't do

Bots add rules that Telegram doesn't have on its own. To act on messages, a bot must be an admin in the group with permission to delete messages. A bot that isn't an admin runs in privacy mode and only sees commands, replies to it and service messages, so it can't moderate anything. See how to add a bot to a group and make it admin.

Anti-spam bots generally fall into a few types:

• Captcha bots ask each new member to tap a button or solve a small puzzle before they can write. They stop automated accounts, but not a real person paid to spam.
• Filter bots delete messages that match rules you set, like certain words or links. They need tuning, or they delete good messages too.
• Gate bots ask members to meet a condition before they can write.

The member verification template

The Member Verification template you can make with Echo Maker is a gate bot. When someone who hasn't joined your channel writes in the group, it removes the message and shows them your channel link and a Verify button. Once they join and tap Verify, they can talk. You choose whether it only deletes messages or also restricts the member, and you can write your own message with their name filled in.

To be clear about what it is: it's not a captcha. It doesn't test whether someone is human. What it does is add a step, and that step is enough to put off a lot of drive-by spam, because a spammer posting in hundreds of groups rarely stops to join a channel first. A determined spammer can still join the channel and then post. It also needs a channel, so it fits groups that sit next to a channel, and it grows that channel as a side effect. The idea is the same as mandatory subscription in a bot.

No bot replaces join requests and sensible permissions. Use bots as a second layer, not the first. And if members keep posting the same questions or requests in the group, a contact bot gives them a private place to send them instead.

Admin habits that keep spam low

Settings do most of the work, but a few habits make a real difference:

• Pin short rules. Three or four lines: what the group is for, whether links are allowed, and that ads get you removed. Then enforce them the same way every time.
• Have admins in different time zones. Spam that sits for six hours does more damage than spam removed in six minutes.
• Give admins only the rights they need. A moderator who deletes spam doesn't need permission to add new admins. If one admin account is ever stolen, limited rights limit the damage.
• Ban, don't just delete. A spammer whose message you deleted will often post again. Remove the account too.
• Don't post your invite link everywhere. Every public place you share it is a place spammers can find it. Use separate links per place, so you know which one leaks.
• Check new admins and bots. Only add bots you trust, and only make them admins if they need it. A bot with full admin rights can do anything an admin can. See what bots can see and which ones to avoid.

What to do during a spam wave

Sometimes dozens of accounts arrive at once and post together. Don't try to delete messages one by one while new ones keep coming. Close the door first, then clean up:

1. Stop new posts. In member permissions, temporarily switch off sending messages for regular members. The group goes quiet, and admins can still write.
2. Stop new arrivals. Turn on join requests, and revoke the invite link that's being used. Create a new one later.
3. Clean up. Delete the spam and ban each spam account, so it can't come back.
4. Tell your members. Post a short message: "We're dealing with spam. Don't click links or reply to DMs from strangers." Spammers often message members privately after a wave.
5. Reopen slowly. Turn messages back on, maybe with slow mode for a few hours, and keep join requests on until things are calm.

Afterwards, ask where they came from. If one invite link was the source, it's been shared somewhere public. Replace it with a link that needs approval.