How to stop Discord raids: a layered anti-raid setup

A raid is a burst of accounts joining your server at the same time to flood channels with spam, slurs, scam links or mass mentions. Most raids are scripted: dozens of throwaway or compromised accounts join through a public invite within seconds and start posting before a human moderator can react.

You can't make a public server raid-proof, but you can make raids short, boring and cheap to clean up. The trick is layers: Discord's own settings, tight permissions, a bot that reacts in seconds, and a written plan your moderators can follow.

1. Start with Discord's built-in safety settings

Open Server Settings → Safety Setup (called Moderation in older clients). These settings cost nothing and stop a large share of low-effort raids.

• Verification level. Raise it to at least Medium (accounts must be registered on Discord for more than 5 minutes). High also makes new members wait 10 minutes before they can talk, which defeats most join-and-spam scripts. Highest requires a verified phone number. It's very effective, but it adds friction for real members.
• Discord AutoMod. Turn on Block mention spam, Block suspected spam content and Block commonly flagged words, then add your own keyword rules for scam phrases you see often ("free nitro", "airdrop claim", "support ticket" and so on).
• Require 2FA for moderator actions. If a moderator's account is stolen, the attacker can't ban or delete without the second factor.
• Explicit media filter. Scan media from all members so shock images get blocked automatically.

If your server has Community enabled, also use Rules Screening / Onboarding so new members must accept the rules before they can post.

2. Lock down permissions for new members

Raids do damage through permissions you forgot to remove. Check the @everyone role, and any role new members get automatically:

• Turn off Mention @everyone, @here and All Roles. This one setting stops the most disruptive kind of raid.
• Turn off Embed Links and Attach Files in public chat for unverified members, or limit them to a single channel.
• Turn off Create Invite for regular members, so raiders can't spread fresh invites.
• Use slowmode (5–10 seconds) in your busiest public channel. Real members barely notice it, but spam scripts do.

3. Add a bot that reacts in seconds

Humans are too slow for a scripted raid. A moderation bot can watch the join rate and act before the second wave arrives. A good anti-raid setup does four things:

1. Join-rate detection. For example: if more than 8 accounts join within 10 seconds, treat it as a raid.
2. An automatic response. Alert your moderators, lock public channels, or kick the accounts that joined during the burst.
3. An account-age gate. Brand-new accounts (for example, less than 1–3 days old) are the cheapest raid fuel. Holding them back stops most attacks with little impact on real people.
4. A verification gate. New members press a button (optionally with a captcha) to get a role that can see the rest of the server.

With GuardSmith, that is /protection antiraid for join-rate detection, the response (alert, lock every channel, or kick new joins for 5 minutes) and a minimum account age, /verification for the button-and-captcha gate, and /automod for spam, invites, links, caps and mass mentions. You can also change everything on the dashboard.

4. Your raid playbook (pin this for moderators)

When a raid starts, the order matters. Stop the inflow first, then clean up.

1. Lock it down. Run /lockdown on (or remove Send Messages from @everyone in public channels). This stops the damage immediately.
2. Stop new joins. Pause invites from the server's security actions, or delete the public invite being used. Raise the verification level temporarily.
3. Remove the raiders. Sort the member list by join date and ban or kick the burst. A moderation bot that logs cases makes it easier to see who joined when.
4. Clean the channels. Use /purge to bulk-delete the spam (Discord only allows bulk-deleting messages newer than 14 days).
5. Report it. Report the accounts and the raid to Discord Trust & Safety, especially when it involves threats, doxxing or illegal content.
6. Reopen calmly. Run /lockdown off, post a short note, and keep the stricter verification level for a day or two.

5. After the raid

• Find the entry point. Was it a public invite posted on a server list? Rotate it and set new invites to expire.
• Review your logs. Message, join and ban logs show what got through. Add those phrases or links to AutoMod.
• Check your admins. If any permissions or webhooks changed, assume an account was compromised. Reset tokens, remove unknown webhooks and re-check 2FA.
• Tune your thresholds. If the bot fired too late, lower the join threshold. If it fired during a legitimate event, such as a partner announcement, raise it for that day.

Quick checklist

• Verification level at Medium or higher
• Discord AutoMod: mention spam, suspected spam and keywords switched on
• @everyone can't mention everyone, post links or create invites in public channels
• Slowmode in busy channels
• Join-rate detection with an automatic response
• Button or captcha verification for new members
• A pinned raid playbook, and moderators who know where it is