diff --git a/src/activitypub/handlers/create.rs b/src/activitypub/handlers/create.rs
index 741923f..40ed313 100644
--- a/src/activitypub/handlers/create.rs
+++ b/src/activitypub/handlers/create.rs
@@ -657,7 +657,7 @@ pub async fn handle_note(
     Ok(post)
 }
 
-async fn is_unsolicited_message(
+pub async fn is_unsolicited_message(
     db_client: &impl DatabaseClient,
     instance_url: &str,
     object: &Object,
@@ -678,9 +678,9 @@ async fn is_unsolicited_message(
 }
 
 #[derive(Deserialize)]
-struct CreateNote {
-    actor: String,
-    object: Object,
+pub struct CreateNote {
+    pub actor: String,
+    pub object: Object,
 }
 
 pub async fn handle_create(
@@ -692,12 +692,6 @@ pub async fn handle_create(
     let activity: CreateNote = serde_json::from_value(activity)
         .map_err(|_| ValidationError("invalid object"))?;
     let object = activity.object;
-    let instance = config.instance();
-
-    if is_unsolicited_message(db_client, &instance.url(), &object).await? {
-        log::warn!("unsolicited message rejected: {}", object.id);
-        return Ok(None);
-    };
 
     // Verify attribution
     let author_id = get_object_attributed_to(&object)?;
@@ -716,7 +710,7 @@ pub async fn handle_create(
     };
     import_post(
         db_client,
-        &instance,
+        &config.instance(),
         &MediaStorage::from(config),
         object_id,
         object_received,
diff --git a/src/activitypub/receiver.rs b/src/activitypub/receiver.rs
index 1efee49..14a6ba3 100644
--- a/src/activitypub/receiver.rs
+++ b/src/activitypub/receiver.rs
@@ -25,7 +25,11 @@ use super::handlers::{
     accept::handle_accept,
     add::handle_add,
     announce::handle_announce,
-    create::handle_create,
+    create::{
+        handle_create,
+        is_unsolicited_message,
+        CreateNote,
+    },
     delete::handle_delete,
     follow::handle_follow,
     like::handle_like,
@@ -320,6 +324,15 @@ pub async fn receive_activity(
         };
     };
 
+    if activity_type == CREATE {
+        let CreateNote { object, .. } = serde_json::from_value(activity.clone())
+            .map_err(|_| ValidationError("invalid object"))?;
+        if is_unsolicited_message(db_client, &config.instance_url(), &object).await? {
+            log::warn!("unsolicited message rejected: {}", object.id);
+            return Ok(());
+        };
+    };
+
     if let ANNOUNCE | CREATE | DELETE | MOVE | UNDO | UPDATE = activity_type {
         // Add activity to job queue and release lock
         IncomingActivityJobData::new(activity, is_authenticated)