diff --git a/src/routes/channels/message_bulk_delete.rs b/src/routes/channels/message_bulk_delete.rs
index fad6e2fb..65aae1bf 100644
--- a/src/routes/channels/message_bulk_delete.rs
+++ b/src/routes/channels/message_bulk_delete.rs
@@ -1,3 +1,4 @@
+use chrono::Utc;
 use revolt_quark::{
     models::{Message, User},
     perms, Db, EmptyResponse, Error, Permission, Ref, Result,
@@ -19,6 +20,8 @@ pub struct OptionsBulkDelete {
 /// Delete multiple messages you've sent or one you have permission to delete.
 ///
 /// This will always require `ManageMessages` permission regardless of whether you own the message or not.
+///
+/// Messages must have been sent within the past 1 week.
 #[openapi(tag = "Messaging")]
 #[delete("/<target>/messages/bulk", data = "<options>", rank = 1)]
 pub async fn req(
@@ -32,6 +35,19 @@ pub async fn req(
         .validate()
         .map_err(|error| Error::FailedValidation { error })?;
 
+    for id in &options.ids {
+        if ulid::Ulid::from_string(id)
+            .map_err(|_| Error::InvalidOperation)?
+            .datetime()
+            .signed_duration_since(Utc::now())
+            .num_days()
+            .abs()
+            > 7
+        {
+            return Err(Error::InvalidOperation);
+        }
+    }
+
     perms(&user)
         .channel(&target.as_channel(db).await?)
         .throw_permission(db, Permission::ManageMessages)