DEV Community

Cover image for How to set up Discord AutoMod that actually catches raids (not just spam)
Julius
Julius

Posted on

How to set up Discord AutoMod that actually catches raids (not just spam)

#discord #automod #security #moderation

Most Discord AutoMod setups fail at the one thing they're supposed to do: stop raids. They catch spam words, they slow down chat, but when 50 bots join at 3am and post scam links in every channel, your AutoMod watches.

Here's how to set up AutoMod that actually works — using Cipher (free, open-source) or any bot with similar features.

The three layers you need

Layer 1: Verification gateway (stop bots before they join)

The biggest mistake is letting bots into your server in the first place. A verification gateway puts new members in a holding channel until they prove they're human.

With Cipher:

/verification setup #verify @Verified method:Browser
Enter fullscreen mode Exit fullscreen mode

This uses Cloudflare Turnstile — the same anti-bot system that protects major websites. Bots can't click it. New members verify before they see anything else.

Without Cipher: Use Discord's built-in verification level (Server Settings → Safety Setup → Verification Level). It's weaker but better than nothing.

Layer 2: AutoMod rules (catch what slips through)

Set up these rules in order of severity:

  1. Anti-spam: Rate limit messages (3 per 5 seconds is a good start). Auto-mute repeat offenders.
  2. Anti-invite: Block Discord invite links from non-staff. This kills 90% of scam promotion.
  3. Anti-mention: Block mass mentions (@everyone, @here, role pings from non-staff).
  4. File scan: Quarantine executable files, zip bombs, and anything with mismatched extensions.

With Cipher:

/automod toggle true
/automod antiinvite true
/automod filescan true warn
Enter fullscreen mode Exit fullscreen mode

Layer 3: Manual review (for edge cases)

No automated system is perfect. Set up a log channel where AutoMod actions are posted, so your team can review false positives and adjust rules.

The setup that stops most raids

  1. Verification gateway with Cloudflare Turnstile
  2. Anti-spam: 3 messages per 5 seconds → mute
  3. Anti-invite: block all invite links from non-staff
  4. File scan: quarantine .exe, .scr, .bat, .zip with macros
  5. Log channel for review

This setup catches 95% of raids automatically. The remaining 5% need manual intervention — but your team will be ready because they got an alert, not a surprise.

Common mistakes

  • Verification too easy: A single reaction click isn't enough. Bots can click reactions. Use a browser-based challenge.
  • No file scanning: Most admins ignore this until someone drops a RAT in #general. Then it's too late.
  • AutoMod too aggressive: If you mute people for 2 messages in 3 seconds, you'll mute legitimate users. Tune your thresholds.
  • No log channel: Without logs, you can't tell why someone was muted or adjust false positives.

Tools

  • Cipher (free, open-source): https://cipher-dc.vercel.app — verification, AutoMod, file scan, all in one
  • Discord's built-in AutoMod: free, basic, no file scanning
  • Wick: paid, good anti-raid, no file scanning

The point isn't which tool you use — it's that you have all three layers. One layer is not enough.

Raids happen at 3am. Your AutoMod should be ready.

Top comments (0)