diff --git a/app/models/status.rb b/app/models/status.rb
index ce642f9bf..157986e24 100644
--- a/app/models/status.rb
+++ b/app/models/status.rb
@@ -37,6 +37,8 @@ class Status < ApplicationRecord
 
   LOCAL_DOMAINS = ENV.fetch('LOCAL_DOMAINS', '').chomp.split(/\.?\s+/).freeze
   LOCAL_URIS = LOCAL_DOMAINS.map { |domain| "https://#{domain}/%" }.freeze
+  FORCE_SENSITIVE = ENV.fetch('FORCE_SENSITIVE', '').chomp.split(/\.?\s+/).freeze
+  FORCE_UNLISTED = ENV.fetch('FORCE_UNLISTED', '').chomp.split(/\.?\s+/).freeze
 
   # If `override_timestamps` is set at creation time, Snowflake ID creation
   # will be based on current time instead of `created_at`
@@ -293,6 +295,8 @@ class Status < ApplicationRecord
 
   after_create :set_poll_id
 
+  after_find :limit_visibility
+
   class << self
     def selectable_visibilities
       visibilities.keys - %w(direct limited)
@@ -547,6 +551,13 @@ class Status < ApplicationRecord
     self.sensitive  = false if sensitive.nil?
   end
 
+  def limit_visibility
+    return unless has_attribute?(:uri) && !uri.nil?
+    domain = Addressable::URI.parse(uri).host
+    self.sensitive = true if domain.in?(FORCE_SENSITIVE)
+    self.visibility = :unlisted if domain.in?(FORCE_UNLISTED)
+  end
+
   def set_locality
     if account.domain.nil? && !attribute_changed?(:local_only)
       self.local_only = marked_local_only?