How do I protect my chatbot from spam and abuse?

Enable the spam filter to detect abusive activity, configure rate limits to cap message frequency, and use IP or country blacklists to block specific sources.

How do I restrict which domains can display my chatbot?

In Security settings, enter allowed domains separated by commas in the Allowed Domains field. Leave the field empty to allow your chatbot on all domains.

What happens when the spam filter detects suspicious activity?

The spam filter can temporarily block offending IP addresses; repeated violations can escalate to permanent blocking. You can view active blocks in the Temporary Blocks table and review all detected incidents in the Security Violations Log.

Can I block entire countries from using my chatbot?

Yes, use the Country Filter tab in the Blacklisting section to select and block specific countries. This is useful for spam prevention or when your service is only available in certain regions.

How do I limit how many messages a chat session can send?

Enable rate limits in Security settings, then set the maximum number of messages and the time window in seconds. When a user exceeds the limit, the chatbot shows a custom message instead of responding.

Security Settings - ChatLab Help Center

Security Settings help protect your chatbot from abuse, spam, and unwanted embedding. You can restrict where your chatbot appears, limit message frequency, block specific IPs or countries, and enable automatic spam detection.

Where to Find Security Settings

From the main ChatLab administration page, select Chatbots in the main menu and click on the chatbot you want to configure. Navigate to Settings > Security.

Allowed Domains

This setting restricts which websites can display your chatbot widget. By default, your chatbot can be embedded on any website.

To limit your chatbot to specific domains:

Enter the domain names in the Allowed Domains field
Separate multiple domains with commas (e.g., example.com, shop.example.com)
Wait for the saved status before leaving the page.

Leave the field empty to allow the chatbot on all domains. This is an embedding restriction, not private-user authentication. Matching has important exceptions and is not strict hostname matching; read Restricting domains before relying on it.

Rate Limits

Rate limits protect your chatbot from abuse by restricting how many messages a chat session can send within a given time period. When the limit is exceeded, the chatbot displays a custom message instead of responding.

To configure rate limits:

Toggle Enable rate limits for bot to ON
Set the message limit (default: 40 messages)
Set the time window in seconds (default: 150 seconds)
Customize the message shown to users when the limit is exceeded
Wait for the saved status before leaving the page.

The limit is keyed to the chat session, not the visitor's IP address or a guaranteed separate browser tab. Tabs that reuse a session share its counter. For reset behavior and testing, see Rate limits.

IP Blacklist

Block specific IP addresses from interacting with your chatbot. This is useful when you identify abusive users or want to prevent access from specific sources.

To add an IP to the blacklist:

In the Blacklisting section, select the IP Blacklist tab
Enter the IP address (IPv4 or IPv6 format)
Optionally add a reason for blocking
Click Add

To remove an IP from the blacklist, find it in the Blocked IP Addresses table and click Remove.

Country Filter

Choose Blacklist to block selected countries or Whitelist to allow only selected countries. Country detection uses the visitor's IP address. Unknown countries remain allowed, and an empty whitelist does not block everyone, so this is not a substitute for authentication or a legal geographic-access control.

To block a country:

In the Blacklisting section, select the Country Filter tab and choose Blacklist.
Choose a country from the dropdown
Optionally add a reason for blocking
Click Add

To unblock a country, find it in the country list and click Remove. For a whitelist, switch mode, confirm the change, and add the countries you want to allow. Switching modes changes which list is enforced; review the active mode before leaving.

Spam Filter

The spam filter automatically detects and blocks suspicious activity targeting your chatbot. When enabled, the system monitors for patterns such as excessive messages, repeated message sequences, and rapid session creation, and temporarily blocks offending IP addresses.

To enable the spam filter, toggle Enable spam filter to ON and wait for the saved status.

When the spam filter is enabled, two additional sections appear:

Temporary Blocks - Shows IP addresses currently blocked by the spam filter. Each entry displays the IP address, the rule that was triggered, when the block started, when it expires, and the number of violations. You can manually remove a temporary block by clicking the delete button next to the entry. Click Refresh to load the latest data.
Security Violations Log - A read-only history of all security events detected by the spam filter. Click Refresh to load the latest events.

The Security Violations Log shows the following details for each event:

Date/Time - When the violation occurred
IP Address - The source IP
Country - Country code of the IP (if detected)
Rule - Which security rule was triggered
Action - What action was taken (e.g., Temporary Block)
Duration - How long the block lasts

Check Your Configuration

Wait for the saved status after changing settings, then reload your website to check normal visitor access. IP and country list buttons apply their own changes. Review the active mode and block lists if a legitimate visitor cannot connect. A shared office or mobile-network IP can represent several visitors.