No spam

An open form with no login is exactly what spam bots look for, and guestbooks have been a favourite target of theirs for years. UltraGuest deals with it in layers: protection that every guestbook gets without touching a setting, and moderation tools you can add yourself. None of it involves tracking your visitors.

What every guestbook gets

A human check on every post. The sign form includes a Cloudflare Turnstile challenge, which stops the plain bots that used to flood guestbooks. For most people it takes no more than a click.
No links in messages. Almost all guestbook spam exists to spread links, so a message containing a web address or a link tag is refused with a short explanation, and a name cannot contain a link either. Visitors can still leave an e-mail address, which only you see.
Rate limits. One address may post at most 20 times an hour to a guestbook, the same message cannot be repeated within five minutes, and a guestbook that has already received 40 posts in a day takes no more until the next day.
Campaign detection. The same text posted to eight or more guestbooks within a week is treated as a spam campaign, whatever it says: further copies are refused and the earlier ones are removed.
Content rules. Every post is checked against rules for illegal material and the usual junk: pharmacy and drug spam, scam testimonials, hate propaganda, piracy, adult advertising. Recent posts are re-checked every six hours and everything is scanned once a week, so a campaign that slips through is gone within hours.

Text only, on purpose

Visitors can write up to 1,500 characters and use simple formatting (bold, italic, underline, lists) and smilies, but they cannot upload files or images and cannot embed HTML. That removes a whole class of trouble before it starts.

What you can add

In the Control Panel you can approve new messages before they appear, switch on the word filter, keep private messages for your eyes only, block an IP address with one click next to any message, and edit, hide or delete anything. The manage messages page describes these tools, and the moderation guide has the details of the automatic layers.

What we keep when a post is refused

When a rule refuses or removes a post we keep the date, the guestbook, the rule's name and the posting address, never the text. A poster's IP address is shown to the guestbook owner only. More on the privacy and security pages.