How to Protect a Discord Server From Raids (2026 Playbook)

A raid is not one thing, and that is why so many servers are prepared for the wrong one. Three attacks share the word:

• The join flood. Fifty to several hundred accounts arrive within a minute or two and spam every channel they can reach. Loud, obvious, mostly recoverable.
• The nuke. One account with dangerous permissions deletes channels, deletes roles, or mass-bans. Quiet until it is over, and by far the most damaging.
• The mass DM. The attackers do not need to post in your server at all. They scrape your member list and message everyone privately, so your channels look completely normal while your members are being phished.

The join flood is the one every anti-raid guide covers. The nuke is the one that ends servers. Prepare for all three, in that order of effort.

Before anything happens

Raid defence is mostly configuration you do on a quiet Tuesday. None of this is exciting and all of it works.

Permissions are the whole nuke defence

There is no bot on Discord that can stop a full nuke from an account holding Administrator. By the time the deletions are in the audit log, they have already happened. The defence is that nobody holds that permission who does not need it.

Go through your role list and check who actually has Administrator, Manage Server, Manage Channels, Manage Roles, Ban Members and Manage Webhooks. For each holder, ask one question: if this account were compromised tonight, what could it do? Most servers find at least one role that has kept a permission from a feature they stopped using a year ago.

Then:

• Give bots the narrowest permission set they need. A levelling bot does not need to ban.
• Require 2FA for moderation actions in Server Settings. It is a single toggle and it removes an entire class of takeover.
• Audit webhooks. A leaked webhook URL lets anyone post into that channel forever, with no account and no permissions, and it survives every ban you issue. Delete the ones you do not recognise.
• Keep the owner account clean. No third-party token grabbers, no random "server management" sites, no logging into it on a machine you use to install game mods.

The cheap server settings

• Verification level Medium or High. High means a member has to be in the server ten minutes before typing, which alone defeats most join floods.
• Remove Attach Files and Embed Links from @everyone outside the channels that need them. Image spam is the dominant format and this is the cheapest counter to it.
• Turn off DMs from server members in the safety setup, which is your only structural defence against the mass-DM raid.
• Onboarding or a rules gate, so an account has to do something deliberate before it can post.
• A verification gate with a minimum account age. Raid accounts are usually registered minutes before the raid, and an account age floor is the single condition they cannot satisfy. Fenrai's verification has this as a setting rather than a rule, along with kicking members who never pass the gate.

Detecting the raid

Human moderators find out about a raid when a notification pile-up wakes someone. That is usually two to five minutes in, which is two to five minutes of spam, and if it is 4am it can be hours.

The detection has to be automatic, and the signal is simple: the server, not the member. Fenrai's moderation rules have server-level conditions for exactly this, and they count across the whole guild rather than per-user.

The join-rate rule

• Trigger: member join
• Condition: joins in window at least 25 within 60s
• Actions: enter raid mode, raise verification level, pause invites

Tune the number to your server. A server that gets four joins an hour should not use the same threshold as one that gets four hundred. Look at your busiest genuine hour in your analytics and set the threshold above it.

Server-wide actions run once per server, not once per raider, so forty accounts arriving locks the server down one time.

The similar-names rule

Raid tooling generates accounts from a pattern, so the member list fills with names that differ by a digit or a suffix.

• Trigger: member join
• Condition: similar names joined in window at least 5 within 60s
• Action: enter raid mode

This one catches slow raids that stay under a join-rate threshold, which is how a competent attacker gets past rule one.

What raid mode is for

Enter raid mode changes nothing on Discord by itself. It sets a flag that other rules read through the raid mode is active condition. That indirection is the useful part: one rule decides that something is happening, and every other rule can behave differently while it lasts.

So you write the aggressive rules with raid mode as a condition and they stay dormant the rest of the time:

• On message sent, raid mode is active and account age at most 7d, delete the message.
• On member join, raid mode is active and account age at most 1d, kick.
• On message sent, raid mode is active and has link, delete and log.

None of those are safe as permanent rules. All of them are correct for the ninety seconds a raid lasts.

The spam-burst rule

Raiders who get through the gate spread across channels fast, which is the same shape as the compromised-account spam covered in how to stop scam links:

• Trigger: message sent
• Conditions: channels used in window at least 3 within 10s, and repeated messages in window at least 3 within 10s
• Actions: purge recent messages from the last 1m, then mute

The purge matters as much as the mute. Muting stops the next message and leaves everything already posted on screen.

During the raid

If the rules did their job, your involvement starts after the lockdown, which is the right order. What is left for a human:

1. Read the mod log before acting. You need to know whether this is a hundred fresh accounts or five compromised long-standing members, because the response is opposite.
2. Do not mass-ban the member list. Raids drag real members in, and a ban wave costs you people who did nothing. Kick fresh accounts, ban the ones that posted.
3. Say something in a channel that still works. Two sentences: we are being raided, the server is locked for a few minutes, nothing is broken. Silence during a lockdown is what makes people leave.
4. Do not turn off the bot to stop the noise. It is the thing holding the line.

After the raid

The cleanup is where servers either learn something or repeat the incident next month.

• Purge the spam properly. Messages left up keep the links live for everyone who scrolls back.
• Check the audit log for permission and role changes, not just messages. A join flood is sometimes cover for something quieter happening at the same time.
• Rotate what leaked. New invite links if the old ones were posted publicly, and delete any webhook you cannot account for.
• Check the joins that were not spam. Some of the accounts that arrived during the raid were real people who saw the worst possible first impression. Their day-1 retention will tell you how many stayed.
• Adjust one threshold, not ten. If detection was late, lower the join threshold. If it fired on a normal busy evening, raise it. Changing five rules at once means you learn nothing from the next incident.

What to skip

Do not install four anti-raid bots. They fight each other, members get punished twice, and when something goes wrong nobody can tell which bot did what.

Do not rely on a blocklist of known raider names or domains. Both are regenerated faster than any list updates.

Do not leave the server in permanent lockdown. Lockdown is a response, not a configuration.

Do not make verification so hostile that real members give up. A quiz plus an account age floor stops raid tooling. An image captcha mostly stops people using screen readers.

The minimum viable setup

If you do nothing else:

1. Audit dangerous permissions and webhooks, and require 2FA for moderation.
2. Verification level Medium or High, with @everyone unable to attach files server-wide.
3. A verification gate with a minimum account age of at least a few days.
4. One join-rate rule that enters raid mode, raises verification level and pauses invites.
5. Two rules conditioned on raid mode being active, so the aggressive behaviour exists only while it is needed.
6. A mod log channel everything reports into.

That covers the join flood outright, blunts the mass DM, and makes the nuke require a mistake you have already gone looking for.

Common questions

What is a Discord raid? A coordinated attack on a server. The three shapes are a join flood with spam, a nuke where an account with dangerous permissions deletes or bans in bulk, and a mass DM wave that targets your member list without posting in the server at all.

Can a bot stop a Discord nuke? Not really. A bot can detect the deletions and lock things down afterwards, but an account with Administrator can act faster than any reaction. Nukes are prevented by permission hygiene and 2FA, not by detection.

What is the best verification level to stop raids? High if you can accept the friction, because the ten-minute wait defeats most raid tooling. Medium plus a minimum account age gate is a good compromise for servers that need new members talking immediately.

Should I ban everyone who joined during a raid? No. Ban accounts that posted, kick the fresh accounts that did not, and leave the rest. Ban waves reliably catch real members.

How do I stop mass DM raids? Turn off DMs from server members in the safety settings. That is the only structural fix, because the attack never touches your channels.

How many joins per minute should trigger raid mode? Whatever is above your busiest genuine hour. Read your own join chart and set the threshold from it rather than copying a number from a guide, including this one.