X open-sourced the code that decides who sees your posts. I had it read — all of it, including the adult-content enforcement system that none of the "algorithm expert" threads have touched. This is what it actually says, in plain language, for the creators it affects most. Every claim is cited to a line of their code, so when someone tells you I'm wrong, hand them the receipt.
- Claims verified
- 541
- Made up
- 0
- Viral myths tested
- 15
- Myths that survived
- 2
- Code snapshot
- a389166
If you only read one screen, read this one
- Check your avatar and banner today. X scores them separately from your posts. Either one alone can quietly kill your reach to non-followers — account-wide, even if every post is clean.
- Your followers always see you. Strangers are the thing at risk. Every penalty in this system works the same way: your existing fans keep seeing you (so everything looks normal to you), while people who don't follow you stop seeing you entirely.
- Original posts are the only format that reaches strangers. Replies and reposts are physically excluded from the discovery system. "Reply to big accounts to grow" does not work — not badly, at all.
- The first like on a post is a switch, not a stat. Until a post has one like, it isn't even eligible to be shown to non-followers. After 24 hours, the discovery window closes; after 48, the post is done everywhere.
- A report hurts ~470 times more than a like helps. Avoiding one report is worth more than hundreds of likes. Anything in your caption that bait-triggers reports is costing you more than it earns.
- Marking your own post "sensitive" gets zero leniency. Same treatment as being caught by the classifier, in the exact same line of code.
- Flags expire on their own, and your reputation is basically last week. An automatic NSFW account flag lasts at most 7 days. The credibility score that decides whether enforcement even looks at you is rebuilt daily from a rolling 7-day window. You are not permanently shadowbanned; the code literally forbids it.
- The only real way to check your reach: log out. The code shows you your own posts everywhere, always, even while hiding them from everyone else. Your own timeline is a two-way mirror.
One honest caveat before the details
The numbers in this post are the values X ships as defaults in the published code. The live servers can override them with a private settings file that isn't public, and the code says these defaults were last synced on August 12, 2026. So: this is the best evidence that exists — dramatically better than the guesswork in most threads — but it's a photograph, not a livestream.
Six flags decide whether strangers ever see you
X can put twelve different flags on an account (not just on a post). Half of them are adult-content flags. The code includes X's own plain-English description of each one, written for a transparency report — so the words below are X's, not mine.
| The flag | X's description | What it does to you |
|---|---|---|
| NsfwHighRecall "maybe" flag | Account detected by automated systems as one that may post adult content. | All your posts hidden from everyone who doesn't follow you. |
| NsfwHighPrecision "probably" flag | Account detected as likely to post adult content. | Same: hidden from all non-followers. |
| NsfwNearPerfect "certain" flag | Applied when a single image scores above 0.99 — near-certainty from the classifier. | Same: hidden from all non-followers. |
| NsfwAvatarImage | Triggered by your profile picture — not by anything you posted. | Same: hidden from all non-followers. |
| NsfwBannerImage | Triggered by your header image — not by anything you posted. | Same: hidden from all non-followers. |
| NsfwAdmin the human one | Applied after a user report to an account that primarily posts adult content. The only one of the six that involves a human. | Everything above, plus a content warning on every post, plus hidden from minors, logged-out visitors, and anyone with no birthdate on file. |
The thing to actually do about this
Two of the six flags have nothing to do with what you post. Your profile picture and your banner are each scored on their own, and either one can cost you every non-follower on the platform. If your reach died and your posts are tame, look at your profile images first. It's a five-minute check that almost nobody knows to make.And be clear about what "hidden from non-followers" means, because it is not a downrank. In the code, a flagged account's posts are deleted from the pool of posts a stranger's feed can even choose from. You don't rank lower. You aren't in the running.
Receipts: under-the-hood/strato/lib/underTheHoodLabels.strato (X's descriptions) · visibility-filtering/rules/user_label_drops.rs (the hiding rules) · 9 of 11 account-flag rules contain no exception for anyone except you viewing yourself.How you actually get flagged
Only one of the six account flags requires a human report. The rest are applied by machines, and several of them never look at a single post you made.
- Every image and video is scored the moment you upload it.Nobody has to report you. A model grades all media into buckets — one bucket means "probably adult," another means "maybe adult," and each applies a flag automatically. What score puts you in a bucket is the one number X kept out of the published code.
- Videos are judged on 8 frames.The system samples up to 8 stills from a video and grades those. One unlucky frame can flag the whole clip.
- Text alone can be flagged — no picture needed.There's a dedicated flag for explicit language, and it carries the same hidden-from-minors, hidden-from-logged-out treatment as an explicit image. A spicy caption on a clean photo is a real risk.
- The preview image of a link counts as your image.Post a plain-text tweet linking to a site whose preview thumbnail is explicit, and your post gets flagged off the thumbnail. If you post promo links, the preview card is part of your content whether you chose it or not.
- Your avatar is scored. Separately.Applies an account-level flag directly.
- Your banner too.Same deal, independently.
- Doing well gets you re-checked.Crossing 128 likes triggers a fresh adult-content review of a post that passed the first time. Separately, an AI reviews posts against the written adult-content policy — but only once they start getting traction. A post can be fine at 50 likes and flagged at 500 because it took off.
- One explicit-enough post can flag your whole account, instantly.The flagging bot doesn't wait for a pattern. If a single image lands in the "probably adult" bucket, it applies the account flag right then — one post, same day.
- Or a pattern can do it.The slower route: if 3 of your last 5 posts get flagged, your account gets flagged. This is the one to watch if you run close to the line regularly.
- A link's website can go bad and take your old posts with it.When a domain gets marked unsafe, a bot goes back and flags every existing post that ever linked to it — months later, no notification, nothing you did. If you post clip-site or aggregator links, your archive's reach depends on their reputation, not yours. (When the domain clears, the flags come off the same way.)
What a flag costs you
Your followers keep seeing you. On a flagged post they get a "sensitive content" tap-through — and fans who turned on "show sensitive media" in their settings see it with no warning at all. Your existing audience is genuinely unaffected.
Strangers stop seeing you, and their settings can't fix it. This is the cruelest mechanic in the code: even a viewer who opted in to sensitive content will never be shown your flagged post in their For You feed. The hiding rule simply never asks what the viewer wants. Opting in fixes the warning screen for fans; it does nothing for discovery.
Anyone not logged in sees nothing. Share a flagged post's link anywhere — the click from someone without an account (or under 18, or with no birthdate set in 16 countries) hits a wall. Your promo links off-platform are only as good as your flag status.
Once your account is flagged, even your clean posts are hidden. Plain text, no media, totally safe-for-work — hidden from all non-followers anyway, until the flag expires.
Quoting the wrong post can sink yours. The system checks what you quoted and what you replied to. If that post is hidden, yours goes down with it — automatically, regardless of what you wrote.
The "mark it sensitive yourself" question, settled
Creators have argued for years about whether self-marking your media buys you gentler treatment. The code answers it: no. The rule that hides a self-marked post and the rule that hides a classifier-flagged post are the same rule, built twice, with the same outcome. Self-marking has exactly one benefit: X can't also catch you, which may matter for policy strikes. Algorithmically it buys nothing.
Receipts: visibility-filtering/rules/tweet_flag_rules.rs (identical twin rules) · nsfw_interstitial.rs (the opt-in check that exists for followers) · the recommendations hiding rules contain no such check · registry.rs (quoted/parent post checks).The way back
The single most reassuring thing in the code
Automatic account flags expire by themselves in at most 7 days. The code physically caps their lifetime — a rule that tried to flag you for longer would be rejected. There is no permanent automated shadowban in this system. If you stop posting things that re-trigger the flag, it lapses within a week, no appeal needed.
If a flag was ever manually removed from your account, you get 90 days of protection. The bot checks for a past manual removal and, if it finds one within 90 days, it will not re-flag you automatically — it sends your case to a human instead. If you've successfully appealed before, that appeal is still protecting you.
Link flags reverse on their own. When a domain's reputation clears, the same bot that flagged your posts goes back and unflags them.
Big accounts get a human, small accounts get the bot. Fair warning rather than good news: established, high-reputation accounts are exempt from auto-flagging entirely — their cases go to a review queue. The automation falls hardest on smaller creators.
Rebuilding after a flag — why it's faster than you think
There is no "rebuild your reputation" feature in this code, and that turns out to be the good news: reputation in this system barely has a memory. Three separate mechanisms, all short-windowed:
Your credibility score is a rolling 7-day window, recomputed every day. This is the score that, when it's high enough, makes the enforcement automation skip you entirely. It's built from exactly two things: the likes and reposts you received in the last 7 days, weighted by how credible the accounts giving them are, plus who follows you. Your standing is literally last week. There is no ancient history to live down.
The behavior model looks back 30 days. The account-scoring model that feeds into flagging trains on 30-day windows — a bad month ages out of the data on its own.
The feed has zero memory. No lingering account penalty exists in the ranker at all. The moment a flag lapses, ranking treats you like anyone else.
So the comeback playbook, straight from the mechanics:
Diagnose first, logged out. Nothing reaching non-followers at all (even plain text) means an account flag. A warning on one or two posts is just post labels — a much smaller problem that mostly solves itself at the 48-hour mark.
Go clean for the flag window. 7 days for NSFW flags, up to 30 for spam ones — and that includes your pfp and banner, which are scored on their own. The flag lapsing is the reset; there's nothing else to wait for.
The week you come back, engagement from established accounts is the medicine. Credibility flows outward from established and verified accounts through likes and reposts. A circle of real creators engaging each other's original posts isn't just a growth tactic — it is directly the input to the score that buys enforcement immunity. One good week rebuilds it, because one week is all the system reads.
Keep your report ratio down. The spam automation runs on reports-per-like ratios. An audience that likes and never reports is, mathematically, the profile of a credible account.
One honesty note so nobody over-promises with this: automated flags expire; a few spam-flag variants ship with no expiry at all, and manual enforcement sits outside all of this. "Shadowbans clear in 7 days, guaranteed" is not the claim — "the automated system forgets fast if you stop feeding it" is.
How to find out if you're flagged
The code contains a real, built transparency feature: a monthly "Under the Hood" report you can request about your own account, listing the flags on it in the plain-English wording quoted above. Requirements found in the code: your account is at least 1 year old and you posted 10+ times last month; the report covers the previous month and appears about 10 days after it ends. It's behind a feature switch, so it may not be visible to everyone yet — but the machinery exists.
Until then, the logged-out check
Nearly every hiding rule in the code has one exception: you. You always see your own posts, everywhere, even while they're hidden from the world. So checking your own profile proves nothing. Open an incognito window, logged out, and look at your profile and your latest posts. That's the view the algorithm actually serves.What each thing a fan does is actually worth
Every post gets a score, and the score decides its rank. The code prices every action a viewer might take. Here's the price list, converted into the only unit that makes sense: likes. One like = 1.
One thing first, because it changes how you read the table: X doesn't wait for any of this to happen. A model predicts, for each person about to scroll past your post, the odds they'll do each of these things — and your post is scored on the predictions. Two consequences. Your post's fate is largely set before anyone touches it. And a post that merely looks like report-bait to the model gets buried in advance, no actual report required.
| When a fan… | It's worth | In the code |
|---|---|---|
| What helps you | ||
| Copies your post's link to send to someone — the single most valuable thing a fan can do | 40 likes | share-via-copy-link, 20.0 |
| Replies to your original post, when you follow each other — mutuals replying to your originals are the most prized audience in the whole system | 40 likes | reply 5.0 + mutual bonus 15.0 |
| DMs your post to someone | 10 likes | share-via-DM, 5.0 |
| Replies (everyone else) | 10 likes | reply, 5.0 |
| Quote-posts you | 10 likes | quote, 5.0 |
| Follows you because of the post | 8 likes | follow-author, 4.0 |
| Shares it (share button) | 4 likes | share, 2.0 |
| Reposts it | 2 likes | retweet, 1.0 |
| Likes it | 1 like | favorite, 0.5 — the baseline |
| Taps to expand your photo / opens your video | 1/10th | photo-expand / video-open, 0.05 |
| What counts for nothing — yes, really | ||
| Bookmarks your post. Bookmarks add zero to a post's score — the weights file doesn't even contain the word. The "bookmarks are secretly huge" advice is fiction. | 0 | no bookmark weight exists |
| Stares at your post for a long time. Dwell time is priced at zero in the shipped defaults. | 0 | dwell, 0.0 |
| Visits your profile from the post. Also zero. | 0 | profile-click, 0.0 |
| What hurts you | ||
| Reports your post — one predicted report erases the value of hundreds of likes | −468 likes | report, −234.0 |
| Mutes you | −118 likes | mute-author, −58.8 |
| Taps "Not interested in this post" | −86 likes | not-interested, −43.2 |
| Blocks you | −62 likes | block-author, −31.2 |
What to do with this table
Make posts people send to each other — a copied link is worth 40 likes, a DM share 10. Talk with your mutuals on your originals — that conversation is the highest-value signal you can generate. And stop optimizing for bookmarks and dwell time; the code prices both at zero. Meanwhile one report outweighs ~470 likes, so anything in a caption that provokes reports from people outside your audience is a net loss even when it "does numbers."How strangers actually find you
Getting shown to people who don't follow you isn't a ranking contest you're always entered in. It's a pool, and your post has to get into the pool first. The code is blunt about the entry rules:
One like puts you in. Zero likes means you don't exist. A post enters the discovery pool when its like count hits 1. Before that, strangers' feeds cannot select it at all — it isn't ranked low, it isn't ranked. Those first minutes where your core fans like the post? That's not engagement, that's the door opening.
The door is open for 24 hours. The main discovery pool only holds posts under a day old. After 48 hours, the post is finished everywhere — every feed in the code hard-deletes anything older, no matter how well it's doing.
Only original posts and quotes get in. Replies and reposts are never added to the discovery pool, and a separate filter deletes them from strangers' feeds before ranking even starts.
Posting in bursts wastes score. When several of your posts land in the same person's feed at once, only your best one keeps full value — each extra one is cut in half, down to a floor of a quarter. The counter resets every refresh, so this punishes crowding, not frequency. Space posts out; don't dump.
Under 1,000 followers? The code is on your side. There's a deliberate boost for small accounts: one under-seen original post per feed load gets lifted to roughly the 16th slot's score. It has to be an original, under 24 hours old. This is real and it's specifically for you.
Receipts: the discovery pool is phoenix's "1fav_1day" index (the name is the rule: 1 favorite, 1 day) · MAX_POST_AGE = 48 hours in home-mixer/params/config.rs · burst penalty: author-diversity decay 0.5, floor 0.25 · small-account boost: cold-start, follower cap 1,000.The myth check
Fifteen claims collected from the most-shared threads about this code drop. Thirteen failed.
| "Everyone knows…" | Verdict | What the code says |
|---|---|---|
| Marking your own post sensitive is treated more gently | False | Identical rule, identical hiding. Zero leniency. |
| Viewers turning on "show sensitive content" restores your reach | False | Fixes the warning for your followers. Does nothing for discovery — the hiding rule never asks. |
| NSFW accounts are permanently shadowbanned | False | Automatic flags are hard-capped at 7 days and lapse on their own. |
| Flags only apply to individual posts | False | Two routes reach your whole account — one of them off a single post. |
| A reply the author replies to is worth 150× a like | Not in code | No "author replied back" bonus exists anywhere. A reply is 10× a like. |
| A repost is worth 20× a like | False | It's 2×. The "20" in the file is the copy-link share. Someone read the wrong line and everyone repeated it. |
| A bookmark is worth 10× a like | False | Bookmarks are worth exactly nothing to a post's score. |
| A block is −3, a like is +0.5 | Half true | The like is right. The block is −31.2 — ten times worse than claimed. |
| Posting links kills your reach | Half true | No blanket link penalty exists — opening your link actually counts for you. But if the linked domain gets marked unsafe, every post that ever linked to it is flagged retroactively. |
| Posts die after 48 hours | True | Exact. Hard-coded, enforced before ranking. |
| Premium accounts get an algorithm boost | Half true | No boost in the feed ranker. But verified accounts get a structural credibility advantage, and high credibility skips enforcement entirely. |
| Replying to your own post boosts it | False | The opposite — your reply competes against your original for the single slot a thread gets. |
| Replying to big accounts grows your reach | False | Strangers are never shown your replies. The filter deletes them before ranking. |
| Posting too often gets your account penalized | False | No memory of your posting rate exists — the burst penalty resets every single feed refresh. |
| The rules are the same for everyone | False | Both enforcement rulebooks open with exemptions for high-reputation accounts. |
What nobody can know from this code
This section is why you can trust the rest. Some things genuinely aren't in the published code, and anyone claiming to know them is guessing:
How explicit is "too explicit." The score cutoff that sorts an image into the flagging buckets was kept out of the release. Nobody outside X can tell you where the line is — only that the line exists and what crossing it costs. And it's worse than a hidden number: the classifier is fed your account's reputation alongside the image. Same photo, different poster, different score. "Too explicit" isn't a rule anyone wrote — it's a vibe inside a model.
Today's exact numbers. Everything here is the shipped default; the live override file isn't public.
How much traction triggers the AI policy review. That threshold lives in a config that wasn't released.
Who's on the manual blacklists. Files exist for excluding specific accounts and posts from discovery by hand. The lists themselves aren't published.
One detail worth keeping, because it tells you these files are the real thing and not a cleaned-up press release: one of the NSFW account rules ships with a config bug — it demands 11 flagged posts inside a window that only ever holds 10 — so as written, it can never fire. Real codebases have bugs. Sanitized ones don't.
How this was made
Eleven AI research agents read X's published code in parallel, each covering one subsystem, each required to pin every claim to an exact file and line. A twelfth agent had one job: attack everything the others found and try to kill it. It struck down or corrected 29 claims before anything reached this page. Then all 541 file-and-line citations were re-checked mechanically against a fresh copy of the code: every cited file exists, every quoted line is really there. Zero were invented. The adult-content sections were then re-read by hand, line by line.
The code is public: github.com/xai-org/x-algorithm, snapshot a389166. The small print under each section names the exact files. If you think something here is wrong, you can go look — that's the point of writing it this way.
If this saved you from one bad decision, send it to a creator friend. That's the whole ask. — Urlilgoddess