Set up Discord raid protection: protect your server from raids, spam and nukes

A raid usually comes without warning: dozens of new accounts join almost at once and flood your channels with spam, scam links or disturbing content. A nuke is even more dangerous: an account with too many permissions deletes channels and roles or bans members within a short time. Often it is a hijacked account from your own team.

Good Discord raid protection has three parts: prevention, automatic detection and a plan for emergencies. In this guide you set up all three, with Discord's own settings and with Lizbot.

Raid or nuke: what you are up against

In a raid, the attack comes from outside. Typical signs are many fresh accounts without an avatar that join through the same link and start posting right away. Verification, AutoMod and join wave detection help here.

In a nuke, the attack comes from inside. An account with admin permissions, a badly configured bot or a team member whose account was taken over deletes channels and roles. Sparing permissions, anti-nuke and an up-to-date backup help here.

Discord basics first

Before you set up a bot, check your server settings:

• Verification level: at least Medium, so brand new accounts can't post right away.
• 2FA requirement for moderation: Discord can require everyone with moderation permissions to have 2FA enabled. That makes hijacked team accounts much rarer.
• Administrator permission: Only give it to people you would trust with the whole server, and to no bot that doesn't really need it.
• Role order: Moderators should not be able to manage roles that sit above their own.

1. Turn on AutoMod and phishing protection

The first line of defense is AutoMod. In the dashboard under AutoMod, use Load AutoMod level to apply the Standard level. That enables the word filter, invite links, mass mentions and the spam filter. On the Phishing tab, switch on Use public scam lists. Lizbot updates these lists every six hours and also detects lookalike Discord and Steam addresses.

All settings in detail are in the guide Set up Discord AutoMod.

2. Put verification in front

Verification keeps simple bots out. New members only see one channel at first and get the rest after a click, a captcha or an email code. Set a Minimum account age of a few days as well. How to do that is covered in the guide Set up Discord verification.

3. Turn on automatic raid protection (Pro)

In the dashboard under AutoMod, on the Spam & raid tab, you find the Raid protection section. It counts how many accounts join within a short time:

• Joins and in seconds: when a wave counts as a raid; the Standard level uses 10 joins in 30 seconds
• Suspicious: account younger than: accounts below this age in days count as suspicious during a raid
• Action for suspicious joins: kick, ban or alert only
• Lock the server during a raid: temporarily raises the verification level to High
• Lockdown duration and Alert channel

When Lizbot detects a wave, it locks the server for the set duration and posts an alert. At the same time, the dashboard shows a "Raid detected" notice. When the time is up, Lizbot automatically restores the previous verification level.

For small and medium servers, the Standard level values are a good start. If you often get big rushes, for example after a stream, raise the number of joins so real visitors don't trigger a lockdown.

4. Keep an eye on alt accounts and joins

On the Alt accounts tab, Lizbot rates every join with a risk score. It goes up for very young accounts, a missing avatar, typical default names and several new accounts joining through the same invite. From a score of 60, Lizbot reports the account with buttons to kick, quarantine or ignore. This detection is included in the Free plan too.

Under Recent joins you see every join with account age, invite and the member who invited them. With suspicious only you filter for conspicuous joins, and the User ID field narrows it down to a single member. That way you quickly find out which link a raid came through.

5. Turn on anti-nuke

Anti-nuke is off by default. You turn it on in the dashboard under Moderation on the Anti-nuke tab. Lizbot then counts per account how many channels and roles are deleted and how many members are banned or kicked. The defaults: 5 deleted channels, 5 deleted roles, 8 bans or 8 kicks within 30 seconds.

If a limit is exceeded, the Action when a limit is exceeded kicks in: Remove dangerous roles, Kick or Ban. If a backup exists, the alert in the Alert channel offers a button to restore missing channels and roles from the latest backup. The server owner is always exempt. Add bots that clean up regularly under Exempt user IDs. Bans and kicks a moderator carries out through Lizbot count towards that moderator.

6. Create a backup

If something does happen, a backup helps. Lizbot saves channels, roles and permissions and restores them. The Free plan includes one saved backup, Pro includes ten. From Pro, backups run automatically and can be copied to another server, and in Studio messages can be backed up as well. More in the guide Discord backup.

During a raid: immediate steps

Even without Pro you can always react yourself:

• /channel lockdown start raises the verification level to High, for 15 minutes by default, and with the minutes option for up to 24 hours. /channel lockdown end ends the lockdown early.
• /channel lockall locks all text channels for regular members after a confirmation, /channel unlockall reverses it.
• /channel slowmode slows down a single channel, /channel purge cleans up spam messages.
• /quarantine add takes all roles from a suspicious member until you have sorted out the case. /quarantine remove undoes it.

Once the wave is over, ban the raid accounts in one go instead of one by one. In the dashboard under Cases, admins open the Mass action, paste up to 200 user IDs and confirm with a confirmation word. You find the IDs under Recent joins. Every ban is saved as its own case with a reason.

Checklist

• verification level at least Medium, 2FA requirement for moderation on
• AutoMod with phishing protection is enabled
• new members have to verify
• raid protection with lockdown is configured (Pro)
• anti-nuke is on and an alert channel is set
• only a few trusted accounts have admin permissions
• an up-to-date backup exists
• your team knows /channel lockdown start and the mass action

Common mistakes

• Anti-nuke never turned on: It is off by default. Without the switch, it protects nothing.
• No alert channel: Lockdowns then happen silently and your team notices nothing.
• Raid threshold too low: With 3 joins in 30 seconds, an active server locks itself down at every event.
• Lizbot lacks the Manage Server permission: Then the lockdown can't raise the verification level. Lizbot reports this, but the protection doesn't kick in.
• Creating a backup after the nuke: Then it only saves the destroyed state.