Discord Raid Protection: How to Stop and Prevent Raids

Responding to a raid in progress

The first minute is worth more than the next hour. Work in this order.

The first thirty seconds, concretely

1. Verification level to Highest. Server Settings → Safety Setup. Requires a verified phone number, which most raid accounts do not have.
2. Pause invites. Server Settings → Invites → Pause Invites. Stops every existing link at once.
3. Remove Send Messages from @everyone in public channels if spam is already flowing.
4. Post one line telling members what is happening. Silence during a raid causes more damage than the raid.

Recognising a raid

• Join clustering. Twenty accounts in thirty seconds is not organic, whatever your growth rate.
• Uniform account age. Accounts created the same day, often the same hour.
• Default avatars and patterned usernames — the same word with incrementing numbers.
• Identical or near-identical messages posted across multiple channels simultaneously.
• Shared network origin. The same ASN or VPN exit across most of the arrivals.

That last signal is the one you can act on before anyone gets in, which is what the prevention half of this guide is about.

Discord's built-in anti-raid and anti-spam protection

Discord ships more raid protection than most owners ever turn on. It lives in Server Settings → Safety Setup, it is free, and it should be in place before you add any bot.

Raid protection and CAPTCHA

• Activity alerts. Discord flags unusual spikes in joins or DMs to your moderators, so a raid gets noticed in seconds rather than when members complain.
• CAPTCHA for suspicious accounts. Accounts Discord considers risky have to solve a CAPTCHA before they can join.
• CAPTCHA for everyone during a suspected raid. The closest thing Discord has to a built-in raid mode: every new arrival is challenged until the spike passes.

Anti-spam with AutoMod

• Block mention spam — stops the mass-ping floods that most raids open with.
• Block suspected spam content — Discord's own spam classifier, applied to messages in your server.
• Keyword filters for the slurs, scam links, and phrases you have actually seen.
• DM spam protection — filters DMs from suspicious accounts, which is where raids that fail in public channels go next.

Discord renames and moves these options from time to time. If a label here does not match what you see, look under Safety Setup and AutoMod in your own server settings.

Raid mode: one plan for the first minute

“Raid mode” or “lockdown” is what anti-raid bots call a set of emergency changes applied all at once. Wick ships a lockdown mode that does this with one command, but you can build the same thing from Discord's own controls. What matters is writing the list down before you need it:

1. Verification level to Highest so only phone-verified accounts can talk.
2. Pause invites so no new accounts arrive at all.
3. CAPTCHA every new account if you leave invites open.
4. Remove Send Messages from @everyone in public channels, and add slowmode to any channel that stays open.
5. Write down the reverse. A raid mode nobody remembers to turn off quietly becomes your server's normal state.

RestoreCord does not run a live lockdown. Its job is the layer either side of it: rules that stop raid accounts at the door, and the snapshot and recovery path for when one gets through.

Prevention that actually holds

Baseline settings (free, do these first)

• Verification level Medium or higher. Medium requires an account older than five minutes; High requires ten minutes of membership; Highest requires a verified phone.
• Raid protection and AutoMod configured as above.
• 2FA enforcement for moderation actions.
• Explicit content filter for all members.
• Fewer permanent invites. Expiring, limited-use invites reduce your exposed surface.

A verification gate with rules

Discord's native levels are blunt instruments — age and phone number only. An OAuth gate with firewall rules lets you act on the signals that actually distinguish a raid: shared ASN, VPN exit, country concentration, user-agent pattern.

The bonus is that the same verification produces an authorization that makes each member recoverable later. The gate you install to keep raiders out is also the thing that gets your community back if a raid ever succeeds.

Anti-raid bots for live detection

• Beemo — zero-configuration join-pattern raid detection, free and genuinely add-and-forget.
• Wick — heat-based spam scoring plus anti-nuke, the strongest live interceptor available.
• Security Bot — score-based join evaluation plus an independent moderation-permission system.

Compare them properly in the anti-raid bot roundup.

VPN and proxy blocking

Coordinated raids overwhelmingly run through VPNs or hosting providers, because the accounts need to look like they come from different places. VPN and proxy detection at the gate removes most of that traffic in one setting — and set a bypass password so the legitimate privacy-conscious members you also catch have a route in.

Building the stack

Recovering after a raid

Most raids are noise — spam, harassment, a bad afternoon. Some escalate into a nuke. If channels, roles, or permissions were changed, roll back from your most recent clean snapshot rather than repairing by hand; hand-repair is where subtle permission mistakes creep in.

If members were mass-banned or left, member recovery re-adds everyone who authorized beforehand. Without that authorization, no service can bring them back — the full picture is in the nuked-server recovery guide.

Do the free things this afternoon: verification level, raid protection, AutoMod, 2FA enforcement. Then add the gate and a snapshot so a raid stays an inconvenience. Start free.