Telegram newcomer restrictions: design an entry policy people can finish
Choose between join requests, an in-group CAPTCHA and member permissions. Set up Defendy, test exceptions and restore access when a legitimate newcomer gets stuck.
A new contributor joins a technical community to ask for help with a build failure. The answer requires a log excerpt and a documentation link, but the group has blocked both for newcomers. The restriction may stop some unwanted posts; it also prevents the first useful conversation. This is a hypothetical example of a policy that protects the doorway while making the room difficult to use.
Choose restrictions around the abuse you have actually observed. Immediate posts after joining call for an entry check. Advertising after a completed check calls for message rules. Each restriction needs an understandable end condition and a way to contact a person before admission or after removal.
Separate admission from participation
“New-member protection” is not a single setting. There is a decision about who enters, a check that may happen during entry, and a policy for what members can post once admitted.
| Control | Where the person is | How it ends |
|---|---|---|
| Join request | Waiting outside the group | An administrator or configured bot approves admission |
| In-group CAPTCHA | Already joined; the bot attempts to restrict posting during the check | A successful answer restores the group’s ordinary permissions |
| Default group permissions | Participating under the community’s content policy | An administrator changes the relevant permission |
| Individual mute or ban | Unable to post or return | The applied restriction expires or an administrator removes it |
Defendy’s CAPTCHA timeout is not a general probation period. The verified panel does not provide a separate “no links for the first day” timer or progressively unlock newcomer permissions. If your policy requires a human review after a day, someone must own that review; do not describe it as an automatic feature.
Likewise, changing default member permissions affects ordinary members generally. It is not automatically scoped to recent arrivals. Disabling link previews also does not prevent someone from posting URL text.
Pick an entry route you can support
An open help community may need newcomers to enter promptly. With Defendy’s In group mode, the check appears after joining; successful verification restores the usual group permissions. If files are prohibited by those defaults, passing the challenge is not a promise that file uploads will become available.
A members-only association may prefer Join requests. Defendy sends the challenge in a private chat and approves a successful application. The invitation or other approval-based entry route must be configured in Telegram separately. Changing the Mini App mode does not convert every existing invitation.
This matters when old links are still circulating. In Join requests mode, a direct join is not given the equivalent in-group challenge. Check the actual routes used from the website, partner communities and pinned announcements. Testing only a newly created request link leaves the old direct-entry route unexamined.
Agree on manual approvals, too. An approved application does not trigger another in-group CAPTCHA in this implementation. If one moderator admits someone manually while another expects the bot to screen everyone, the team has two different admission policies without realizing it.
Configure the check, then inspect the consequences
Open Settings in the private chat with @defendy_bot, choose the intended group and open Captcha. Use a test group first, with an ordinary account that is new to it.
- Turn on Enable captcha and select Captcha mode: In group or Join requests.
- Choose an understandable challenge. Button with five minutes under Time to solve is one possible low-friction starting point, not a universal recommendation or a measured security threshold.
- Check Max attempts and Action on failure. To test wrong answers, choose a challenge that actually has wrong answer options; the simple button does not.
- For an in-group mute, set and verify the sanction duration separately from the solution time. Zero means no expiry for that mute. The CAPTCHA ban does not apply the selected duration in either mode.
- Let saving finish, reopen the section and confirm the values. Switches save as they change; an error message means you need to verify what was persisted.
For an in-group failure, the chosen action is kick, mute or ban. A failed join request is declined, and selecting ban additionally attempts to block the account. In the verified implementation, neither CAPTCHA mode applies the selected ban duration. The in-group mute does use its configured duration. Do not treat ban as a short waiting period; test the actual outcome and recovery before using it. The CAPTCHA guide covers the available settings in more detail.
Telegram requires the appropriate administrator rights for restricting members and for approving requests. A visible challenge does not establish that the posting restriction succeeded. Test a harmless message before answering as well as after. The Bot API permission model distinguishes those operations.
A worked policy for a contributor community
Consider a hypothetical open-source support group. Newcomers need to paste short errors, link to documentation and occasionally attach screenshots. The observed abuse is immediate promotion of unrelated paid services.
The moderators start with an in-group check and retain the content types needed for support. They write down a useful first action: “Describe what you expected, what happened and which version you are using. Remove tokens and private information before sharing logs.” A welcome points to that instruction; it does not substitute for verification.
A tester passes the challenge but cannot send a screenshot. The moderators inspect default group permissions and discover an older media restriction. Increasing CAPTCHA difficulty would not fix that failure. Once the permission is corrected, they repeat the whole route instead of declaring success from the challenge screen alone.
If an admitted account later posts an unsolicited sales pitch, they review the message-filter policy. Being new is relevant to the entry workflow; it is not sufficient evidence of malicious intent. A missing profile picture, unfamiliar display name or quiet account does not justify exclusion by itself.
Include bypasses and failures in the test
Use a genuinely new ordinary member for the first test. Returning accounts with an existing group role and people added by a privileged administrator may take an exempt path. Test them separately, rather than using an administrator’s rejoin as proof that all newcomers are protected.
- Try posting before answering, then confirm the expected restriction.
- Pass the check and send normal text plus a content type the community needs.
- Let a challenge expire and inspect the actual sanction.
- In request mode, test approval, failure and ban if you intend to use it.
- Repeat entry through every invitation route still in circulation.
- Verify the help contact from outside the group.
Write the expected result before running each case. “The member can post an ordinary question and a documentation link after passing” is testable. “The bot looks active” is not an acceptance condition.
Also test the transition after a settings change. Record the old mode, the invitations you changed and who will review pending requests. An orderly handover prevents people already waiting from disappearing between a manual and an automated process.
Give legitimate members a recovery path
Determine whether the person is awaiting approval, was rejected, was removed, is muted or is banned. Ask for the approximate time and the message they saw. Identity documents and account credentials are not needed to diagnose an ordinary group restriction.
A pending application needs an admission decision. A mistaken mute or ban needs the corresponding restriction removed. Turning CAPTCHA off does not reverse sanctions already applied. Use the relevant moderation action, then check both entry and ordinary posting.
If several real people get stuck, return to a known, understandable configuration and adjust one cause at a time. Review missed spam alongside failed joins and requests for help. The policy is working when normal members can complete the journey and moderators can explain and correct mistakes, not merely when a challenge appears.
Sources and scope
Checked on October 5, 2026. Defendy's CAPTCHA guide covers entry checks, temporary restrictions, restored permissions and failure actions. Telegram’s ChatPermissions reference defines the platform controls. The contributor community is hypothetical; the test plan is a procedure for administrators, not a claim of a live editorial Telegram test.
