What is review moderation for?
A review arrives that makes you hesitate. It has a swear word in it, or a customer's phone number, or it names the person who served them. Maybe it is just harsh. Review moderation is the decision you make at that moment: publish it, publish it with a change, or keep it off the page.
The decision is easier with one test. Ask what is wrong with the content, and ignore the stars. If the problem would be a problem in a five-star review too, such as spam, a phone number or a threat, hide it. If the only problem is that the customer is unhappy, publish it and answer. In the US, the FTC's rule on consumer reviews allows hiding only for reasons of that kind, and our article on the FTC fake reviews rule goes through them.
The list in the rule is short, so it is worth having in front of you. Section 465.7(b), read on 7 November 2026, does not count a review as suppressed when it is held back under criteria applied to every review alike and it contains trade secrets or confidential business information; defamatory, harassing, abusive, obscene, vulgar or sexually explicit content; someone's personal information or likeness; content that is discriminatory about race, gender, sexuality, ethnicity or another intrinsic characteristic; or content that is clearly false or misleading. Reviews you reasonably believe are fake, and reviews wholly unrelated to what you sell, are also on the list. A low rating is not.
Ten reviews: hide or keep?
Here is the test applied to ten common kinds of review.
| Review | Decision | Why |
|---|---|---|
| One star: “Took three weeks to arrive and nobody answered my emails.” | Keep and reply | An honest complaint about a real order. Hiding it is the thing the rules forbid. |
| Three stars: “It's fine. Nothing special.” | Keep | A lukewarm opinion is still an opinion. |
| Two stars, with a swear word about the packaging | Keep, mask the word | The complaint is real; the word is the only problem. |
| Four stars: “Sarah at the till was rude, but the bread is great.” | Keep | Criticism of staff by first name or role is part of the experience. |
| Five stars, with the reviewer's phone number in the text | Hide: personal data, then ask them to resend | The rating is fine; the number should not be public. |
| Five stars from a name that is a website address | Hide: spam | An advert dressed as a review, whatever the rating. |
| The same review, sent twice a minute apart | Hide the copy: duplicate | One customer, one review. |
| One star: “Worst plumber in town”, on a bakery's page | Hide: not about your business | Meant for someone else. |
| A threat against a named employee | Hide: threats or harassment | Remove it whatever the rating, and keep a copy. |
| Five stars from your cousin, who never bought anything | Hide: spam or fake | Not a customer, so not a customer review. |
Two of these need a little more thought. The staff review stays because the customer is describing what happened to them; the threat goes because it is no longer about the shop but aimed at a person. And the cousin's review goes for the same reason a paid one would: it was not written by a customer. In the US, reviews from staff and relatives are a matter for the FTC rule too, which is why a short note to your team saying "please don't review us" is worth sending.
What about photos, discounts and accusations?
A few reviews don't fit the ten above. These five take a bit more thought.
| Review | Decision | Why |
|---|---|---|
| Five stars: “Got 10% off for leaving this, but I'd have said it anyway.” | Keep, and make the incentive visible | It's a real review. Say that a discount was given, though: the FTC says leaving that out can break the FTC Act, and in the UK a review that hides an incentive is banned. |
| Two stars: “Same kettle is cheaper and faster from the shop down the road.” | Keep | Comparing you with another shop is still a review of your kettle. It only goes if it reads like an advert for them. |
| One star: “The driver stole a parcel from my porch.” | Keep and reply, unless you can show it is false | If a delivery photo or a tracking record shows otherwise, it can go as clearly false. If you have nothing, it stays and you reply. |
| Four stars, with a photo of the customer's bank card next to the product | Hide: personal data, then ask for a new photo | Nothing wrong with the review. The card number just can't be public. |
| Three stars, with a photo of a cracked lid | Keep | That photo is the most useful thing in the review. |
The parcel one is the hardest. Section 465.7 lets you withhold defamatory or clearly false content, but you are the one judging a claim about your own business, so "clearly" has to mean something you can show. With a record that shows it did not happen, hide it, note why, and keep the record. Without one, the review stays, and your reply is where you tell your side.
Can you edit a review instead of hiding it?
Do not rewrite a customer's words. Changing what a review says, even to fix spelling or soften it, turns it into your text with their name on it. The exceptions are mechanical: masking a swear word with stars, or removing a phone number, where the reader can see that something was taken out.
When a review breaks a rule in one sentence and is useful in the rest, the cleanest fix is to hide it and ask the reviewer to send it again without that sentence. Tell them which part was the problem, so they know what to leave out.
Should you write a moderation policy?
Yes, and it can be five lines. List the reasons you hide reviews, say that the same reasons apply to every rating, and keep it somewhere your team can find it. When a customer asks why their review is not up, you can point to the reason instead of improvising one. Putting the same lines where shoppers can read them, under the reviews or on your FAQ page, costs nothing and answers the suspicion that you only show the good ones.
If you sell to customers in the EU, the Omnibus Directive also expects you to tell shoppers whether and how you check that reviews come from real buyers. Our article on the Omnibus Directive and verified reviews has wording you can copy.
The UK is stricter about how you display what you keep. Paragraph 13 of Schedule 20 to the Digital Markets, Competition and Consumers Act 2024 bans publishing consumer reviews "in a misleading way", and the examples it gives include "failing to publish, or removing from publication, negative consumer reviews whilst publishing positive ones" and "giving greater prominence to positive consumer reviews over negative ones". It also expects whoever publishes reviews to take "reasonable and proportionate steps" to keep fake ones out and to remove them.
Decide, too, who publishes and how fast. Approving every review by hand gives you the most control, but a review that waits two weeks for someone to look at it is a review the next shopper never sees. Publishing at once and hiding later is faster but puts the occasional spam online for a while. Pick the one you can keep up with.
How many reviews does Formgong hide?
Very few, and the numbers are small, so read them as a picture rather than a benchmark. On 6 November 2026 we counted, read only, the reviews on the 8 sites we run ourselves, our demo shops and test sites. There, 10 of 169 reviews are hidden, 6 are waiting and 153 are published. Of the 153 published, 47 are 1 or 2-star reviews, kept like the rest. For 5 of the 10 hidden reviews we can still read the reason: 3 were our own test reviews, 1 was marked as spam or fake, and 1 had already been hidden in the app it was imported from. The reasons for the other 5 are stored in each site's own review store, which we do not query in bulk.
Small numbers like these are why this page leans on the rules and the cases rather than on our averages.
How does moderation work in Formgong?
You pick one of four publishing modes per site: approve each review yourself, publish star ratings at once and check written reviews, publish everything at once, or, on the Pro plan, let an AI check publish reviews that pass. None of them filters by stars. The AI check is never shown the rating, holds written text only for spam, abuse, personal data or text about something else, and is told to publish criticism of staff by role or first name like any other review.
Hiding asks for one of six reasons: spam or fake, duplicate, not about your business, personal data, threats or harassment, or test. The list is the same for every rating, and only test, spam and duplicate reviews can be deleted outright, so an honest bad review can never quietly disappear. Rude words are masked on your website by default, shown as the first letter and stars, and the review is still published. In the modes that publish on their own, only three reviews a day from one visitor go out at once. Photos and videos are moderated with the review. In the AI mode each photo is checked too and held only for nudity, violence, an identity or bank document, advertising such as a QR code, or an image unrelated to a purchase, while a photo of a broken or faulty product is published like any other. In that mode a review with a video always waits for you, because the check cannot look at video. Visitors can report a review under it, and you see the count. The moderation docs show each screen, and our article on the benefits of negative reviews makes the case for keeping the low ones.
Which review made you hesitate?
If you have a review you were not sure whether to hide, send it to support@formgong.com with the names taken out. If it is a case this page does not cover, we will add it to the table.
Frequently asked questions
What is review moderation?
Deciding which customer reviews go public: publishing them, masking part of one such as a swear word, or hiding one that breaks a clear rule.
Can I hide negative reviews?
Not for being negative. Hide a review for its content, such as spam, a fake, personal data or threats, and use the same reasons for every rating.
Should I approve reviews before they go live?
If you can check them within a day or two, yes. If reviews would wait for weeks, publish at once and hide the few that break your rules.
Can I edit a customer's review?
Only mechanically, such as masking a swear word or removing a phone number. Do not change what the customer said; hide it and ask them to resend instead.
Which reviews does the FTC rule let you hide?
Ones with confidential information, defamatory, abusive or explicit content, personal data, discriminatory or clearly false content, fakes, and reviews unrelated to what you sell, if you apply that to every rating.
Sources and documentation
Official references for this guide: Formgong: What the FTC fake reviews rule bans. Moderate reviews, where data is stored.
Related guides
- Lovable form submissions to email and Telegram
- HTML contact form without a backend: a working example
- How to send website form submissions to Telegram
- Contact form not sending email? Check where it stops
- Managing website leads in Telegram without a CRM
- Form backend for Lovable, Bolt, v0, Cursor
- Telegram bot for a contact form: build or skip?
- GDPR form backend: 7 checks before you choose
- Lovable form not sending email? 6 fixes
- Netlify Forms not working? React and Bolt fixes
- Stop contact form spam without a CAPTCHA
- GitHub Pages contact form: a working setup
- Mailto Form in HTML: Why It Fails and What to Use
- HTML form to Google Sheets: 2 free methods
- Webflow form submission limit: what to do at 50
- Turnstile vs reCAPTCHA vs hCaptcha for forms
- Contact Form 7 and Elementor forms to Telegram
- Squarespace contact form not sending email?
- Shopify contact form: where do messages go?
- Google Form to Telegram: free Apps Script way
- Wix contact form not sending email? Fixes
- EU / GDPR Formspree alternatives compared
- HTML form action attribute explained
- How do HTML forms work? The HTTP request
- Types of Injection Attacks on Web Forms (2026)
- Indirect Prompt Injection in MCP
- MCP Rug Pull Attack: Detect Tool Changes
- Form without a backend: 7 ways that work
- Thank-you page after form submission (HTML)
- Indirect Prompt Injection Examples (2023–2026)
- Indirect Prompt Injection via Email
- What Is Tool Poisoning in MCP?
- WordPress contact form without a plugin
- Send email from frontend JavaScript
- How to Prevent Indirect Prompt Injection
- Honeypot Form Field: How to Add One That Works
- Contact Form with File Upload (HTML, No PHP)
- Angular contact form without a backend
- Send form submissions to Slack or Discord without Zapier
- Verify a form webhook signature (HMAC-SHA256)
- Contact forms that send nothing: 793 AI-built sites tested
- v0 contact form that actually sends: 3 ways
- How we tested AI-built contact forms, and 12 bugs we hit
- Cloudflare vs Netlify free plan: hosting that never pauses
- EmailJS 412 “Gmail_API: Invalid grant”: reconnect Gmail
- Resend “You can only send testing emails”: verify a domain
- Supabase Edge Function blocked by CORS policy: 3 causes
- Formspree “Form not found” and other errors: fixes
- Web3Forms errors: “Invalid access key” and 403 explained
- How to add customer reviews to your website for free
- Getform not working? “This form has been deleted” and more
- Next.js contact form not working? 6 errors, reproduced
- Webflow form not sending email? What to check, tested
- FormSubmit not working? “This form needs Activation” fix
- Contact form “TypeError: Failed to fetch”: causes and fixes
- WooCommerce product enquiry form
- Contact Form 7 vs WPForms
- Gravity Forms alternative free
- WordPress contact form block
- 535-5.7.8 Username and Password not accepted (Gmail)
- 535 5.7.3 Authentication unsuccessful: Office 365 SMTP
- Nodemailer “Missing credentials for "PLAIN"”: the fix
- Nodemailer “Greeting never received”: port 465 fix
- Nodemailer SSL “wrong version number”: the port fix
- Nodemailer “self-signed certificate in certificate chain”
- Nodemailer ECONNREFUSED 127.0.0.1:587: missing SMTP host
- SendGrid “authorization grant is invalid”: 401 fix
- Mailgun 401 Forbidden: why the API rejects your key
- “Edge Function returned a non-2xx status code”: the fix
- Next.js “Body exceeded 1 MB limit”: Server Action fix
- Unexpected token '<', "<!DOCTYPE "... is not valid JSON
- “TypeError: Body is unusable”: body has already been read
- Turnstile “timeout-or-duplicate” and other siteverify errors
- Turnstile vs hCaptcha vs reCAPTCHA: speed and size tested
- Judge.me reviews not showing on Shopify: how to fix it
- Judge.me review carousel not showing: how to fix it
- Yotpo reviews not showing on Shopify? Check the app embed
- Loox reviews not showing on product page: how to fix
- Shopify reviews not showing: what to check first
- How to show reviews on Shopify
- GDPR for website forms: what each type of form needs
- WooCommerce reviews not showing: how to fix it
- Stamped.io reviews not showing on Shopify: how to fix it
- Etsy reviews not showing: why and what to do
- Trustpilot widget not loading: how to fix TrustBox
- Yotpo problems in 2026: what merchants report
- Contact Form 7 “error trying to send your message” fix
- Elementor form “Your submission failed because of an error”
- Framer form not sending email or not working: what to check
- Carrd contact form not working: plans, spam and errors
- Google review link not working: what customers see and why
- tawk.to widget not showing on your website: causes and fixes
- How to add questions and answers to your product page
- “Failed to send a request to the Edge Function”: fixes
- Next.js “Failed to find Server Action”: what it means
- Brevo “unauthorized: Key not found” 401: the fix
- Amazon SES “Email address is not verified”: the fix
- Shopify contact form not working: how to fix it
- Judge.me alternative for WooCommerce after the 2025 shutdown
- Free WooCommerce review plugins compared on the free version
- WooCommerce review reminder emails without a paid plugin
- Add Voice Recording to a Website Form
- Contact Form 7 spam: how to stop it
- WPForms not sending email: how to fix it
- Contact form emails going to spam: how to fix it
- HTML form not submitting: how to fix it
- Contact form not working: how to find the fault
- Webflow form spam: how to stop it
- Website form to Notion: how to set it up
- Website form to WhatsApp: what works and what does not
- What 1-star reviews say about AI support chatbots
- Which free form backend gives you the most submissions?
- Elfsight reviews widget not showing? Check the view limit
- Next.js contact form backend vs Server Actions
- Review stars not showing in Google search results
- How to stop duplicate form submissions
- How to see which form leads came from ChatGPT
- What happens when a form webhook fails
- When to send a review request email after an order
- How to collect video testimonials for free
- Add contact form sign-ups to Mailchimp or Klaviyo
- How to migrate from Formspree without losing submissions
- How to get a Google review link for your business
- What is a headless form backend?
- Is it safe to put a form access key in your HTML?
- AI chatbot that answers only from your website
- Minified React error #441 in Next.js
- Squarespace product reviews after Judge.me
- Accessible contact form checklist for WCAG 2.2
- How to ask a client for a testimonial by email
- How to respond to negative reviews, with examples
- 429 Too Many Requests on a contact form
- MCP server for forms in Cursor and Claude
- Can you offer a discount for a review?
- Do EU stores have to say if reviews are verified?
- Webflow form backend options compared
- How to add review schema JSON-LD to a product page
- How to turn a customer review into an Instagram post
- How to make a QR code for Google reviews
- Live chat or chatbot for a small business website
- Why people abandon your contact form halfway
- Which form backend do AI assistants pick? 54 answers
- PHP mail() not sending email, even when it returns true
- What “Failed to fetch” means, tested in three browsers
- 405 Method Not Allowed when you submit a form
- Send a contact form to more than one email address
- What is review syndication, and who needs it?
- How to save HTML form data to a database
- NetworkError when attempting to fetch resource
- Send product reviews to Google Merchant Center
- PHPMailer not working on a live server
- AI review reply generator: does it help?
- React 19 contact form with useActionState
- Astro Actions or a form backend?
- Is no-reply@wixsiteautomations.com legit?
- Where to find the Judge.me review widget code
- AI review summaries: what shoppers actually see
- Photo reviews for WooCommerce, and the GPS inside them
- Review request email templates you can copy
- Reviews in AI search: what ChatGPT and Perplexity cite
- Lead capture form with UTM tracking, built and tested
- Form design best practices, with our own form data
- Client intake form template with file upload
- What is social proof? Meaning and examples
- What is user-generated content (UGC)?
- Benefits of negative reviews for your store
- How to get your first reviews as a new store
- How to use customer reviews in your marketing
- How to get more customer reviews
- React form validation without a library, tested
- jQuery submit form with validation
- reCAPTCHA v3 setup with the server score check
- Shopify social proof that shoppers can check
- HTML file input: accept, multiple, capture and size checks
- How to add hCaptcha to a form, with the server check
- How to add invisible reCAPTCHA to a form
- Bug report form template with browser details
- What the FTC fake reviews rule bans for online stores
- How to show reviews on your homepage
- Do reviews increase sales? What the studies show
- HTML input types and what each one sends
- HTML textarea, tested in a real form
- HTML dropdown menu in a form, tested
- Do reviews help SEO? What Google says and shows
- How to add a review carousel people can read
- Product review examples that help shoppers decide
- Which trust badges actually mean something
- Customer satisfaction survey with CSAT and NPS
- JavaScript FormData and what fetch actually sends
- JavaScript form validation without a library
- Server-side form validation and what it catches
- Email validation in JavaScript, tested on 33 addresses
- Zod form validation with FormData, tested
- Store reviews vs product reviews
- How to send review requests through Klaviyo
- How to tag customer reviews by topic and mood
- Custom review form questions worth asking
- Online reputation management for small businesses
- HTML radio button groups and what they send
- HTML label tag and what screen readers hear
- HTML autocomplete attribute, tested with Chrome autofill
- HTML fieldset and legend, and what disabled leaves out
- HTML button tag and what a form button sends
- Vite contact form that still works after the build
- How to test a contact form, end to end
- How to embed a Google Form, and what it loads
- Customer feedback questions that get real answers
- How to convert a file to base64 in JavaScript
- FilePond with a form backend, and when to skip it
- Bootstrap form validation and server errors
- Tailwind form validation, tested in three browsers
- Donation form in HTML, and where the payment goes
- How to ask for a review in person or by text
- Which review sites matter for your business
- What are customer reviews, and which kinds count
- Online review statistics, checked at the source
- Best review app for Shopify and WooCommerce
- Why Gmail sends your self-hosted mail to spam
- htmx contact form that sends to another domain
- AI form builders tested, from prompt to sent form
- Headless WordPress forms with Contact Form 7, tested
- React Hook Form watch vs useWatch, and what gets sent
- Elfsight widget not working? It vanishes when views run out
- Jotform not sending emails? Check Jotform's bounce list
- Typeform not working? A white box means a blocked script
- Positive review response examples that don't sound copied
- How to remove a Google review when you can't delete it
- Google reviews not showing up? 8 causes to check in order
- Is buying Google reviews illegal? Even a review swap counts
- Average star rating: what 4.8 from 5 reviews means
- Reviews on a product page: where and how many to show
- SaaS testimonials: 3 of 27 had a number in them
- Do reviews reduce returns? Not when they're too good
- Testimonial examples for business: what makes one believable
- Testimonial questions to ask clients, by type of business
- Testimonial page design: a page or a section?
- Testimonial advertising rules: what the FTC requires
- Form submission canceled because the form is not connected
- Input type date format dd/mm/yyyy: what you can change
- How to disable textarea resize, or allow only vertical
- How to prevent Enter from submitting a form
- form.submit() vs requestSubmit(): what submit() skips
- Custom HTML checkbox CSS that doesn't break required
- How to reset a form after submit, and what reset() keeps
- Input type number maxlength not working? What to use
- How to create an HTML form, step by step
- Best form builder: free plans and branding, checked
- Best WordPress contact form plugin: 10 free ones compared
- How to increase form conversion rate: start with the count
- Form backend vs form builder: which one do you need?
- WordPress contact form not sending email? 3 plugins tested
- Contact Form 7 webhook? Turning it on switched our email off
- Gravity Forms webhook: what it sends and the URLs it rejects