Automatic Link Deletion via a Telegram Group Chat Bot

Which links should be deleted in a Telegram group

Before configuring the filter, establish a rule for members and moderators. In Telegram, a link is not just text like https://site.example. A member can send an address without a protocol, an invite to another chat, a shortened URL, clickable text with a disguised address, or a link in the caption of a photo, video, or document.

Separately decide what to do with links to streaming platforms, social networks, donation services, cloud storage, portfolios, stores, and request forms. For a streamer's chat, advertising other channels and third-party invites are usually prohibited, but links to the schedule, clips, donations, and team resources are allowed.

The bot receives a message only after it has been sent and then deletes it. So the link may be visible in the chat for a few seconds. Telegram does not allow a bot to block a member from sending a message in advance.

Choose a filtering scheme, not a blanket ban

Deleting all links entirely suits a closed chat where only the project team publishes materials. In a public community, such a scheme quickly becomes a nuisance: viewers won't be able to send a timestamp, a bug report, a link to a clip, or relevant material on the topic being discussed.

It's more practical to divide links into several categories: allowed domains, links from trusted roles, suspicious links from newcomers, and prohibited invites. For example, you can delete all t.me invites, links to other people's streams, and URL shorteners, but allow links to the channel's official resources.

• Strict scheme: delete any URL from a regular member.
• Whitelist: allow only approved domains and subdomains.
• Role-based scheme: don't check links from administrators, moderators, and service bots.
• Reputation-based scheme: apply the strict filter only to new or suspicious accounts.

The more complex the rule, the more testing it will require. A scheme that's too lenient will let some advertising through, while one that's too broad will start deleting legitimate messages.

A ready-made bot, a builder, or your own logic

For basic moderation, you can use ready-made bots such as Combot or Rose. Such solutions usually include anti-spam, word filters, restrictions for newcomers, warnings, and an action log. Before installing, check whether the chosen bot can analyze links specifically, media captions, and edited messages.

A ready-made bot is convenient when a standard rule is enough. But the set of exceptions, the log format, and the URL-checking logic may be limited by the service's settings. Commands for such bots differ by version and interface, so rely on their current help documentation rather than random instructions from old posts.

An automation builder suits a simple scenario: received a message, found a URL, sent a notification to the moderator. Its weak points are delays, integration limitations, and dependence on an external platform. For an active chat, this can be noticeable.

A custom bot via the Telegram Bot API is needed if you require a separate policy for different topics, roles, and types of links. It lets you check Telegram entities, store violation history, and send logs to a private moderator chat. In return, you'll be responsible for the server, updates, and token security.

Which permissions a bot needs to delete messages

Add the bot to the required group and make it an administrator with the permission to delete messages. Without this, the bot can recognize a URL, record the event in a log, and even send a warning, but it won't be able to delete the post.

If you plan temporary restrictions, muting, or bans after repeated violations, you'll need the corresponding permissions. A simple anti-link setup doesn't need permissions to change the group profile, appoint administrators, or manage invites.

Grant only the necessary permissions. A code error, a service vulnerability, or a compromised token is more dangerous if the bot has full control over the chat.

Check whether the bot receives members' messages

After adding it, don't stop at the start command. Send a test message from a regular account without admin rights. Check text with a link, a link in a photo caption, and clickable text. It's important to test as a member: the owner and administrators often fall under exceptions.

For your own bot, check incoming updates. New messages usually arrive in the message field, while changes to already published messages arrive in edited_message. If the bot works in a channel with a linked group or processes channel posts, separate update types may be required.

Privacy mode also affects which messages the bot receives. If the handler only sees commands and replies to the bot's messages, the link filter won't work fully. After changing settings, re-check updates in a test group.

Check Telegram entities, not just text

In a message, Telegram passes markup entities. For links, the url and text_link entities are especially important. The first means the address itself is in the text. The second means the address is hidden under an ordinary word: for example, a member sends "look here," but the link leads to an advertising site.

If the bot only checks the message string, text_link is easy to miss. For text_link, you need to extract the URL from the entity field rather than searching for the domain in the visible text. For media captions, analyze caption and caption_entities the same way as text and entities.

The minimal checking logic looks like this: collect URLs from entities, then find text addresses that Telegram didn't recognize as entities, normalize the domain, and compare it against the rules. You need to delete the entire message along with the attachment; otherwise, an advertising image or file without a caption will remain in the chat.

Regex examples for URLs and Telegram invites

Regex doesn't replace entity checking, but it helps catch addresses without a protocol and unusually formatted text. For example, for regular URLs you can use the pattern: (?i)\b(?:https?://|www\.)[^\s]+. It finds addresses with http, https, and www, but won't see a domain like example.com without a prefix.

For domains without a protocol, you can add a separate check: (?i)\b[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.(?:com|net|org|ru|io|gg)\b(?:/[^\s]*)?. The list of zones should be tailored to your audience. If you list only a few zones, spammers can use others. If you make the pattern too broad, it will start confusing URLs with technical notations.

Telegram invites are conveniently checked with a separate rule: (?i)\b(?:https?://)?(?:t\.me|telegram\.me)/(?:joinchat/|\+|[a-z0-9_]{5,})\b. Such a rule covers public t.me links and some invites. It shouldn't automatically treat a link to the project's official chat as spam, so domains and specific allowed paths are added to exceptions.

Don't try to cover all bypasses with a single regex. Entries like s i t e . com, replacing the dot with the word "dot," Unicode characters, and images with an address require other methods: anti-spam scoring, manual review, or OCR. A pattern that's too aggressive will cause many false deletions.

Handle links in captions, forwards, and files

Spam rarely limits itself to an ordinary text message. A link can be in the caption of a photo, video, GIF, document, audio, or poll with an explanation. If the bot only looks at the text field, a member will bypass the filter with a single media file.

For every incoming message, check text, entities, caption, and caption_entities. A document's name sometimes also contains a domain or advertising text, but you should be cautious about deleting a file just because of its name: in a work chat, it's easy to lose a needed archive or stream recording that way.

A forwarded post doesn't always contain a visible URL, but it can lead to a third-party channel via a button or caption. A regular bot doesn't always receive all the data about inline buttons and the forward source in a format convenient for filtering. If forwards are a problem, it's safer for new members to restrict them separately or send such posts for manual review.

Close the bypass via message editing

A typical bypass looks like this: a member sends a neutral phrase, waits for the message to leave the moderators' attention, then adds advertising via editing. If the handler only reacts to new messages, the link will remain in the group.

For your own bot, subscribe to the edited_message update and run the same checking function as for message. Don't create separate stripped-down logic: otherwise, the filter may delete a direct link in a new message but miss a text_link or caption after editing.

In the log, note that the deletion occurred after an edit, and save the original message identifier. This will help sort out a complaint: a member might have edited an old post not for advertising but to fix a link to an allowed resource.

Build a whitelist of domains and paths

It's better to build a whitelist by normalized domain rather than by exact string match. For the address https://clips.example.com/video/123, the bot should separate the host clips.example.com from the path, convert it to lowercase, and strip the service www prefix.

An example exception list for a streamer community:

• your main site and required subdomains;
• channel pages on streaming platforms;
• pages with the broadcast schedule and announcements;
• donation services the project uses;
• team documents, request forms, and task trackers;
• the project's official Telegram links: the specific @username of the chat or channel;
• partner domains, if their publication is genuinely permitted by the rules.

Don't add an entire large service to the whitelist if you need one specific resource. Allowing the whole domain can open the way to third-party pages, referral spam, or phishing on the same platform. In such cases, check not only the domain but also the allowed URL path.

Separate trusted roles from regular members

Administrators, moderators, and notification bots should usually be able to publish links without delays. The simplest option is to skip users with administrator status. It's convenient but gives a full exception to everyone granted admin rights, including temporary helpers.

A stricter option is a separate list of trusted account user IDs. It's useful when not all administrators should advertise external resources. The list needs to be reviewed after team changes: a forgotten former moderator's ID becomes a filter bypass.

For newcomers, you can enable a separate mode. For example, delete any external links from members who joined recently, while sending regular users' messages for a more lenient check. This approach cuts down mass spam but may prevent a real viewer from immediately sending needed material.

How to distinguish an advertising link from a useful one

A URL by itself doesn't prove spam. Evaluate the message context, the domain, and the author's behavior. A link to patch notes in a game update discussion differs from "check out my channel" under any message, even if both addresses are technically valid.

• The link leads to a domain from the whitelist or a known resource on the topic of discussion.
• The text around the URL is related to the current conversation rather than containing a template call to subscribe or earn money.
• The member has been in the group for a long time, writes ordinary messages, and doesn't post identical text in multiple topics.
• The domain doesn't use suspicious substitutions, lookalike characters, or a chain of redirects through shorteners.
• The link is posted in an allowed topic, such as the clips, requests, or technical support section.
• The account hasn't sent several messages in a row with different links after joining the chat.

Heuristics shouldn't be turned into an automatic ban. A new real viewer may have a low reputation, while a known account is sometimes hacked. For borderline cases, it's better to delete the message, save it to the log, and provide a way to quickly contact a moderator.

Set up a reaction after a link is deleted

Silent deletion reduces noise, but a member may repost without understanding the reason. A short notification in the chat or a private message makes the rule clearer. Don't publish the deleted URL in the notification: otherwise, the bot itself will redistribute the spam.

A suitable notification text: "The link was deleted by the group rules. On-topic materials and domains from the exception list are allowed. If your message was deleted by mistake, write to a moderator." It's better to adapt the wording to the community rules.

A violation counter is useful for protection against repeat flooding. But don't enable automatic blocking on the very first trigger. First, gather statistics on false deletions, especially if you're checking domains without a protocol and links in captions.

Keep logs and notify moderators

The moderation log should contain at minimum the data for review: chat ID, user ID, name or username at the time of the event, message ID, time, trigger type, and reason. Reasons might be "prohibited domain," "invite to a third-party group," "URL shortener," "link after editing," or "link from a new member."

It's better to send the deleted URL to a private moderator chat rather than store it in a shared log channel. If the link may be malicious, don't make it clickable: pass the domain as text or replace the dot with a space with an explanation for the moderator.

A useful moderator notification includes the action and context: who sent the message, where it was posted, which rule it was deleted under, and whether it was an edit. Then the moderator can quickly decide whether to add the domain to the whitelist, lift a restriction from the member, or leave the rule unchanged.

What to do about a false trigger

A member needs a clear route for a complaint: private messages to a moderator, a separate topic in the group, or a feedback form. Don't ask them to resend the deleted link in the general chat. It's better to suggest sending the domain and explaining why it's needed.

When reviewing, the moderator should check the rule, the entity type, and the author's status. If the URL was allowed, add the exact domain or path to the exceptions. If the problem arose from a regex that's too broad, narrow the pattern rather than creating a list of dozens of random exceptions.

Don't automatically restore any deleted message. It may contain a phishing link, and the original context is already gone. It's safer to ask the author to repost the material after moderator confirmation or to place it in the topic intended for links.

Test the filter in a test group before launch

Create a test group with the same bot permissions and set up a regular test account. Testing from the chat owner isn't suitable: they may be excluded from the filter as an administrator. Record the results so that after changing the regex or whitelist you don't break scenarios that already work.

1. Send a URL with https, with www, and a domain without a protocol.
2. Check a link hidden in clickable text via the text_link entity.
3. Send a t.me invite to a third-party group and a link to the project's allowed chat.
4. Add a URL to the caption of a photo, video, and document.
5. Edit a neutral message and insert a prohibited link into it.
6. Check a post from an allowed domain and a message from a trusted moderator.
7. Make sure the moderator log receives the deletion reason without publishing the dangerous link in the general chat.

Add a rule about links to the group description

A short rule reduces the number of repeat violations and disputes with members. It's enough to state that advertising links, third-party invites, and shortened URLs are deleted automatically, and that useful materials can be coordinated with moderation.

Don't disclose all the technical details of the filter, regular expressions, and reputation-check conditions in the description. This information helps spammers find bypasses. For members, it's more important to know which links are acceptable and where to turn in case of an erroneous deletion.