Answer first
What to know
- Before a raid, enable Discord verification, AutoMod, mention limits, raid alerts, moderator 2FA, and a private incident channel.
- During a raid, pause invites, raise verification, enable slowmode, tighten AutoMod, lock affected channels, and preserve an incident record.
- After containment, remove malicious content, reverse unsafe changes, review compromised accounts, and document which control failed first.
- Guardy adds join gates, anti-nuke detection, panic mode, cases, reversals, and raid cleanup to the native Discord safety layer.
A Discord raid is a coordinated wave of malicious joins or activity intended to spam, harass, post shocking material, or damage server structure. The fastest response comes from controls prepared before the first alert. Build a short incident checklist, give moderators the permissions required to use it, and test it outside a real emergency.
Before a raid: reduce the available damage
Start with Discord’s native safety controls. Third-party automation should extend that baseline, not replace it.
Set an appropriate verification level
Verification levels can require a verified email, an older Discord account, time spent in the server, or a verified phone number before a member can interact. Public servers should not use no verification by default. Raise the level when the server becomes more visible or has an active threat.
Turn off broad mentions for ordinary members
Disable permission to mention @everyone, @here, and broad roles for members who do not need it.
Mention spam is disruptive even when every other message is deleted quickly.
Configure AutoMod and alerts
Enable mention-spam and message-spam controls. Send alerts to a private incident channel. Add narrow custom rules for raid phrases or invite patterns observed in the community, then test them with an ordinary member account. The Discord AutoMod setup guide covers the full process.
Require 2FA for moderator actions
Discord can require moderators and administrators to use two-factor authentication for sensitive actions. This reduces the chance that one stolen staff account becomes an internal nuke.
Keep permissions narrow
Audit Administrator, Manage Roles, Manage Channels, Manage Webhooks, Ban Members, and mention permissions. Remove permissions that a role does not need every day. A smaller trusted surface gives anti-nuke controls less to defend.
During a raid: contain first, investigate second
When malicious activity is active, stop new damage before trying to understand every account.
- Acknowledge the alert. Assign one moderator to coordinate and one to record decisions.
- Pause server invites. Discord recommends pausing invites during an active raid so the join stream stops while staff contains the incident.
- Raise verification. Move to High or Highest temporarily when the threat justifies the member friction.
- Enable slowmode. Apply it to affected channels to reduce message volume.
- Tighten AutoMod. Add phrases currently used by raiders, lower the mention threshold, and enable block plus alert responses.
- Lock affected channels. Remove send permissions from the least trusted roles while keeping the moderator incident channel available.
- Use panic mode if configured. A prepared panic action should apply reviewed restrictions, not improvise a large permission rewrite.
- Preserve evidence. Record timestamps, account IDs, affected channels, triggered rules, and staff actions before bulk cleanup.
Discord may surface Activity Alerts when unusual join or DM behavior appears. Configure the alert channel in Server Settings > Safety Setup > Raid Protection and CAPTCHA where available.
Raid response by failure mode
| What is happening | Immediate control | Follow-up |
|---|---|---|
| Mass joins | Pause invites and raise verification | Review join source and account age pattern |
| Message flood | Slowmode, AutoMod, channel lock | Purge malicious content after evidence capture |
| Mention spam | Lower mention limit and block | Remove mention permission from ordinary roles |
| Explicit media | Tighten media filtering and lock uploads | Review content filter settings |
| Channel or role deletion | Remove compromised authority and trigger anti-nuke response | Restore structure and rotate staff credentials |
| Compromised bot | Remove or isolate its role | Rotate its token and review integration permissions |
After the raid: recover without hiding the lesson
Clean malicious messages, reverse unsafe changes, and remove confirmed raiders. Do not bulk-ban solely from a weak signal such as a new account age without reviewing false-positive risk.
Then review the sequence:
- Which alert fired first?
- How long did staff take to see it?
- Which permission allowed the most damage?
- Did the panic or lockdown procedure behave as documented?
- Were legitimate members blocked, and can their access be restored quickly?
- Did the team preserve enough evidence for a report to Discord?
- Which one change would reduce impact next time?
Publish a short member update that explains what happened, what data or channels were affected, and what changed. Avoid sharing details that teach attackers how to bypass the new control.
Where Guardy fits
Guardy’s moderation module connects a join gate, anti-nuke detection, panic mode, raid cleanup, cases, escalation, and reversals. The objective is not to claim that one bot makes a server impossible to raid. It is to reduce time to containment, limit destructive authority, and make the response reviewable afterward.
Native Discord verification, AutoMod, safety alerts, staff training, and narrow permissions remain part of the system. Layered controls are more dependable than asking one filter to solve every raid. For an established alternative with a different operational model, read the sourced Guardy vs Dyno comparison.
