Accepting contributor and reader submissions safely

Contributor and reader submissions widen your coverage and add risk. You gain voices you do not employ, and you take on the job of checking, labelling and moderating what they send. The CMS controls much of this through roles, queues and moderation tools, but the policies behind it are editorial. This guide covers the setup and the decisions around it. We have not tested submission workflows in every system, so use the checks here to test your own.

Who should be allowed to do what?

Start with roles. Decide who can write, who can review and who can publish, then map those to the roles your CMS offers.

WordPress documentation gives a clear example of a graduated set. It describes the Contributor as somebody who can write and manage their own posts but cannot publish them, the Author as somebody who can publish and manage their own posts, and the Editor as somebody who can publish and manage posts including those of other users. Other systems use different names, and many allow custom roles with finer permissions.

A sensible default for a news site looks like this:

Check that the CMS can enforce the boundary. Create a test contributor and try to publish. See how to evaluate the editor experience.

How should a review queue work?

A review queue is a list of submissions waiting for a decision. It should show who submitted each piece, when, its status and who is looking at it.

A workable flow has five steps:

1. Submit. The contributor saves a draft and marks it ready.
2. Triage. An editor accepts it for editing or declines with a reason.
3. Edit. Changes are tracked through revisions, so the contributor can see them.
4. Check. Facts, links, images and disclosure are verified.
5. Publish. An editor schedules or publishes, with the right byline and author record.

Look for revision history and clear status labels. If your CMS has no built-in workflow states, ask whether an add-on provides one, and check how plugins work before depending on it.

Give contributors written guidelines covering length, sourcing, image rights, conflicts of interest and what you will edit. Link them from the submission page.

How do you control spam?

Anything the public can type into is a target. Google’s spam policies define user-generated spam as spammy content added to a site by users through a channel intended for user content, such as forums and blogs. Comments, guest-post forms and profile pages all qualify.

The usual layers:

• Moderation by default for new accounts, with approval before anything appears.
• Rate limits on submissions and registrations.
• Filtering for known spam patterns and link-heavy messages.
• Challenges such as a simple verification step on public forms.
• Clean-up tools to delete a spammer’s entire history in one action.

Check what your CMS provides natively and what needs an add-on. Every public form is also a security surface, which is another reason to keep plugin lists short.

How should you handle links in contributed content?

Links are the most abused part of any submission. Google’s spam policies define link spam as creating links to or from a site primarily to manipulate search rankings, which includes buying or selling links.

Its guidance on outbound links names three values for the rel attribute:

• sponsored for advertisements or paid placements, commonly called paid links.
• ugc for user-generated content links, such as comments and forum posts.
• nofollow for cases where other values do not apply and you would rather Google not associate your site with, or crawl the linked page from, your site.

Values can be combined. A practical rule is to apply ugc automatically to links in comments and reader submissions, and sponsored to any link in a paid post. Check whether your CMS does this by default. If it does not, a plugin or template change may be needed.

Editors should also read the links. Automated attributes limit the effect on search, but they do not stop a contributor pointing your readers at something harmful.

How do you disclose sponsored and paid posts?

Search attributes and reader disclosure are different obligations. The rel value tells search engines about the link. Readers need to be told about the commercial relationship in plain words.

The US Federal Trade Commission’s guidance says that if there is a connection between an endorser and the marketer that a significant minority of consumers would not expect, and that would affect how they evaluate the endorsement, the connection should be disclosed clearly and conspicuously. That guidance is American and aimed at endorsements, so check the rules where you publish. It is still a good test of what to do.

For a sponsored post, that means:

1. A visible label near the top, such as who paid.
2. A distinct design or section, so readers do not confuse it with news.
3. rel="sponsored" on commercial links.
4. A clear internal policy about who may buy placements and what they cannot influence.

Make the label a field in your CMS, so it prints automatically and an editor cannot forget it. See reading CMS reviews critically for how the same principles apply to affiliate content.

What belongs on the submission page?

Keep the form short. Ask for the author’s name and contact details, a pitch or draft, relevant conflicts of interest, and agreement to your terms. State what you pay, if anything, who owns the rights and how long you will take to reply. If you accept reader submissions, say whether you moderate before publishing.

What should you check in a CMS before you commit?

Add these to your feature checklist: custom or graduated roles, a status workflow, revision history with authors, comment and form moderation, automatic rel attributes on user links, and a field for sponsorship labels. For the broader structure behind bylines and author pages, see organising content.