Protecting a Discord server from raids and fake accounts
A raid means having a large number of accounts join a server in a short time, to flood its channels or mass-mention its members.
The right defence is not detecting the raid as it starts, but making sure a freshly arrived account cannot write anything until a human has let it in.
The layer Discord provides
In the server settings, the verification level sets conditions on writing: a verified email address, an account older than five minutes, or membership of the server for more than ten minutes. The highest level requires a verified phone number.
This layer is free, immediate, and stops the least sophisticated waves. It is not enough on its own: aged, verified accounts are resold, and a prepared raid uses them.
Close the server by default
This is the most effective measure, and the most often skipped. Remove from the @everyone role the permission to view channels, except for a single landing channel. An account joining the server then has nothing to flood.
Real access comes from a separate role, granted only after verification. Until that role is given, the newcomer sees a closed door — however many accounts arrived at the same time.
Require an action from the newcomer
With Eric's verification module, each arrival posts a request in the verification channel, addressed to the new member: react with one specific emoji to be granted the access role. The bot adds that emoji plus a reject one, and only accepts the reaction if it comes from the person named.
The accept emoji is drawn at random on each arrival. That is what makes the filter: a script reacting to everything, or one that learned a fixed emoji, lands on the reject one and gets kicked. An account prepared in advance works around nothing, because there is nothing to prepare — the message has to be read as it arrives.
This approach has a cost worth knowing: the kick is immediate and automatic. A legitimate member who clicks the wrong reaction ends up outside, and will need re-inviting.
What to prepare before the incident
- An access role distinct from @everyone, with channel permissions that genuinely depend on it.
- The bot's role placed above the access role in the hierarchy.
- A verification channel visible to everyone, newcomers included: it is where they must react.
- Discord's verification level set to at least medium.
- A written instruction for the team: who raises the verification level, and when.
During a raid
- Immediately raise the server's verification level to its maximum: this blocks writing from accounts without a verified phone number.
- Suspend active invites if the raid arrives through a publicly shared link.
- Ban rather than kick: a kick lets them return with the same invite.
- Do not delete the messages before collecting the account identifiers, which are needed to report them to Discord.
- Restore the settings once the wave has passed, or genuine new members stay locked out.