How to Set Up Verification on Your Discord Server

Discord's verification levels, a verification gate, and a full verification system — step by step, plus the five mistakes that cost more members than they save.

By RestoreCord Editorial TeamPublished February 16, 2026Reviewed October 17, 2026

TL;DR

Every verification type filters some abuse. Only one leaves anything behind: an OAuth2 gate produces an authorization that lets you re-add those members if the server is ever lost. Same friction for the member as a CAPTCHA, radically different value to you. Set up Discord's native level first because it is free, then add an OAuth gate, then add firewall rules gradually against abuse you have actually seen.

What verification is really doing

A gate is not a yes/no door, it is a funnel of decisions you configure. Understanding it that way is what stops people from over-trusting it.

Verification funnel

  • Clicked the verify button1,000

    Raw traffic hitting your verification page

  • Completed Discord OAuth842

    Real Discord accounts, consent recorded

  • Passed firewall rules731

    IP, ASN, country and user-agent rules applied

  • Passed VPN and alt checks664

    Proxy, VPN and duplicate-account signals

  • Granted the verified role664

    Recoverable later if the server is lost

Illustrative numbers, not measured averages — your own rates depend entirely on which rules you enable. The point is the shape: each layer is a decision you configure, and everyone who reaches the bottom is recoverable later.

Be clear-eyed about the limit: verification proves an account completed a flow. It does not prove the account belongs to a distinct, trustworthy person. It raises the cost of abuse — worthwhile, but not identity.

The four types of Discord verification compared

TypeMember frictionWhat it stopsWhat it leaves behindBest for
Discord verification levelsNoneBrand-new and phone-less accountsNothingEvery server, as a free baseline
Reaction rolesOne clickAlmost nothing automatedNothingRule acknowledgement, not security
CAPTCHA botsOne puzzleNaive automationNothingBot-heavy spam with no recovery need
OAuth2 verificationOne authorizationAutomation, plus whatever your rules addA recoverable authorizationServers that would not survive losing their members

The fourth column is the whole argument. A CAPTCHA and an OAuth authorization ask roughly the same of a member; one produces nothing durable and the other produces the thing that saves your community later.

Step 1: Set Discord's verification level

Every Discord server has a built-in verification level. It is free, takes a minute, and stops brand-new and throwaway accounts before any bot is involved. Open Server Settings → Safety Setup → Verification Level and pick one:

LevelWhat a member needs before they can talk
NoneNo restriction
LowA verified email address on the Discord account
MediumLow, plus registered on Discord for longer than 5 minutes
HighMedium, plus a member of your server for longer than 10 minutes
HighestA verified phone number on the Discord account

Medium suits most servers. Keep Highest for emergencies — a verified phone stops most raid accounts, and also a fair number of real members.

Step 2: Add Discord's verification gate (Rules Screening)

Community servers can turn on Rules Screening, which makes new members accept your rules before they can send messages. It is a gate for acknowledgement, not security: it stops nothing automated and leaves nothing behind. Use it so members have read the rules, and pair it with a real verification system if you need protection.

Step 3: Add a verification system with a bot

A verification bot is what turns a server into a verification system: new members land in one visible channel, verify, and get the role that unlocks everything else. Here is the setup with RestoreCord.

Setup sequence

  1. 1

    Connect your bot

    Your own Discord application, added with the permissions it needs and nothing more.

  2. 2

    Add the server

    Choose the server, name the verify link, and pick the role verification gives or removes.

  3. 3

    Set up verification

    RestoreCord picks the verify channel, hides protected channels, and publishes the verify message.

  4. 4

    Test end to end

    Verify from a spare account on mobile data, then confirm the bypass password works.

Run setup before you share the verify link. Publishing verification while protected channels are still public teaches members it is optional.
  1. Create your account and connect a custom bot. In the dashboard, open Bots → Add New Bot and follow the wizard. Custom bots are included on every plan — verification under your own name and avatar builds noticeably more trust than a shared bot.
  2. Add the server. Servers → Add new server: pick the Discord server, name your verify link, and choose whether verifying gives a verified role, removes an unverified role, or both. RestoreCord's free plan covers one server with the full verification and recovery workflow.
  3. Position the bot role correctly. It must sit above the role it manages. This is the single most common setup failure.
  4. Run Set up verification. On the server's Discord Integration card, it proposes a verify channel and the channels to protect, previews the verify message, and only changes Discord after you confirm. It edits View Channel only, and staff channels are always left alone. Prefer to choose yourself? Configure manually instead.
  5. Edit the verify message. Say what the authorization does in plain language. “This lets us re-add you if the server is ever lost” converts far better than an unexplained button.
  6. Test from a spare account. On mobile data, not your own network — that is how you catch rules that block real members.

The docs walk through verification channel setup and designing the verify message screen by screen.

Step 4: Add firewall rules

For possible duplicate accounts, configure alt detection during verification and start with webhook warnings before enabling blocks or automatic bans. Read how to review Discord alt-account matches before deciding how to handle shared IPs and devices.

Rules are where a gate stops being decorative. Add them one at a time, against abuse you have actually observed.

Firewall decisions during verification

Verification attemptsIP and ASN rules−3Country rules−2VPN and proxy checks−4User-agent and alt signals−2Verified role granted
Every verification attempt is evaluated against your configured rules before the member is let in. Redis bypass entries are checked first, so allowlisted members never hit the rule chain.

The order to add them in

  • VPN and proxy detection first. The broadest win for the least tuning, and it catches the majority of coordinated attempts.
  • ASN rules second. Raids frequently share a hosting provider. Blocking that ASN costs you very few genuine members.
  • Country rules last, and sparingly. They are blunt and will catch members who travel.
  • User-agent conditions for specific patterns once you have logs showing one.
  • A bypass password from day one, before any of the above.

Five mistakes that cost members

1. No holding channel

A member who joins and sees nothing at all assumes the server is broken and leaves. Always leave one visible channel explaining what to do.

2. Too strict, too early

Every rule costs some legitimate joins. Starting with country blocks and aggressive alt thresholds on a server that has never been raided trades real members for hypothetical safety.

3. Not testing before going live

Test from an account that is not yours, on a network that is not yours. Half of all broken verification setups are a bot role positioned below the role it needs to assign.

4. Ignoring the logs

Firewall decisions are logged for a reason. If completions drop after you add a rule, the log tells you which rule and why — rules tuned from evidence always beat rules tuned from intuition.

5. No bypass password

Without one, the only response to a blocked legitimate member is disabling the rule. Do that three times and you have no filtering left.

Our verdict

OAuth2, with rules added gradually

All verification types filter. Only OAuth2 leaves behind an authorization that still helps you on the day the server is gone — for the same friction a CAPTCHA costs.

  • The authorization makes every verified member recoverable later, uncapped on any plan
  • Firewall rules on IP, ASN, country, and user-agent act on real raid signals
  • Bypass passwords keep strict rules from becoming a support queue
  • Custom bots let verification run under your own branding on every plan
  • Discord's native verification level stays free underneath it all

Where that flips: If your only problem is naive spam bots and you have no interest in recovery, a CAPTCHA gate is simpler and does that job. VaultCord offers CAPTCHA via Turnstile if you want both in one product.

Set Discord's native level today — it is free and takes a minute. Then add the gate that keeps working after the server does not. Start free, or compare the options in the verification platform comparison.

Frequently asked questions

Sources and verification

Vendor features and limits were checked against these primary or first-party references. Recheck time-sensitive details before purchasing.

Related Articles

Ready to Get Started?

Join thousands of server owners who trust RestoreCord to protect and grow their Discord communities.