Writing AssistantPlenty of people have something worth saying and stall before they say it. The support question that arrives as "it's broken, help". The reply that reads angrier than it was meant to. The topic somebody starts three times and abandons. Writing Assistant puts a button in the post editor, next to bold and italic. It fixes what is already written, and it drafts from a sentence when there is nothing written at all. Seven ways to improve what is thereFix spelling & grammar Corrections only. It will not quietly rewrite somebody's voice while it is in there. Improve writing Clarity and flow, keeping their vocabulary and register. If they write plainly, it stays plain. Make it shorter Cuts padding and repetition without dropping a point, a question or a caveat. Add detail Develops what is already there. It cannot introduce facts that were not. Friendlier tone Removes the sarcasm and keeps the disagreement. It will not water down what somebody is actually saying. More professional Raises the register without turning it into a press release. Summarise A long post down to its key points. And two for the blank pageThe member writes a sentence about what they want to say, and gets a draft to edit. Ask a better question is the same idea pointed at your support forum: it turns a vague complaint into something your community can actually answer. It marks what it does not know instead of inventing it. Every assistant of this kind fills gaps with plausible specifics — a version number, a price, an error message nobody ever supplied. On a forum that means members posting confident details that are false, and your staff correcting them. This one writes [your IPS version], [paste the error here], [what you have already tried], and tells the member the draft has gaps to fill. A draft with three placeholders is useful. A draft with three fabrications is a trap. It cannot damage a postQuoted text, code blocks and mentions are removed before the request and put back afterwards. The model never sees them, so it cannot alter them. If one does go missing, the member is warned before they can replace anything. Nothing is applied without the member pressing Replace. They see the result first, can compare it against the original, and can retry. Every change goes through the editor's normal undo. You decide what it costsMonthly cap A hard stop in dollars. When the month's estimated spend reaches it, the assistant pauses until the month rolls over. This is the setting that means one member cannot hand you a bill. Daily limits Per member and across the whole site, measured over a rolling 24 hours rather than a calendar day — so somebody who runs out at 11pm is not handed a fresh allowance an hour later. Length limits Nothing is spent rewriting four words, and nobody pastes a novel in. Per group Set globally, and again per action. Let everybody fix their grammar; keep drafting for members who have earned it. Spend is an estimate, not a bill. It is calculated from published token prices for models it recognises. A self-hosted model shows as zero, which is accurate — but so does an unrecognised commercial one, and for that the cap cannot protect you. Set a budget limit with your provider as well. The instructions are yours to changeA support forum and a fiction workshop want opposite things from "improve writing". Every instruction is editable in the AdminCP, including the shipped ones, and your edits survive upgrades. You can add your own actions too, with their own icon and group restrictions. Shared safety rules — never invent facts, return only the text, preserve quotes and code — are applied automatically and cannot be removed by editing an action. Reporting that tells you somethingCalls and spend, broken down by action and by member. The number worth watching is how often members keep the result rather than cancelling. Call counts only prove the button is being pressed; a low kept-percentage on one action means its instruction needs retuning, and you can go and retune it. Your key, your dataWorks with Anthropic, or anything speaking the OpenAI chat-completions shape — including self-hosted gateways such as Ollama, vLLM, LiteLLM and OpenRouter. Set the base URL and nothing leaves your network. Members' drafts are not stored. The log records which action ran, when, by whom, and the token counts — not the text. There is a setting to keep it temporarily while you tune a prompt; it is off by default. Already running AI Assistant or Guardian? It will reuse that key rather than making you paste a second copy. RequirementsInvision Community 5.0 or newer (self-hosted) An API key from your chosen provider, or a self-hosted endpoint Outbound HTTPS from your server No account with me, no service of mine in the middle, no per-request fee. You pay your provider directly for what your members use.

Backup & RestoreInvision Community ships with no backup of any kind. The only thing it does is ask you to tick a box confirming you have made one — immediately before an upgrade, which is the single most dangerous thing the software does. The usual advice is "just run mysqldump". On a correctly configured server you cannot. Invision Community's own Configuration Error notification tells administrators to disable exec, shell_exec, passthru, popen and proc_open. Take that advice, as you should, and every shell-based backup tool stops working. This is pure PHP. No shell, no mysqldump, no external binary. It works on shared hosting, in a container, and on a hardened server where nothing can be executed. It reads every backup backA backup nobody has ever opened is not a backup — it is a file you are hoping about. After writing an archive this one reads it again, from the beginning, and checks: the compressed stream decompresses whole, without truncation; the end-of-file marker is present, which is what proves it was not cut short; the SHA-256 checksum matches what was written; every table is present, and every table's row count matches. Only then is it marked verified. A backup that fails any of those is marked failed and — importantly — never counts towards your retention limit, so a good archive is never deleted to make room for a broken one. It tells you when a backup is not a snapshotWhere the database is small enough to finish in one request, the dump runs inside a single transaction with a consistent snapshot: every table as it was at the same instant. Where it is too large, the work is queued across requests — which means the first table is read minutes before the last, while people are still posting. Both kinds are labelled, on every row. A staged backup can contain a reply whose topic is missing. That is a real limitation of any backup taken this way, including mysqldump without --single-transaction, and you are told which kind you have rather than left to assume. Somewhere other than the server it is protectingA backup on the same disk as the community does not survive losing that disk. Archives are written above the web root where possible, so they cannot be requested over the internet at all — and can be sent to any storage you have already configured: Amazon S3, Cloudflare R2, Backblaze or FTP. If the parent directory is not writable and archives have to live under the web root, the application says so plainly on the screen rather than quietly hoping the filename is enough. RestoringOne table The case that actually happens: somebody deleted a forum. Restore that one table and nothing else — the rest of the community, including everything posted since, is untouched. The screen shows which tables have lost rows since the backup, so you can see what is missing before you touch anything. Everything Runs from a generated standalone script, not from a button. A full restore replaces the very tables the running request depends on — sessions, caches, the job queue — and doing that from inside the suite is how a community ends up unable to start. The script boots nothing, reads your configuration directly and survives its own work. The restore script is key-protected, refuses to run without an explicit confirmation, and refuses outright if the archive does not match the database it is pointed at — for example if it came from a different install, or before an application was added — unless you override it deliberately. Details that matter when it countsBinary data is hex-encoded, so blobs, attachments and anything with a NUL byte come back byte for byte rather than quietly corrupted. A legitimate zero stays zero in an auto-increment column, instead of being silently reassigned and breaking every row that pointed at it. Archives are portable. The dump is written as ordinary SQL that restores in any MySQL session, not only inside Invision Community. The schedule is measured from the last successful backup, not the last attempt — so a job that fails every night cannot keep satisfying the schedule while producing nothing. It survives its own restore. Restoring replaces this application's own records too; it rebuilds them by reading the archives back off disk, rather than reporting that you have no backups. RequirementsInvision Community 5.0 or newer (self-hosted) PHP with zlib, which every install already has A running task scheduler, for scheduled backups No shell access. No mysqldump. No external service.

Most of the people reading your community are not members of it. They arrive from a search result, read the answer they came for, and leave — and nothing about that visit is recorded, so you never find out which of your topics were the ones worth joining for. Convert does two things: it asks them to join at the moment they are most likely to say yes, and it tells you which pages actually worked. Ask at the right momentInvision Community's guest sign-up block is a static panel in the sidebar. It says the same thing to somebody who has just landed as to somebody who has read six topics and is scrolling to the bottom of a seventh. Convert puts the prompt where the visitor already is, and only when it makes sense: The reply box Where a signed-out visitor is told they need an account to reply. They have read to the bottom of a discussion and want to say something — the strongest moment the software has. Under the discussion At the end of the posts on a topic. Every page The foot of any page, including Downloads, Pages and Gallery. And only to the right people. Show it after somebody has read two pages, not one. Show it only to visitors who arrived from a search engine. Show it only in the forums where it makes sense. Show it at most twice a visit, so it never becomes wallpaper. "No thanks" is remembered. When a visitor dismisses a prompt it stays dismissed, for as long as you choose. Nothing is more likely to lose a reader than asking them the same question on every page after they have already said no. Then find out what actually workedEvery prompt is measured the whole way down: shown, clicked, joined, posted. Not just the click — the click is easy. The number that matters is at the bottom. What brings people in The pages people were reading when they decided to join, ranked. Usually a surprise, and usually the most useful screen here — it tells you what your community is actually good at before you write another word of copy. Where they came from Search, social, another site, or direct — recorded from the first page of the visit, so it survives them clicking around. Compare two versions Give two prompts the same test name and each visitor sees one of them, consistently, for their whole visit. Then read the two rows side by side. It counts the people who joined without being asked, too. That is the number every prompt is competing against, and leaving it out is how conversion reporting ends up permanently flattering. If forty people joined unprompted last month and three came through a prompt, you have learned something real. Honest about what it showsA rate with nothing behind it is shown as blank, not as 0%. "Never shown" and "shown a thousand times and ignored" are opposite findings, and printing zero for both hides the difference exactly when you need it. Impressions are counted on the server, as the page is built. Counting them with a script means an ad blocker can delete them, which quietly inflates every click rate you look at. Posting is tracked separately from joining. A prompt that produces accounts which never post has produced nothing, and the report is built so it can say so. What it collectsDaily totals per prompt — shown, clicked, dismissed. No row is ever written per visitor. The only per-person record is one row for each member who registers, so that the report can say which page brought them in; it is created at registration and belongs to a member you already have. The only cookie it sets exists to remember that somebody pressed "No thanks". Everything else rides the session Invision Community already keeps. RequirementsInvision Community 5.0 or newer (self-hosted) Registration open to guests, which is what there is to convert them to Nothing else. No account, no key, no external service.

Cohorts & RetentionInvision Community can tell you how many members you have and how many joined last month. It cannot tell you the thing that actually matters: of the people who joined in March, how many were still here in April? In June? That single question is the difference between a community that is growing and one that is churning while the registration counter goes up. The gridEvery row is everyone who joined in one month. Reading across shows how many of them came back one month later, two months later, and so on. Reading down a column shows whether the community is getting better or worse at keeping people — which is the number to watch after you change anything about registration, onboarding or moderation. Twelve months of history, on the day you install it. This reads data Invision Community has been keeping since your community started, so the grid is complete from the first build. Nothing has to accumulate first. Two definitions of "still here", because they answer different questionsSigned in The broad measure. Includes people who read without ever posting, who are the majority of any community. Answers: are they still turning up? Posted something The hard measure. Any content in any application — a forum reply, a file, a blog comment. Answers: did they become a participant, or just an audience? Both are worth looking at, and the gap between them is often the most interesting thing on the screen. It collects nothingThere is no tracker, no new logging and no external service. Everything comes from three things your community already stores: when each member registered, the record of which days they signed in, and the index of who posted what and when. Uninstalling removes only this application's cached grid. The grid is built in the background, never while you wait. Building it compares every member against their whole history, so it runs as a background job and stores the result. Opening the screen reads a small cached table — it does not recompute anything. Honest about what it showsPeriods that have not happened yet are left blank, not shown as zero. A cohort that joined last month has no month-6 figure. Printing 0%% there would read as "everybody left" when the truth is "we do not know yet", and that difference matters when you are deciding whether something is wrong. Month 0 is rarely 100%%. It is the month people joined, so anything missing is people who registered and never came back at all — one of the more useful numbers on the grid, and one most analytics never shows you. Activity dated before somebody joined is discarded. Imported members, merged accounts and hand-edited join dates all produce it. It is dropped rather than shown in a column nobody can interpret. Small cohorts are noisy. A cohort of nine people moves 11%% every time one person returns. The grid shows the underlying counts on hover for exactly this reason. AlsoWeekly or monthly cohorts. Weekly is worth using when you are measuring something specific — a launch, a campaign, a change to registration. Up to 36 periods across, though twelve is usually where the interesting part has already happened. No core files are edited. Upgrading Invision Community will not break it. RequirementsInvision Community 5.0 or newer (self-hosted) A running task scheduler, to build the grid in the background Nothing else. No account, no key, no external service.

Community Experts — freeInvision Community has a Community Experts feature. Members you name as experts get a badge on their posts in the forums they actually know about, and get an email when a question in one of those forums goes unanswered. It is Cloud only. On a self-hosted community it is switched off, and there is no setting anywhere that turns it on. This does not imitate that feature. It completes it.Almost all of Community Experts is already sitting in your installation, doing nothing: The badge The graduation-cap badge, its styling, and the follow-this-expert button are all core templates that already ship with your community. The email The "questions waiting for you" email — both the HTML and plain-text versions — is a core template. The unsubscribe link Core already knows how to handle it and which preference to change. The data Core already has the table that records who is an expert in which forum, and the member settings for opting out and being blocked. What is missing is the switch. Every one of those pieces is behind a check for the Cloud platform, so none of them can ever run. This application supplies what is missing and uses core's own badge, core's own email, core's own unsubscribe handling and core's own table. The practical result: what your members see is the real feature, not a lookalike. And because the assignments live in core's own table, a community that later moves to Invision Community Cloud finds its experts already in place. Named per forum, which is the whole pointSomebody who knows billing inside out is not an authority on off-topic. Experts are named per forum and the badge only appears where they actually are one — a badge that follows a member everywhere is worth considerably less than one that does not. Naming experts automatically, if you want toOff by default. When enabled, anyone who clears both of these tests in a forum is given the badge there: Accepted answers in that forum. Replies of theirs that somebody marked as the answer. This is the strongest evidence available, because the person with the problem said so. Posts in that forum. A second test, so one lucky answer is not enough on its own. Both are counted inside the forum, deliberately. Promoting on a site-wide reputation score or post count measures how much somebody posts, not what they know — on a community whose busiest forum is off-topic, that names the most prolific chatterer an authority on billing. The admin screen lists everyone who currently meets the tests whether or not automatic naming is switched on, so you can see exactly who the rule would pick before trusting it with the decision. Nobody is ever removed automatically: taking a badge away stays a decision a person makes. Emails that produce answersOnce an hour, experts are emailed about questions in their forums that nobody has answered. It skips anything they started, anything they have already replied to, and anything they have already been told about — an expert is never sent the same question twice. One email lists several questions rather than sending several emails. Members can turn it off from their own notification settings, or from the link in the email itself. Both routes work because both are core's. AlsoAn audit trail of who was named or removed, when, and by whom — with automatic changes marked as such and the reason recorded. Members can opt out of being shown as an expert without losing their assignments. Administrators can block a member from ever showing as an expert. Restrict by group, so the badge can only reach the people you intend. No core files are edited. Upgrading Invision Community will not break it. Honest about the limitsForums only. Experts are named against forums, because that is what core's own data does. Automatic naming needs "solved" enabled in a forum. Without accepted answers there is no evidence to promote on, so nobody is ever named automatically in a forum that does not use it. Naming people by hand works everywhere. The emails need a working task scheduler. Without one, nothing is sent. Three language strings belong to core's namespace. They have to, because they are the strings for core's own email, which does not ship with them. If you ever migrate to Invision Community Cloud, uninstall this application first — see the setup guide. RequirementsInvision Community 5.0 or newer (self-hosted) The Forums application A running task scheduler, for the emails and for automatic naming Free. No key, no account, no external service.

Pulse — traffic analytics that never leave your databaseInvision Community tells you a great deal about your content. Registrations, posts, reactions, badges, points, solved rate — there are forty statistics screens in the AdminCP and they are genuinely good. None of them tell you about your traffic. Not pageviews. Not visitors. Not where anybody came from. Guests, who are most of the people reading your community, appear nowhere at all — they exist only in the sessions table, which is wiped continuously. The official answer is Google AnalyticsInvision Community ships an integration whose entire job is injecting Google's tracking script into your pages. That is the supported route, and for a lot of communities it is not a route at all: a cookie banner, a data-protection question you would rather not answer, and your members' browsing habits handed to an advertising company. Pulse is the third option. Every figure below is measured on your own server, stored in your own database, and shown in your own AdminCP. Nothing is sent anywhere. What it measuresHeadline Pageviews · visitors · sessions · bounce rate · average visit length Where they went Top pages, with the whole path — not just content items Where they came from Referring sites, with your own domain excluded Who Members against guests, and desktop against mobile and tablet Countries A world map you can hover, country by country Every headline figure carries a trend line, and the whole dashboard can be read over seven, thirty or ninety days. No JavaScript. No cookies. No IP addresses.This matters enough to be specific about, because "privacy-friendly" is easy to claim. No script is loaded. Not one byte of JavaScript, not even for the charts — the graphs and the world map are inline SVG. Nothing is fetched from anywhere. No cookie is set, so Pulse adds nothing to a consent banner. No IP address is ever written to the database. One is read to compute a hash and immediately discarded. There is no column to store it in. The visitor identifier is salted with a secret that changes every day. It cannot be reversed, and it cannot be matched from one day to the next — so it counts visitors without following anybody. A pageview records whether somebody was signed in, never which account. There is no member column. Raw events last hours, not for ever. They are rolled into daily totals and deleted. After that a day exists only as a handful of numbers. The settings screen lists all of this in the interface, with live counts, so you can answer a data-protection question by pointing at it. It cannot slow your forum downThe recording happens after the page has already been delivered. Invision Community closes the connection to the browser before running its shutdown work, and Pulse writes its single row at that point. The visitor has their page before the database is touched. There is no query on the way in, no join, and nothing that can fail in a way that affects the page. Honest about the limitsSome things cannot be measured without JavaScript, and it is better to say so than to invent them: A one-page visit has no measurable length. There is no exit signal, so bounces contribute nothing to the average visit time rather than a made-up figure. The average is over visits that can actually be measured. Visitors are counted per day and added up. Somebody who comes on Monday and Tuesday counts twice over a week. Counting them once would mean keeping the raw records for the whole period, which is exactly what this app is designed not to do. Countries need a header from in front of your site. If you run Cloudflare or a load balancer that provides one, the map fills in. If nothing supplies it, the map is hidden rather than shown empty. Pulse does no geolocation lookups of its own — that would mean either an external request or shipping a database of IP ranges. AlsoCrawlers are separated out, using Invision Community's own spider detection. Search engines can be most of your raw traffic and none of your audience. You can exclude your own staff, so your browsing does not become the story. Retention is yours to set — hours of raw events, days of history. No core files are edited. Upgrading Invision Community will not break it. RequirementsInvision Community 5.0 or newer (self-hosted) A running task scheduler — the hourly rollup is what produces every figure Nothing else. No API key, no account, no external service.

Drip Campaigns — email sequences that run themselvesSomebody registers at three in the morning on a Saturday. A week later they have posted nothing and you have not spoken to them, because nobody was awake to. Multiply that by every member who ever joined and you have the reason most communities lose people in their first fortnight. A drip campaign is a sequence of emails that starts when a member does something and then unfolds on their clock — a welcome straight away, a nudge two days later, an invitation to introduce themselves after a week. Everyone gets the same thoughtful onboarding regardless of when they arrived. Invision Community has this. On Cloud. On some plans.Email Drip Campaigns arrived in Invision Community 5.1 for Cloud customers, on selected packages. Self-hosted communities do not get them at all. This app brings sequences to self-hosted — and adds the two triggers the Cloud version does not have. Both were the most-requested things in the comments under the announcement, and neither made it in. The trigger nobody else offers: they stopped showing upEvery other trigger is an event — somebody did a thing, so something happens. Absence raises no event. Nobody fires a notification when a member quietly stops visiting, which is exactly why re-engagement is the hardest email to send and the one worth the most. This app goes looking instead. Set a number of days, and members who cross that line are enrolled by a scheduled scan. A "we miss you" series that actually reaches the people it is about. And renewals, which are not first purchasesInvision's Cloud version fires on "purchases a subscription". This one also fires on renewals, on an upcoming expiry — the moment worth acting on while there is still something to save — and on cancellations. Thanking a three-year customer for joining reads badly; these deserve different emails and now they can have them. Every triggerJoining Registers · confirms their email · updates their profile Taking part Joins a club · responds to an event · completes a course Money Buys · renews · is about to expire · cancels Absence Has not visited for a set number of days Chaining Another campaign finishes Event responses can be narrowed to one answer, so you are not telling somebody who declined that you will see them there. Triggers for applications you do not run are never shown, and never listened for. Audiences built from filters you already haveThis app invents no filters of its own. It uses Invision Community's own member filters, which means you can target by group, join date, last visit, content count, reputation, achievements and profile fields — and, if you run Commerce, by purchases, subscriptions, total spend and donations. Anything a third-party application adds to that list works here too, automatically. It checks again before every emailThis is the part that stops a campaign embarrassing you. Someone qualifies for "we miss you" on Monday, comes back on Tuesday, and on Wednesday the second email arrives telling them how much you miss them. Audiences are re-checked before every send, not just at enrolment, so a member who stops matching stops receiving. It can be switched off; it is on by default for a reason. Care taken where it mattersOpting out is honoured absolutely. A member who has turned off administrator emails is never enrolled, never sent to, and is removed from a campaign if they opt out mid-sequence. Unsubscribing uses Invision Community's own mechanism — the same link, the same page, and a key derived from the account so it stops working when the password changes. Nobody is enrolled twice. A trigger that fires more than once for the same person does nothing the second time. Disabling an email does not strand anyone. Members waiting on that step move to the next one rather than sitting there for ever. Posting and paying never wait on email. Enrolment happens in the background; sending happens on a schedule. No core files are edited. Upgrading Invision Community will not break it. Check a member"Why didn't they get it?" has a dozen possible answers. There is a screen that gives you the actual one: whether they can be emailed at all, whether they match each campaign, whether they are enrolled, which step they are on, and when the next email is due. RequirementsInvision Community 5.0 or newer (self-hosted) Working outgoing email and a running task scheduler Commerce, Calendar, Clubs are all optional — their triggers appear only if you run them

Auto Tagging — tags every topic by what it is aboutTagging only works if people do it, and people do not do it. Your tag list gets built with care, gets used properly for a fortnight, and then quietly stops being used at all. Everything posted after that is untagged, so tag pages go stale, filtering misses things, and the vocabulary you designed is doing nothing. This reads each new topic and applies the tags that actually fit it. It matches meaning, not wordsA topic titled "my card keeps getting declined and I was charged twice" gets tagged billing — a word that appears nowhere in it. Invision's own tag box offers autocomplete over text the author has already typed, which cannot do this. Matching here is done on meaning, so a topic reaches the right tag even when it shares no vocabulary with it at all. It uses your tags. Only your tags.Nothing is invented and nothing new appears in your tag list. The app reads the tags you have already defined and chooses between them, so the vocabulary stays exactly as you designed it. Disable a tag and it stops being applied. It also learns what each tag means in your community, not in general. A tag is understood partly from the topics that already carry it, so build on a woodworking forum and build on a gaming forum end up meaning quite different things — as they should. It will not touch work someone did by handThis is the part worth reading carefully. Adding a tag in Invision Community is not actually an operation the platform offers — saving tags replaces every tag on the item. A tagging tool that gets that wrong will silently delete tags your moderators set, and nobody will connect the loss to the app that caused it. Auto Tagging always writes the complete set: existing tags, the new ones, and the item's prefix. By default it leaves anything already tagged completely alone. Honest about confidenceEvery match carries a score, and there is a threshold below which nothing is applied. The defaults are set to tag less rather than tag wrongly — a wrong tag is worse than a missing one, because someone has to find it and undo it. There is a Preview screen that scores real topics from your own community and shows you the numbers, so you can pick a threshold from evidence rather than from a guess. It tags nothing while you do it. Fits around the site rather than into itPosting never waits. Tagging happens in the background after the topic is saved. Nobody sits watching a spinner while an API is called. Backfill on demand. Tag the topics you already have, batched so a large community does not arrive as one enormous bill. Scope it. Restrict it to certain forums, and list any tags it must never apply — solved and staff pick mean something procedural that only a person should decide. Respects your limits. It will not push an item past your site-wide maximum tags per item. One key, one bill. If you run Related Topics or AI Assistant, it can borrow their embeddings key instead of asking for another. No core files are edited. Upgrading Invision Community will not break it. What it costs to runAuto Tagging needs an embeddings API key — Voyage AI or OpenAI. This is not a subscription to me; you hold the account and pay the provider directly. Embeddings are among the cheapest things either provider sells. Your tag list is processed once and then only when it changes, and each new topic is a single small request. For an ordinary community this runs to a trivial amount per month, and there is no charge at all while nothing is being posted. RequirementsInvision Community 5.0 or newer (self-hosted) Forums Tags enabled, with at least a few tags defined An embeddings API key from Voyage AI or OpenAI — or Related Topics / AI Assistant already installed, in which case it can share theirs

Passkeys — sign in with a face, a fingerprint or a security keyA passkey replaces the password entirely. Your members tap their phone, look at their laptop, or touch a security key, and they are in. Nothing to remember, nothing to type, nothing to leak. This is a real login method, not a second factor. Invision Community has no WebAuthn support of any kind — this registers through core's own login-handler system, so the passkey button sits alongside your existing sign-in options and behaves like one of them. Why passkeys and not another password policyThey cannot be phished. A passkey is bound to your domain by the browser. A convincing copy of your login page on another domain simply will not work — the credential refuses to sign for it. They cannot be reused. Every site gets a different key, so a breach somewhere else cannot reach your community. There is nothing on your server worth stealing. You store a public key. It verifies signatures and can create none. Nothing to reset. No "forgot password" flow, no reset emails, no support tickets about them. What members seeAdding one A page in their account settings. One button, their device prompts, they name the key. Several devices, several keys. Signing in A "Sign in with a passkey" button on the normal login form. Managing them Rename or remove any key, with the date added and last used, so an old laptop is easy to spot and revoke. Works with what people already haveFace ID and Touch ID, Windows Hello, Android biometrics, iCloud Keychain, Google Password Manager, 1Password, Bitwarden, and hardware keys such as YubiKey. Nothing to install — every current browser has this built in. Built carefully, because this is authenticationEvery check the WebAuthn specification asks for is performed, and the reason each one exists is that skipping it breaks the model. The challenge is single-use, purpose-bound and expiring, so a captured ceremony cannot be replayed. The origin is compared exactly — not "starts with" — so a lookalike domain cannot relay it. Registrations cannot be replayed as logins. A signature is verified over exactly the bytes the authenticator signed. Cloned-device detection. WebAuthn gives one signal that a credential may have been copied: a signature counter that goes backwards. If that happens the passkey is disabled and the member is told why. Authenticators that don't count at all report zero forever — that is normal, and is never mistaken for an attack. No third-party code. No composer packages, no bundled cryptography library, nothing fetched at runtime. Verification uses PHP's own OpenSSL functions. Hidden when it cannot work. Browsers refuse passkeys outside a secure context, so on a site without HTTPS the button does not appear rather than failing when pressed. No core files are edited. Upgrading Invision Community will not break it. What you controlHow many passkeys each member may register Whether to require user verification — a fingerprint, face or PIN, rather than mere presence Whether a backwards counter disables the credential The name members see on their device when it asks them to confirm RequirementsInvision Community 5.0 or newer (self-hosted) HTTPS. Browsers will not create or use a passkey without it. PHP with OpenSSL — standard on every install

Community Stats — one block that fits wherever you put itInvision's built-in stats block shows three things: total members, most ever online, and the newest member. No posts, no topics, no sense of whether any of it is growing. This shows what a visitor actually wants to know, with the trend behind it — and it reflows to whatever space you give it. The same block, both orientationsIt measures its own container, not the browser window. Drop it in a 260px sidebar and it renders as a neat stacked list. Drop it across a content column and the same block becomes a row of tiles. Nothing to configure and no second block to maintain — a normal responsive block cannot do this, because a viewport media query cannot tell a narrow sidebar from a wide page. If you would rather decide yourself, you can force it to always stack or always tile. Who's online, with facesA row of avatars linking to profiles, with an overflow count when there are more than will fit. Anonymous browsing is respected, properly. A member who has chosen to browse anonymously is never shown and never counted — and neither are guests or search engine spiders. The number beside the avatars is derived from the same list that draws them, so the count and the faces can never disagree with each other. Figures that mean somethingCounts Members, topics, posts, online now, newest member And, if you run them Files, images, blog entries, events Trend A rise or fall over a period you choose Sparkline A 30-day line beside each figure Only the figures your community can actually produce are offered — install Gallery and an image count appears in the list by itself. Nothing runs a query for something you are not showing. Trends work on the first dayMembers, topics and posts can be rebuilt from their own timestamps, so one click gives you a month of history immediately rather than asking you to wait a month for the block to look finished. Everything else starts recording from now. And until there is real history, no trend is shown at all. A "+0" on a fresh install would be a lie dressed up as data. Built to sit on a busy pageCached. Counting every row on a large community is not free, so figures are shared between visitors for an interval you set. No JavaScript. The sparklines are drawn inline as SVG — no charting library is loaded, on any page the block appears on. Big numbers stay readable. 12,300 becomes 12.3k rather than breaking the layout of a sidebar. Follows your theme, or takes an accent colour of your choosing. No core files are edited. Upgrading Invision Community will not break it. RequirementsInvision Community 5.0 or newer (self-hosted) Forums, Downloads, Gallery, Blog and Calendar are all optional — the block simply offers whatever you have

SEO Toolkit — find what's costing you traffic, then fix itThis does not claim Invision Community has no SEO. It has friendly URLs, sitemaps, canonical tags and JSON-LD, and they work. What it has no answer for is "is any of it actually set up correctly on my site, and what is search doing with it?" That is the gap. The auditOne button. It reads your community and tells you what is wrong, worst first, with a link to each offender. Site-wide Friendly URLs turned off · friendly URLs not forced · site offline · no HTTPS · robots.txt blocking everything · sitemap missing from robots · no default share image · Twitter cards off Content Duplicate titles · titles too short or too long to survive a search result · thin topics that will never rank Links Dead outbound links, and which topic each one is in Two findings that quietly cost the most. Friendly URLs being off means every page is served at a query string. And with them on but not forced, every page is reachable at two addresses — which search engines read as duplicate content. Invision's own note on that setting says so. Neither shows up anywhere in the AdminCP until something has gone wrong. Findings are fingerprinted, so re-running updates what is still true rather than piling up duplicates — and anything you have dismissed stays dismissed instead of reappearing every week. Anything you fixed disappears on the next run. Search Console and GA4, in the AdminCPClicks, impressions, click-through rate and average position. What people actually searched for. Which pages got the clicks. Sessions, users and landing pages from GA4 alongside them. A service account, not OAuth. Paste one JSON key. No consent screen, no redirect URL to register, no refresh token to keep alive. The last three days are deliberately excluded. Search Console lags, and including today makes every report look like a traffic collapse. Answers are cached for the day, because the data only changes daily and the calls are metered. Redirects that core cannot doCore follows items that were merged into other items. It has nothing for "we restructured the forums and forty URLs moved" — which is exactly when a site loses its rankings. 301, 302, 307 or 308, with a hit counter so you can see what is still being used Prefix rules that carry the rest of the path across, so /old/a/b lands on /new/a/b rather than dumping everything on one page Loops are refused, not stored. A redirect loop is invisible until a crawler walks into one, and then the page is simply gone from the index The tags core leaves outTwitter card tags. Invision emits Open Graph tags from eight applications and no twitter: tags whatsoever. These are derived from the Open Graph tags already on the page, so the two can never disagree. A fallback share image, used only when a page has none of its own. Per-forum overrides. Core's meta tag feature is a flat list keyed by exact URL, so keeping one forum out of search means knowing every address inside it. Here you pick the forum, tick noindex, and choose whether it applies to sub-forums. Built to be safe on a live siteThe audit never crawls you over HTTP. Everything is answered from the database. A crawler on a large forum is slow and hammers the server it is meant to be helping. Outbound links are the one exception, and they are fetched slowly, in small batches, on a daily schedule — never in a burst that looks like an attack on the sites you link to. HEAD first, falling back to GET, because plenty of servers refuse HEAD while serving pages perfectly well. A refusal is not evidence a link is dead. Requests are pinned to http and https, and private address space is skipped, so a background job cannot be steered somewhere it should not go. No core files are edited. Upgrading Invision Community will not break it. RequirementsInvision Community 5.0 or newer (self-hosted), with the Forums application Optional: a Google service account, for Search Console and GA4 reporting

Live Topics — run a proper live event, and keep the topic afterwardsSchedule a session. Attendees see a countdown. A host presses start and the room opens: video on one side, moderated questions in the middle, live chat alongside. When it ends, everything worth keeping becomes an ordinary forum topic. This is the feature Invision Community sells on its Cloud plans. It has never been available for self-hosted communities, and nobody else builds it. What Cloud charges for it. Live Topics is not included on the entry plan at all. The next tier up allows two events a month. Ten a month arrives at $259/month, and unlimited only at $619/month. This application has no quota. Run one a week or one a day; it is the same price. The roomVideo YouTube, Vimeo, Twitch, or a direct stream. Changeable mid-session, so a wrong link is not a disaster. Cloud supports YouTube only. Main Questions The curated stream. Sortable by newest or by what the room most wants answered. Chat The running conversation. A host can promote any message into a Main Question — which is also how they decide what survives. Three columns on a desktop, with a draggable divider. Tabs on a phone. What hosts and staff can actually doPromote a chat message into a Main Question. The good question always arrives in the chat, never in the right box. Close replies per question — to everyone, or to everyone but staff, so an answered question stops collecting "+1". Mark when a question was answered against the video position. The converted topic then deep-links to that moment. Approve questions or chat before they appear, when the session warrants it. Mute or remove one person without locking chat for everybody. Cloud has neither; its only controls are global. A staff-only channel where staff coordinate, and where reports arrive — during a live event nobody is watching the normal reports queue. Four things Cloud does not doMembers can ask to be told when it starts. Cloud reminds the hosts and tells members nothing, so anyone who missed the start has to guess. Here anyone can opt in, and the notification fires when a host actually starts — which is the useful moment, since starting is manual. A live attendee count. Visible in the room and on the block, so a session looks alive. The chat can be kept. Cloud discards it outright. Keep it as one collapsed post at the end of the topic, or discard it — your call, per event. An AI recap. Optional. At conversion, the questions and answers are summarised into the opening post, so somebody arriving a week later gets the point without reading forty posts. Cloud produces no post-event artifact of any kind. It becomes a real topicMain Questions and their replies are written into your chosen forum as a normal topic, each question attributed to whoever asked it and timestamped when they asked. Searchable, quotable, moderatable — an ordinary topic in every respect. Real-time, without requiring anythingThis works on its own. Out of the box the room updates on a short timer, which is how every live-chat application on this marketplace works. If you also run my Realtime application, this detects it and upgrades to its WebSocket gateway automatically — no configuration, nothing to connect. A socket that drops falls back to timed refresh rather than going silent. Bounded on purposeA session ends itself when every host has left, after a grace period you set. A session ends itself at a maximum length you set. An abandoned room is a standing cost, and neither of these should depend on somebody remembering. Nothing is visible to anyone until a host presses start. What you controlWho may schedule live topics, and who may moderate any of them Per event: hosts, staff groups, who may attend, approval rules, destination forum, whether the chat is kept Refresh interval, maximum length, host-absence grace period Whether recaps are written at all, and with which provider RequirementsInvision Community 5.0 or newer (self-hosted), with the Forums application Optional: my Realtime application, for WebSocket delivery Optional: an Anthropic or OpenAI-compatible key for recaps — or my AI Assistant, whose key this will borrow No core files are edited. Upgrading Invision Community will not break it.