Protecting a Discord Server From Raids: 7 Settings That Actually Help

A raid almost always runs the same way. Between two and five in the morning, fifty to three hundred freshly created accounts join, post the same message in every channel, ping @everyone and disappear again. When you wake up, your server is full of advertising for a crypto site and half your members have muted notifications.

The annoying part: most of these attacks are cheaply automated and fail against very simple hurdles. If you run a server that is publicly discoverable, work through the following seven points. The first four are built into Discord and cost nothing but a few minutes.

1. Raise the verification level

This is the single most effective setting, and it gets overlooked constantly.

Under Server Settings, Moderation, Verification Level you decide what an account has to bring before it may post in your server. The levels mean:

Level	Requirement
Low	Verified email address
Medium	Account registered with Discord for at least 5 minutes
High	Member of your server for at least 10 minutes
Highest	Verified phone number

Medium is the minimum for any public server. High is the point where most automated raids stop working, because the attacker would have to park their accounts for ten minutes before they can do anything. That does not pay off for them.

Highest sounds tempting but also locks out many genuine users who do not want to hand their phone number to a chat app. Only use it while you are actively under attack.

2. Turn on Discord's own AutoMod

Discord has had built-in moderation for a while that many server owners have never opened. Under Server Settings, AutoMod you can enable filters against spam links, mass mentions and commonly abused words in two clicks.

It does not replace a proper filter, but it is free and available immediately.

3. Clean up who actually has permissions

The most unpleasant case is not a raid from outside but an account from inside that got taken over. Somebody on your team falls for a phishing link, the attacker suddenly holds administrator permissions, and four minutes later every channel is gone.

Go through your role list once and ask, for every role with Administrator, whether that person really needs it. In the vast majority of cases the specific permissions are enough:

• A supporter needs Manage Messages and Timeout Members, not Administrator.
• An event manager needs Manage Channels in one category, not server-wide.
• A bot rarely needs everything, even if its invite suggests everything.

You should also require two-factor authentication for every staff member. Under Server Settings, Safety Setup there is a switch that blocks moderation actions without 2FA.

4. Limit invites

A raid needs an invite link. If your link has sat unchanged in a server list for two years, it has ended up in a collection that gets worked through in rotation.

For public listings, create invites with an expiry date and a usage limit instead of spreading an unlimited link. Under Server Settings, Invites you can see every active link and revoke old ones.

5. Enforce an account age

This is where Discord's built-in tools end. Verification level Medium requires five minutes of account age, which is no obstacle for a serious attacker. Anyone who creates their accounts a week in advance still gets through.

A bot can check the Discord account's creation date and automatically remove accounts below a threshold. Seven days is a good default: it catches almost every throwaway account but barely stops genuine newcomers.

One thing matters here: use kick, not ban. A kicked account may come back once it is old enough. A ban eventually hits somebody who only just signed up to Discord because a friend invited them.

In AlphaCloud this is the Account Age module, which you set up in the web panel with two fields.

6. Put verification in front of the server

The principle: new members see exactly one channel. Only when they do something there do they get a role that opens the rest.

The effort for you is one-time:

1. Remove visibility for all channels except the verification channel from @everyone.
2. Create a role that may see everything else.
3. Have a bot grant that role on a button press.

A simple button already stops pure messaging bots. If your server is being deliberately targeted, a small maths problem is the better choice, because it cannot be clicked through blindly.

The side effect is pleasant: the member list immediately shows you who has been through verification and who has not.

7. An automatic emergency brake

The first six points prevent most of it. For the rest you need something that reacts faster than you do.

The idea behind it is simple: a single action is not suspicious, its speed is. One deleted channel is routine. Ten deleted channels in twenty seconds, from an account that became administrator yesterday, is an attack.

An anti nuke system counts such actions, weights them and steps in when a threshold is crossed. What makes sense:

• Quarantine rather than ban for humans. The attack stops immediately, but you can hand the roles back if it was a false alarm.
• A log channel, so you can see in the morning what happened.
• A whitelist for your leadership and for bots that legitimately do a lot.

AlphaCloud calls this module Anti Nuke. It can also restore deleted channels and roles, though with an important limitation any honest system should tell you: the message history does not come back. Restored channels are empty. This is damage control, not a backup.

What to do, in order

If you only have twenty minutes today:

1. Verification level to High (2 minutes)
2. Go through roles with Administrator (10 minutes)
3. Revoke old invite links (3 minutes)
4. Turn on Discord AutoMod (5 minutes)

That handles most of it. Points 5 to 7 become worth it once your server grows past a few hundred members, or if you have already been hit.

And one last piece of advice that has nothing to do with settings: back up your server structure. Roles, categories, channels. If it does happen, that one file is the difference between half an hour and a whole weekend.