How to Stop Facebook Page Spam and Phishing Messages With Keyword Filters

"Your Page has violated our Community Standards and will be deleted within 24 hours. Appeal now." Few people who run a Facebook Page have never received a message like this. Facebook Page spam messages are no longer just an annoyance: many entrepreneurs have fallen into this trap and lost Pages built over years. The good news is that the Meta Business Suite inbox has a simple defence. If a message contains certain keywords, it can be moved to the spam folder automatically. Sultan Muhammad Rashed has long advised setting this up on his own Pages and his clients' Pages. This guide covers the full method, a ready-made keyword list and extra security advice.

Why Facebook Page spam and phishing messages are dangerous

Phishing means tricking someone into handing over a password, login code or personal information. The messages Page admins receive follow almost the same pattern:

• Fear: threats that the Page will be deleted, restricted or disabled.
• Urgency: words such as "now", "final warning" or "within 24 hours" so you don't stop to think.
• Fake identity: names like "Meta Support" or "Facebook Team", or a blue-tick profile picture, on what is really an ordinary account or Page.
• A link: an "appeal" or "verification" link that looks like Facebook but leads to another website.

Enter your login details there and the scammer gets into the account, makes themselves an admin and removes the real owner. Meta's own safety guidance repeats the same advice: never enter login details through links in unknown messages, and report suspicious messages.

Real notifications versus fake messages

An easy rule to remember: if you suspect a problem with your Page, don't follow the link in the message. Open the Facebook app or business.facebook.com yourself and check there.

How to set up a keyword filter in Meta Business Suite

As of November 2026 this is done from the "Automations" section of the Meta Business Suite inbox. Meta occasionally renames and rearranges menus, so the wording on your screen may differ slightly.

1. Open business.facebook.com in a computer browser and select your Page.
2. Open Inbox from the left-hand menu.
3. Click the lightning-bolt Automations icon near the top.
4. Click Create automation. In the template list, choose the template that moves messages to spam or junk under message organisation. If you can't find it, choose Start from scratch and set the trigger to New message received with Keywords.
5. Choose which platform's messages it should act on: Messenger, Instagram or both.
6. In the keyword box, paste the words from the list below, separated by commas.
7. Set the action to Move to spam, then save and turn the automation on.

Always test after saving

Some templates say "contains all of the following keywords" in the keyword box, which means the rule only fires when a message contains every word on the list. In that case a long list is effectively useless. So send your Page a message from your personal account containing "page restricted". If it lands in spam, the filter works. If it doesn't, create separate short automations for each important phrase, or pick an "any" option if one is offered.

A keyword list you can copy

Here is the list Sultan Muhammad Rashed uses for his own Pages, cleaned up and grouped by type. Add or remove words as you need.

Page deletion and policy threats: page notification, page verification, verify your page, page will be disabled, your page is scheduled for deletion, page restricted, account restricted, account disabled, your page has been flagged, final warning, immediate action required, avoid page deletion, copyright violation, copyright report, trademark violation, community standards violation, policy violation

Fake support identity: meta support, facebook support team, meta team, official meta warning, meta business support, facebook business help, support inbox, help center message

Login and payment traps: security alert, suspicious activity detected, confirm your identity, verify now, appeal now, submit appeal, click to verify, confirm account, unauthorized login, unusual login attempt, reset your password now, ad account disabled, ads account suspended, billing issue, confirm payment method

Money and prize bait: free money, earn money fast, investment offer, crypto investment, bitcoin offer, instant loan, win prize, congratulations you won, prize claim, giveaway scam

Service-selling spam: buy followers, cheap followers, increase followers fast, hacking service, backlink offer, guest post, link exchange, seo spam

Others: casino, betting, gambling, dating link, telegram me, whatsapp me, dm me now, limited offer now, bit.ly, tinyurl

You can also add abusive words, threats written in Bangla (for example the Bangla for "your Page will be closed" or "submit an appeal") and any new phrases that keep showing up on your Page.

Think before adding these words

Common words like http, https, www, click here, make money online or offer will catch almost all spam, but a customer who sends a product link or asks "any offer?" will also land in spam. If you sell online, leave these words out, or make a habit of checking the spam folder regularly.

Block comment spam too

The same kinds of links also appear in post comments. Your Page settings have a moderation section where you can hide comments containing specific words. Add the main words from the list above. Those comments then stay hidden from the public, which also protects your followers from being scammed.

Security you need beyond the filter

A keyword filter is only the first wall. Scammers change their wording all the time, so keep these habits too:

• Two-factor authentication: keep it on for every Page admin's personal account. An authenticator app is safer than SMS.
• Keep the admin list short: give each person only the access they need, and remove former staff and agencies.
• Don't reply: replying to spam tells scammers the account is active and brings more messages. Report and block instead.
• Weekly review: spend 15 minutes a week on the spam and message request folders, rescue any customer messages caught by mistake and add new spam words to your list.
• Check logged-in devices: in security settings, see where you are logged in and log out unknown devices.

For sellers who run their business through a Facebook Page, a mixed-up inbox of customer messages and spam also means a higher risk of missed orders. That is why many entrepreneurs now handle orders, couriers and a team inbox from one place; on eCommerce Autopilot, for example, Bangladeshi online shops can manage these tasks together.

What to do if your Page gets hacked

If you entered details on a phishing link, don't waste time. Change your password right away, turn on two-factor authentication, remove unknown logins and check whether anyone new has been added to the Page's admin list. If you can't log in, use Facebook's official hacked-account recovery process. Stay away from "recovery experts" who promise to get your Page back for a fee; they are often scammers too.

Final word

You can't stop Facebook Page spam messages completely, but a keyword filter, two-factor authentication and careful habits together cut the risk a great deal. Take 10 minutes today to switch the automation on, send a test message to check it, and share this guide with your Page's other admins.