Skip to content

Black Friday:

60% off

Cliedesk Pro

Every plan, every site count. Ends Cyber Monday.

00 days 00 hrs 00 min 00 sec
Claim 60% off

Administration

Abuse protection, links and files

This page explains how Cliedesk protects the chat widget, forms and the portal from abuse, and how it handles links and files. The settings are in Settings → Privacy & security → Security. People with the Manage security permission (Cliedesk Admins and Owners) can change them. For spam scores, see Security and privacy.

Spam and bot protection

The Spam and bot protection card applies to the chat widget, forms and the customer portal.

  1. Choose a Protection level:
    • Off.
    • Normal: message limits.
    • Strict: half the limits, bot check before guests start a chat.
    • Under attack: bot check for everyone. Guests can then only leave a message.
  2. Set Messages per minute from one IP address or one contact. The default is 20. The next message is refused.
  3. Under Bot check, choose Cloudflare Turnstile or hCaptcha, and enter the Site key and the Secret key from that service. Guests must pass the check before they start a conversation.
  4. Select Save spam and bot protection.

Akismet checks and levels that change on their own are not part of Cliedesk Free.

Which websites may show the chat widget

The chat widget works on your own website. To show it on other websites too, go to Settings → Channels → Chat widget and fill in Other websites that may show the widget, for example shop.example.com, *.example.com. A product’s trusted domains also count. The widget refuses to start on any other website.

The widget sets no cookies. The only cookie Cliedesk sets is for a password-protected help center, and it cannot be read by scripts.

The Links and files card has three settings:

  • Blocked domains: links to these domains (and their subdomains) cannot be opened by agents. Replies, saved replies and rules that contain them are not sent.
  • Trusted domains: other links show where they really go before you open them. Your own website is always trusted.
  • ClamAV malware scanner: the address of a ClamAV server, for example unix:///var/run/clamav/clamd.ctl or tcp://127.0.0.1:3310.

With a scanner, every file is scanned. An infected file that an agent or a visitor uploads is refused. An infected email attachment is put in quarantine: nobody can download it, and agents see a warning. Without a scanner, files are marked Not scanned. Storing files in private S3-compatible storage comes with Cliedesk Pro.

How files are stored

  • Files of messages are private. Cliedesk serves them only through links for one signed-in person, after checking their permission. Each link works for 15 minutes.
  • Cliedesk checks the real file type. Files of a type that is not allowed, or bigger than the size limit (25 MB by default), are refused. The same checks apply to agents, the widget and the portal.
  • Pictures lose their hidden data, such as the GPS position and the camera, before they are stored. The picture itself does not change. This works for JPEG, PNG and WebP. It is on by default (setting security.strip_image_metadata).