# Lovable Prompts for Building a Classifieds Site - Tool: Lovable Prompts - Last updated: June 2026 ## TL;DR This prompt kit builds a Craigslist-style classifieds site where users post sell or wanted ads with up to six photos, browse by location and category, contact posters via an anonymous inquiry form, and ads expire automatically after 30 days. The biggest risk is spam — the second prompt in this chain is dedicated to anti-spam hardening (honeypot, IP rate limit, Cloudflare Turnstile, email confirmation), not the fifth. Ship this in a day with Lovable Pro. ## Frequently asked questions ### Can anonymous users post and inquire without signing up? Yes, with the email-confirmation flow. Anonymous posters submit the posting form, receive a confirmation email, click the link to activate their ad, and never need an account. Signed-in users skip the confirmation step. Inquiries are always anonymous — from_email is collected for forwarding, but submitters never create an account. This design is intentional: requiring signup to post or inquire kills conversion for classifieds. ### How do I stop spam from killing my classifieds site on day one? Four layers, applied in the second prompt in this chain: (1) Honeypot field — a hidden input that humans ignore but bots fill; submissions with a non-empty honeypot are silently dropped. (2) IP rate limit — maximum 3 inquiries per hour per IP address, enforced in the edge function. (3) Cloudflare Turnstile — a bot-proof CAPTCHA with near-zero friction for humans. (4) Email confirmation gate — ads only go active after the poster clicks a confirmation link, making bot-mass-posting expensive. None of these are optional — without all four, expect hundreds of spam ads within 24 hours of launch. ### Why does the inquiry form expose all other inquiries to anyone? This is a misconfigured RLS policy. Lovable's default scaffold sometimes grants both INSERT and SELECT to the anon role on the same table when you ask for anonymous submission. On an inquiries table, this means anyone can call `supabase.from('inquiries').select()` and see every inquiry ever sent — including email addresses. The correct policy is INSERT-only for anon, and SELECT only for authenticated users whose ads.poster_id matches auth.uid(). Run the anonymous-insert RLS audit follow-up prompt immediately after the starter. ### How do ad expiry and the 30-day clock work technically? Each ad row has an expires_at column defaulting to now() + interval '30 days'. A pg_cron job runs hourly and updates status to 'expired' for any active ad where now() > expires_at. The public-read RLS policy additionally filters on expires_at > now() so even if the cron job is delayed, expired ads won't appear in browse results. You can extend or reset expiry by updating the expires_at column — the poster dashboard includes an 'Renew for 30 days' action. ### Can I monetize with featured or bumped ads via Stripe? Yes. The 'Featured/bumped ads with Stripe Checkout' follow-up prompt adds this. Posters pay $5 for a 7-day bump to the top of their category. The implementation uses standard Stripe Checkout (not Connect, since there's only one seller — you). The webhook sets featured=true and featured_until=now()+7 days on the ad. Browse queries order by featured DESC, posted_at DESC so featured ads appear first. This is the primary revenue model for most independent classifieds operators. ### How is this different from a marketplace or directory? Classifieds: anonymous posters, ephemeral ads (30-day expiry), no payment integration — buyers and sellers connect directly and transact offline. Directory: owned, permanent listings with a claim flow, no transactions, lead capture forms. Marketplace: integrated Stripe payments, buyer protection, seller accounts with ratings. Build classifieds when the user experience is 'post an ad and wait for texts'; build a marketplace when you need escrow or payment processing in the app. ### What happens if someone reports an ad as a scam? The Report button on each ad inserts a row into the reports table with the ad_id and reason. This is INSERT-only for all users — no one can read the reports table except admins. The admin moderation queue at /admin/moderation shows all flagged ads grouped by report count. Admins can approve (set status='active'), flag (set status='flagged' — removes from public browse but doesn't delete), or delete. You can add an automatic threshold: if an ad accumulates 3 reports, automatically set status='flagged' for admin review. ### If your classifieds site needs spam protection at scale or custom moderation workflows, what does RapidDev offer? If your build outgrows this prompt kit and you need custom architecture, RapidDev builds production-grade Lovable apps at $13K-$25K — book a free 30-minute consultation at rapidevelopers.com. --- Source: https://www.rapidevelopers.com/lovable-prompts/lovable-prompts-for-building-classifieds © RapidDev — https://www.rapidevelopers.com/lovable-prompts/lovable-prompts-for-building-classifieds