Protecting a Discord server from raids and fake accounts
A raid means having a large number of accounts join a server in a short time, to flood its channels or mass-mention its members.
The right defence is not detecting the raid as it starts, but making sure a freshly arrived account cannot write anything until a human has let it in.
The layer Discord provides
In the server settings, the verification level sets conditions on writing: a verified email address, an account older than five minutes, or membership of the server for more than ten minutes. The highest level requires a verified phone number.
This layer is free, immediate, and stops the least sophisticated waves. It is not enough on its own: aged, verified accounts are resold, and a prepared raid uses them.
Close the server by default
This is the most effective measure, and the most often skipped. Remove from the @everyone role the permission to view channels, except for a single landing channel. An account joining the server then has nothing to flood.
Real access comes from a separate role, granted only after verification. Until that role is given, the newcomer sees a closed door — however many accounts arrived at the same time.
Approve arrivals by hand
With Eric's verification module, each arrival posts a validation request in a staff-only channel. A moderator reacts to accept, and the access role is granted automatically.
The value of this approach is that it rests on no heuristic. Automatic filters — account age, missing avatar, suspicious username pattern — are worked around by preparing accounts in advance. A moderator watching forty identical requests arrive in two minutes is not fooled.
What to prepare before the incident
- An access role distinct from @everyone, with channel permissions that genuinely depend on it.
- The bot's role placed above the access role in the hierarchy.
- A validation channel visible to staff only.
- Discord's verification level set to at least medium.
- A written instruction for the team: who raises the verification level, and when.
During a raid
- Immediately raise the server's verification level to its maximum: this blocks writing from accounts without a verified phone number.
- Suspend active invites if the raid arrives through a publicly shared link.
- Ban rather than kick: a kick lets them return with the same invite.
- Do not delete the messages before collecting the account identifiers, which are needed to report them to Discord.
- Restore the settings once the wave has passed, or genuine new members stay locked out.