diff --git a/assets/templates/note.html b/assets/templates/note.html
index baf3203..27943d6 100644
--- a/assets/templates/note.html
+++ b/assets/templates/note.html
@@ -18,8 +18,21 @@
             <a href="/{{.ID}}/stats">statistics</a> &middot;
             <a href="/{{.ID}}/edit">edit</a> &middot;
             <a href="/{{.ID}}/export">export</a> &middot;
+            <a href="javascript:void(0)" onclick="report()">report abuse</a> &middot;
             {{end}}
             <a href="/TOS.md">terms of service</a>
+            <script>
+                function report() {
+                    var resp = prompt("Please shortly explain the problem with this note.");
+                    if (resp) {
+                        var xhr = new XMLHttpRequest();
+                        xhr.open('POST', '/{{.ID}}/report');
+                        xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
+                        xhr.send("report=" + encodeURIComponent(resp));
+                        alert("Thank you!")
+                    }
+                }
+            </script>
         </footer>
     </body>
 </html>
diff --git a/email.go b/email.go
new file mode 100644
index 0000000..d7310af
--- /dev/null
+++ b/email.go
@@ -0,0 +1,17 @@
+package main
+
+import (
+	"fmt"
+	"net/smtp"
+	"os"
+)
+
+func email(id, text string) error {
+	smtpServer := os.Getenv("SMTP_SERVER")
+	fmt.Println("DEBUG", smtpServer)
+	auth := smtp.PlainAuth("", os.Getenv("SMTP_USER"), os.Getenv("SMTP_PASSWORD"), smtpServer)
+	to := []string{os.Getenv("NOTEHUB_ADMIN_EMAIL")}
+	msg := []byte("Subject: note reported\r\n\r\n" +
+		fmt.Sprintf("Note https://notehub.org/%s was reported: %q\r\n", id, text))
+	return smtp.SendMail(smtpServer+":587", auth, to[0], to, msg)
+}
diff --git a/server.go b/server.go
index 44fe558..7163f2d 100644
--- a/server.go
+++ b/server.go
@@ -150,6 +150,16 @@ func main() {
 		return c.Redirect(http.StatusMovedPermanently, "/"+n.ID)
 	})
 
+	e.POST("/:id/report", func(c echo.Context) error {
+		if legitAccess(c) {
+			err := email(c.Param("id"), c.FormValue("report"))
+			if err != nil {
+				c.Logger().Errorf("couldn't send email: %v", err)
+			}
+		}
+		return c.NoContent(http.StatusNoContent)
+	})
+
 	e.Logger.Fatal(e.Start(":3000"))
 }