Subreddit guides combine public Reddit source URLs, captured rules, visible verification dates, and Rankhog's account-safety workflow.
Rule summary
[>]
All submissions must be in the form of a question: All posts must be in the form of a question relevant to infosec. Soliciting "guidance", "feedback", or "thoughts" without any specific answerable question is not sufficient. Asking vague "has anyone ever" questions is also not sufficient. Questions must be specific, relevant, and answerable.
[>]
All submissions must be relevant to information security: To keep with the spirit of this sub, questions should be related to information security in an enterprise, large organization, or SOHO context. Homework, industry surveys, and beginner questions are most likely not relevant and should be asked in their respective subreddits. This rule is subject to moderator discretion.
[>]
Questions about possible or confirmed incidents must contain sanitized technical evidence: r/AskNetsec is not intended to assist with mysterious computing events, stalkers, or incidents without factual evidence of a technical nature.
[>]
No low effort questions: If you expect someone to take the time to answer a question and provide the help, you are expected to provide as much information as possible. Please include all previous troubleshooting, operating systems, application patch level, etc. If you think it might be relevant to the questions, then include it.
[>]
Be civil and professional: Always abide by Reddit.com site rules, and use Reddiquette and professional judgment as a guideline. This rule is subject to moderator discretion.
[>]
Do not ask for assistance in committing a crime, encourage crime, or offer criminal services: We are open to aiding people as a community in Penetrating Testing (Pen-Testing), Capture the Flag (CTFs), and red-team related scenarios, but Moderators have the right to remove/lock any comment or post that could be deemed to have criminal intent. If you believe this wrong, please let us know why and provide more information about the current situation. Your post was moderated on most likely because of not having enough info. Breaking this rule intentionally will result in immediate ban.
[>]
Don't spam or excessively showcase your own content. No referral or affiliate links: Repeatedly posting the same content or content from the same source, is considered spam. Posting low-quality content, blogs, vlogs, or YouTube videos is considered spam. Self-promotion and/or shilling (not disclosing a relationship with a source being promoted) are considered spam. If someone asks a question about a specific product, service, or organization, and you are a direct representative of that organization, you may address the question so long as you clearly identify yourself as such.
[>]
No questions about password managers: Question about password managers do not typically fall within the scope of this sub. Please refer to r/PasswordManagers for further assistance.
[>]
No questions about Career Advice, homework, or beginner questions.: /AskNetsec is more focused on technical questions. That means that questions related to career advice, what cert to get, school work, how to get started, etc, should be posted to places like: r/SecurityCareerAdvice, /r/NetSecStudents, /r/ITCareerQuestions, etc.
[>]
No low effort posts: If you expect someone to take the time to answer a question and provide the help, you are expected to provide as much information as possible. Please include all previous troubleshooting, operating systems, application patch level, etc. If you think it might be relevant to the questions, then include it. If you need help identifying what information you need [message the mods](https://www.reddit.com/message/compose?to=/r/AskNetsec) and we can help.
[>]
No posts asking about being hacked: This sub is reserved for network/server/information security questions. Asking questions about home computer or phone being hacked involve too many details. This includes clicking suspicious links/emails, your phone/computer acting weird, or if you believe you are being cyber stalked. To keep yourself safe, change your passwords (do not reuse passwords), enable 2FA, install a virus scanner, and use a password manager (/r/passwordmanagers).
Works well
A specific, answerable question about enterprise security, such as how to harden a particular service or handle a specific configuration problem, with all your technical details included.
A question about a real incident at your organization where you include sanitized technical evidence like logs, indicators, and what troubleshooting you already did.
A question about pen-testing, CTF, or red-team scenarios that is clearly framed as legitimate practice and not criminal intent.
Answering a question about your own product or service while clearly stating up front that you are a direct representative of that organization.
A question about security tooling or architecture in a large organization or SOHO context, with operating systems, patch levels, and previous troubleshooting spelled out.
Avoid
Posting anything that is not framed as a specific, answerable question, including vague asks for guidance, feedback, or thoughts.
Asking has anyone ever style questions with no concrete, answerable core.
Posting about your own computer or phone acting weird, suspicious links or emails, or believing you are being hacked or stalked.
Asking about password managers, which are explicitly out of scope here.
Asking career advice, certification, homework, or how to get started questions.
Posting industry surveys or beginner questions, which the rules call out as not relevant.
What r/AskNetsec Is For
r/AskNetsec is a community dedicated to people who are passionate about security. The people posting here ask technical questions about information security, and the rules say those questions should sit in an enterprise, large organization, or SOHO context. So think security professionals and serious practitioners trading specific, answerable questions, not people looking for general advice. The rules draw a hard line around what belongs here and what does not, which tells you this is a room that takes its focus seriously. It is a question and answer community at heart, and every submission has to be framed as a question.
Rules That Matter Before Posting
The rule that shapes everything here is “All submissions must be in the form of a question”, because every post must be a specific, relevant, and answerable question about infosec, and vague asks for guidance, feedback, or thoughts do not count. “All submissions must be relevant to information security” keeps the topics tied to enterprise, large organization, or SOHO contexts and pushes homework, surveys, and beginner questions out. “No low effort questions” and “No low effort posts” both demand that you bring full technical detail, including previous troubleshooting, operating systems, and application patch levels, if you want people to spend time answering you. “Don't spam or excessively showcase your own content. No referral or affiliate links” is the one that governs any marketing angle, since repeated posting, low quality blogs and videos, and undisclosed self-promotion all count as spam. That same rule does open one narrow door, because a direct representative of an organization may answer a question about that organization's product or service as long as they clearly identify themselves as such. “Questions about possible or confirmed incidents must contain sanitized technical evidence” and “No posts asking about being hacked” rule out the personal incident story angle entirely. “No questions about password managers” and “No questions about Career Advice, homework, or beginner questions.” remove two whole categories of tempting post. Finally, “Do not ask for assistance in committing a crime, encourage crime, or offer criminal services” allows pen-testing, CTFs, and red-team scenarios but bans anything with criminal intent, and breaking it intentionally means an immediate ban.
What To Post
A good post here is a specific, answerable question about information security in an enterprise, large organization, or SOHO context. Before you post, imagine a security professional reading it and asking you for more detail. Include your operating systems, application patch levels, everything you already tried, and anything else that could possibly matter. If your question touches an incident, strip out anything identifying and include the sanitized technical evidence. If you happen to be the right person to answer a question about your own product because someone asked about it directly, you can step in, but say clearly that you represent that organization. If you are unsure whether your post has enough detail, the rules point you to message the mods and they will help you figure out what information is missing.
What To Avoid
Do not post anything that is not a question, and do not post vague questions asking for guidance, feedback, or thoughts, because those get removed. Do not post about your own computer or phone acting weird, suspicious links or emails, or anything that smells like being hacked, because that is explicitly off topic here. Skip password manager questions, career advice, certifications, school work, and how to get started questions, since those belong elsewhere. Do not post surveys, homework, or beginner questions. Do not drop referral or affiliate links, do not repeatedly post content from the same source, and do not promote your blog, vlog, or YouTube channel, because all of that counts as spam. Never post anything that could be read as asking for help committing a crime, because an intentional breach of that rule means an immediate ban.
Use Rankhog before posting in r/AskNetsec
Want the version that does not run out? Subscribers get unlimited tool runs and more careful checks before posting.
Start your 7-day free trial. Card required. $99/month after trial. Next, connect a verified Reddit account; no strategy starts until you explicitly start Rankhog.
Only in one narrow case. If someone asks a question about your specific product, service, or organization, and you are a direct representative, you may answer so long as you clearly identify yourself as such. Everything else counts as spam under the rules.
Can I share a blog post or video I made?
No. The rules say posting low-quality content, blogs, vlogs, or YouTube videos is considered spam, and referral or affiliate links are not allowed either.
Can I ask for feedback on my security startup idea?
Not really. Every submission must be a specific, answerable question relevant to infosec, and soliciting feedback or thoughts without an answerable question is explicitly not sufficient.
Can I post about a security incident we experienced?
Only if you include sanitized technical evidence, and only if it is a network, server, or information security question. Questions about your home computer or phone being hacked, suspicious links, or cyber stalking are banned outright.
Can I ask a beginner question or a career question?
No. The rules send career advice, certifications, school work, and how to get started questions to other subreddits, and beginner questions are called out as most likely not relevant.