Dealing with toxic users: a behaviour playbook, not a courtroom

Toxicity is behaviour that makes other people stop writing. It is not “someone disagreed with a regular.” It is not “the vibe is off.” If you cannot point at a sentence, a pattern, or a pile-on, you do not have a case. You have a mood. Moods are not a reason to use the nuclear badge.

This is a behaviour playbook. It is not legal advice, not a jurisdiction guide, and not a substitute for counsel when something is actually illegal, a safety threat, or a data incident. When those arrive, you preserve, you escalate to whoever owns legal in your project, and you stop workshopping tone. Everything else on this page is community operations.

It is also not the XenForo queue and not the team culture piece. Those own buttons and hiring. This one owns what you do to a person — in what order, in public or in private, and when you stop hoping they will become kind.

The XenForo community notebook we queried for this series did not document warning ladders, brilliant jerks, brigades, or discourage-versus-ban as a culture choice. It did document spam hygiene (profile fields held until a first message; spam phrases such as [url*) and Moderator Panel by Andrew as a place to track reports. Official XenForo still has warning points, a disciplinary group you strip with Never, soft-delete versus hard-delete, IP discourage versus IP ban, and a security lock that is not a punishment. Discourse still has flags, a review queue, silence versus suspend, and a TL0 auto-silence when enough distinct TL3 users flag the same new account. Use those as examples. Write your ladder on a staff page. Do not copy a 2018 blog’s point values.

Name the behaviour before you name the tool

Most “toxic” tickets are one of six shapes. If you skip the name, you will use the wrong size of hammer.

Shape	What you see	First move	Usual mistake
Spam / scam	Pattern, links, new account, copy-paste	Contain fast (queue, silence, spam cleaner)	Debating them in public
Heat	Two people having a bad hour in an otherwise fine thread	Cool the thread; time-out the thread	Banning the louder one because staff is tired
Pattern cruelty	Same person, many targets, many days	Private warning + documented ladder	“That’s just how they are”
Brilliant jerk	High-value posts, high-cost treatment of others	Same ladder as anyone, said out loud	A private exemption
Brigade	Many accounts, one target, sudden, often off-site	Slow the room; stop feeding the audience	Fighting the mob one reply at a time
Safety / illegal	Threats, doxxing, CSAM, swatting talk	Preserve, escalate, lock — not a vibe check	Asking the community to “weigh in”

You will want a seventh shape: “I don’t like them.” That is not a shape. Recuse, or live with them.

Pattern is the word that does the work. One rude post is a warning or a move. Four rude posts to four newcomers is a state change. A single explosion after a ban of their friend is heat. Write the dates down. Memory is how brilliant jerks survive.

Public versus private is a design choice

Default private for the person. Default public for the content.

• The post that broke a rule is edited, moved, soft-deleted, or locked where people can see the result (gone, or a staff note: “locked, cooling off”).
• The conversation about what happens to the account happens in a conversation they can read — XenForo conversation, Discourse PM, an email you can search later — and in the staff note on the profile.
• A public call-out of the person is a show. Shows train the audience to demand more shows.

Exceptions you write down in advance:

• Spam gets no private novel. Remove, log, move on.
• A public lie about what staff did can get one public correction, then private. Do not litigate.
• A warning that must be visible to stop copycats (for example: “we do not post other people’s private screenshots”) can be a generic staff post in the thread, without a parade of the offender’s history.

If two moderators would choose differently, the staff page is unfinished. Finish it. The team article already said consistency is the product. Toxicity is where inconsistency becomes favouritism.

Never argue as the root Admin. The community rule is older than this article: the nuclear badge in a fight chills the room and turns the next honest disagreement into “staff pile-on.” Use the personal account to be a member. Use the staff identity to sign the action.

Build a ladder you can explain in one screen

Do not publish point math you cannot defend. Do publish the rungs and what members will experience.

A ladder that is enough for most public communities:

1. Nudge — public or private sentence: this missed the rule, here is the rule, here is how to continue. No points. No badge. Most heat dies here if staff is fast.
2. Warning — written, stored, with a reason the member can read. Official XenForo: incremental warnings and warning points that can drop someone into a group whose key rights are Never. Discourse: a staff PM plus, if needed, a short silence (they can still read and reply to staff; they cannot start topics, reply in public, flag, or start PMs). Pick one primary tool per platform so the team does not mix metaphors.
3. Contain — they may read; they may not perform. XenForo: stripped group (no post / no start thread / no upload) while the account remains Valid. Discourse: silence for a set period. This is for pattern cruelty that did not stop.
4. Remove — they may not participate. XenForo: ban or a non-Valid state that uses the Unregistered permission set. Discourse: suspend (cannot log in). This is for repeats, for brigades you cannot slow, and for anything on the safety row.
5. Hard-delete content — only for illegal or for spam you have already copied an identifier from. Official XenForo: soft-delete is the reversible default (thread:write); hard-delete is a separate, destructive scope. Undo is a backup. Do not hard-delete a bad take.

Write, next to each rung, whether it expires. If you cannot say, it does not expire, and you will stack people into a hole. Expiry is how a drunk Saturday stops being a personality. Permanent rungs are for patterns.

Write who may climb which rung. Room mods: nudge and (if you trust them) warning. Site mods: contain. Admin: remove, and anything that touches another staff account. The Protected Users idea exists so a junior cannot remove the admin identity. Use stock limits if you do not run the add-on.

Do not invent a second ladder named after ranks. Demoting “Veteran” as punishment couples reward design to discipline. Members will hear “you are not a real regular” instead of “you were cruel on Tuesday.”

Platform tools — examples, not a tour

Use the smallest tool that stops the harm. Name it in the staff note so the next shift does not guess.

XenForo (official facts, used as verbs).

• Soft-delete hides a post or thread. Reversible. Default public action.
• Hard-delete removes the row. Backup to undo. Illegal and confirmed spam, not taste.
• Warning points + a disciplinary group with Never on the rights you are taking. Never overrides Yes from other groups — that is the point of a discipline group, and the reason you must not use Never on Registered for a promotion ladder.
• User state. Valid means they confirmed mail and get Registered rights. Other states use the Unregistered / unconfirmed set. A “disabled” account that can still post is a permission bug.
• Discourage (account or IP) makes the connection miserable without a drama-ban. Official use: the proxy that keeps registering. Do not discourage a member you are still talking to.
• Ban IP from the IP list on the profile (More users to find shared accounts). For the proxy, not for a coffee-shop regular.
• Security lock (Locked: User must change password / Locked: User must reset password). Compromised account. Tell them in a conversation they can still read. Not a punishment.

Community spam practice that prevents a class of “toxic” that is actually industrial: stop unestablished accounts filling location / occupation / website until they have one real post; spam phrases with a wildcard ([url*, not only [url=).

Discourse (official / Meta facts, used as verbs).

• TL1+ can flag. TL0 cannot flag, mute, or ignore. Do not tell a brand-new user to “just flag it.”
• Flags enter the review queue. Higher trust weighs more. Staff can override automation.
• Diverse TL3 flags on a TL0 post can auto-silence the account and hide their posts. That is a spam brake. Check the queue so a popular regular cannot weaponise it against a newcomer they dislike.
• Silence: no new topics, replies, flags, or PMs; no likes; they can still read and reply to staff PMs. This is your contain rung.
• Suspend: cannot log in. Strongest tool. Egregious or repeated.
• Watched words are a moderator tool. Research brief / product: flag, block, replace, censor. The Discourse notebook we queried did not spell those four actions; do not invent extra modes. Use what your version actually lists.
• Reviewable scoring exists; the formula is undocumented. Do not pretend you know the number. Watch what auto-hides and override in the queue.

Shared.

• A staff note on the user, same day, with links.
• One reason code everyone can search.
• No shared Admin session “to handle this quickly.”

If you do not know which button you used, you cannot appeal it, and you cannot repeat it.

The brilliant jerk

This is the case that destroys otherwise adult teams.

They write the guides. They answer first posts. They are cruel to people who are wrong, new, or insufficiently impressed. Regulars will lobby you: “We need them.” You will be tempted to run a private exemption. That exemption is the culture. New people will learn it in a week.

Rules that keep the room:

1. Same ladder. The value of their posts is a reason to talk to them like an adult, not a reason to skip rungs.
2. The conversation is specific. Paste the sentences. Do not say “your tone.” Say “you called a newcomer stupid in three threads this month. Stop, or we contain.”
3. Offer a lane. Some jerks will accept “you may write guides in X; you may not reply in Introductions.” That is access design, not a medal. Write it. If they refuse the lane, they refused the room.
4. Do it before they are a faction. Waiting until they have a fan club means the contain step becomes a civil war. Early is kinder.
5. Staff who are brilliant jerks lose the badge first. A cruel moderator is not a content problem. They are a team problem. Off-ramp, then the same member ladder.

If the community cannot survive their absence, you do not have a community. You have a dependency. Dependencies get sick.

Brigades and off-site heat

A brigade is a performance that wants an audience. Your job is to shrink the stage.

Signs: a quiet user suddenly has twenty quotes from accounts that never post; a Discord or Reddit thread is screenshot-farming you; the same paragraph appears in five voices; the target is a woman, a minority, a staff member, or whoever the week’s villain is.

Moves that work:

• Lock or slow the thread without a staff speech. Every speech is a clip.
• Move the personal fight to a private conversation. The audience does not get a vote.
• Silence or contain the new accounts first. TL0 / unestablished is where industrial pile-ons live. Check IPs and creation times. Do not perform a public “we know where you came from.”
• Protect the target’s ability to leave. “You do not have to reply” is a staff sentence worth sending in private.
• One public note, generic: “Off-site raids are removed. We are not hosting this.” Then stop.

Moves that fail:

• Debating the raid’s ideology in the announcement forum.
• Mass-banning by vibe and hitting three regulars who happened to agree with a sentence.
• Asking the target to “just ignore it” while leaving the thread open.
• Mirroring the raid into your own Discord so two stages burn at once.

If the brigade is about a staff decision, the appeal path in the team article is the valve. A locked thread plus a private appeal is boring. Boring is the goal.

Coordinated harassment that crosses into threats or doxxing leaves this playbook. Preserve. Escalate. Do not crowdsource.

Heat versus pattern — a worked afternoon

Two people in a support thread. Insults. Ten more accounts watching.

If this is heat: lock the thread for a cooling period, nudge both in private, invite them to rewrite the technical question in a new thread tomorrow. No points. No banners. Staff does not pick a winner on the internet.

If this is pattern: one of them has three staff notes this quarter. You skip the theatrical lock-as-punishment. You warn or contain the pattern, and you still lock the thread so the audience does not finish the job. The other person gets a nudge if they escalated, not a matching sentence “to be fair.” Fair is not symmetric when the histories are not.

If this is a brilliant jerk plus a newcomer: you protect the newcomer’s first-post experience (the active-users loop depends on it) and you have the jerk conversation the same day. Waiting until next week is how the newcomer leaves and the jerk writes another guide.

Write the three outcomes on the staff page so a tired evening shift does not invent a fourth.

What you do not do

• Do not give legal advice to members or to other staff in the public thread. “Talk to a lawyer” is allowed. “This is defamation in your country” is not your job on this page.
• Do not publish a dossier. A staff post that lists every sin since 2019 is a pile-on you ran yourself.
• Do not use security lock as a ban. It is for compromised accounts.
• Do not use discourage on someone you are negotiating with. You will look sadistic and you will not get a better apology.
• Do not hard-delete taste. Soft-delete. The next appeal needs the text.
• Do not make the victim moderate their own raid.
• Do not pay the jerk in status. A public “valuable member” exception is a second ruleset.
• Do not argue on the root Admin account.
• Do not outsource the ladder to a Discord mob vote.
• Do not keep a ghost badge on someone who already left. They will come back angry, with delete.

When in doubt, smaller tool, better note, later review.

After you remove someone

A ban is not the end of the work.

• Tell the team in the staff channel: who, which rung, which threads to watch for alts, whether to mention it in public (default: no).
• Watch the alts for a week, not forever. Official XenForo IP tools (More users) are for this. Discourse admin user pages and the review queue will surface the obvious repeats. You will miss a careful alt. Live with it.
• Do not mock them in the room they just left. The audience is still there.
• Offer the target a human sentence. “They cannot post here. You do not owe them a reply if they appear elsewhere.”
• Review the ladder if this is the third time this month the same shape appeared. Maybe the nudge is too slow. Maybe a room should not exist. Maybe a staff member is the jerk.

Appeals: one, on a timer, to a person who did not make the original call. New evidence only. A 4,000-word manifesto is not new evidence. If you overturn, say so in the staff note and take the next similar case yourself so the team sees the new line.

If they come back polite in six months and you run a community that allows that, treat them as a new account with a history, not as a redemption arc you owe the audience.

Staff as the toxic user

The worst version of every row above is a moderator.

Same ladder, faster. The badge comes off before the member rungs continue. Recusal is not optional when the report is about them. The founder does not “have a word” in DMs and leave the badge on. The team article’s off-ramp exists for this. Use it.

If the toxic user is the founder, this page cannot save you. The rest of the staff can only refuse to sign the exemption. That refusal is the job.

Checklist

• Staff page names the six shapes and the first move for each
• Public handles content; private handles the account (exceptions written)
• Ladder rungs, expiry, and who may climb them fit on one screen
• Punishment is not a cosmetic rank
• Soft-delete default; hard-delete reserved
• Discourse: silence vs suspend understood; TL0 auto-silence watched for weaponisation
• XenForo: warning group uses Never on purpose; security lock is not a ban
• Brilliant jerks on the same ladder; staff jerks lose the badge first
• Brigade response is shrink-the-stage, not a speech
• Safety / illegal leaves this playbook
• Notes on the user, same day, with links
• Appeal path exists and is not a public trial
• No legal advice in the thread

Toxicity is a pattern you are willing to name, a ladder you are willing to climb in the same order for the person who writes your best guides, and a stage you are willing to shrink. The tools already exist. The exemption is the only thing you have to refuse to invent.