How to Stop Discord Bot Spam and Raids Without Adding Moderator Hours
The safety layer most teams staff with people and should be running as infrastructure, and the one number that proves which one you have.
📌 How to stop Discord bot spam and raids without adding moderator hours: move the first filter off your people and into four automated entrance checks, then maintain the term list weekly instead of once. Measure human spam touches per week. A falling number means you built a system. A flat number means your moderators are still the system.
The answer sits at the entrance, not on the schedule
The first filter in your server should never be a person. That is the whole answer, and everything below is how to build it. Automated spam accounts, lookalike profiles and coordinated join waves do not arrive between nine and five. They arrive constantly, in volume, from accounts that cost nothing to create. When your response to that is a moderator watching a channel, you have staffed a permanent, unwinnable shift. The moderator gets slower as the night goes on, the room stays exposed in the hours nobody covers, and the person doing the work starts to resent the community they signed up to build. Moving the first filter into automation does not mean removing your team. It means changing what your team is for. Automation handles the arriving volume. People handle judgement calls, appeals, edge cases and the members worth talking to. That split is the difference between a safety layer that costs you money every month and one that quietly does its job.
What is actually arriving at your door
Before configuring anything, separate the three things people lump together as spam. They fail for different reasons and they need different checks.
| What arrives | What it looks like | What actually stops it |
|---|---|---|
| Volume spam | Fresh accounts posting the same link or phrase across several channels | An entry delay plus a maintained blocked term list |
| Coordinated waves | Many accounts joining inside a short window, all created recently | Account age flagging and a raised verification requirement at the door |
| Impersonation | A profile copying your team's display name and avatar, messaging members privately | A name and avatar match check, plus a stated rule that staff never open a private conversation first |
Treat these as one problem and you build one blunt rule that catches real members. Treat them as three and each check stays narrow enough to run without supervision.
The five checks that do the work
Every one of these runs without a human present. Set them once, then maintain the two that need maintaining.
- An entry delay. A new account cannot post the moment it lands. Raising the verification requirement so recently created accounts wait before they can send messages removes most drive by volume on its own. Discord's own settings and safety documentation cover the mechanics at support.discord.com.
- An account age flag. Any join from an account created in the last few days lands in a low permission state and shows up in a log. Real members clear it in a minute. Disposable accounts never bother.
- A blocked term list. Automated filtering on the specific wording your attackers use, which is not the same wording anyone else's attackers use.
- A lookalike check. Watch new profiles against your staff names and avatars. Impersonation is the one attack where a single message can cost a member real money.
- One log channel. Every automated action writes to a single place. No log means no learning, and no learning means you tune the system by memory and argument.
⚠️ The most common failure here is not a missing check. It is five checks that all write to nowhere. If your team cannot answer "what did the filter catch last night" in under a minute, the log channel is the thing to build first.
Your blocked term list is a document, not a setting
This is where most setups quietly die. Someone configures a filter during buildout, feels finished, and never opens it again. Six weeks later the wording has moved and the list is decoration. A term list is a maintained document. It has an owner, a review slot, and a source of new entries. The source is your own members, because they see the new wording before your filter does. Every report your team receives is raw material, so the loop is short: a member reports, a moderator resolves it, the wording goes on the list the same week, and the same message never needs a human again. A workable structure looks like this, kept somewhere your team can edit without touching server settings:
CATEGORY: financial bait
terms: [current scam phrasing observed in reports]
added: date, added by: name, source: report link
action: block message, flag to log channel
review: weekly
CATEGORY: staff impersonation
terms: [staff display names, common misspellings, added on hire]
added: date, added by: name, source: onboarding checklist
action: block message, flag to log channel, notify moderation lead
review: on every hire and departure
CATEGORY: off platform redirects
terms: [invite patterns and redirect wording seen in the last 30 days]
action: block message, flag to log channel
review: weekly
A filter that is never edited is a filter that was accurate once.
The review slot matters more than the length of the list. Fifteen minutes a week, owned by one named person, beats a list of thousands of terms nobody has read since launch.
Impersonation deserves its own rule
Every other category on this page costs you attention. Impersonation costs your members money, and the damage lands on your brand rather than on the attacker. The structural fix has two parts and neither is a filter. First, publish one line in your rules and repeat it in onboarding: staff never open a private conversation first, and never ask for payment or credentials. Say it before anyone needs it, because a member who has read that line once will not act on the message when it arrives. Second, make your real team visibly identifiable inside the room through roles that display in the member list, so identity is something a member can check in three seconds without asking anyone. The automated check catches the copy. The published rule and the visible team are what make the copy useless.
The number that tells you whether it worked
Count how many spam messages a human had to touch. Deleted by hand, banned by hand, answered by hand. One number, counted weekly, owned by the same person who owns the term list.
| What the trend says | What it means | What to change |
|---|---|---|
| Falling week over week | The automated layer is absorbing new patterns | Nothing, keep the review slot |
| Flat | The checks exist and the list is stale | Reconnect member reports to the weekly review |
| Rising | Your people are the filter again | Raise the entrance requirement before touching anything else |
Member count tells you nothing about safety. Human touches per week tells you exactly how much of your safety layer is still being carried by people.
Where this layer sits in the larger system
Safety is the floor. It is not the building. Above it sit the onboarding and first forty eight hours system, support routing so questions reach someone who can answer them, escalation paths for the situations moderation should never decide alone, documentation so answers stop living in one person's head, and reporting so leadership can see what the community returns. Each of those layers assumes the floor holds. When it does not, every layer above it inherits the instability, which is why teams with a shaky safety layer describe their community work as constant firefighting no matter how many people they hire. The order is worth stating plainly. Fix the floor, then build up. A team that runs the five checks and the weekly review has bought back the hours it needs to build everything else.
Run it this week
- Raise the entrance requirement so newly created accounts cannot post immediately
- Turn on account age flagging and route flagged joins to a low permission state
- Create one log channel and point every automated action at it
- Move your blocked terms into a document with an owner and a weekly review slot
- Publish the line about staff never messaging first, in the rules and in onboarding
- Start the count of human spam touches, and read it again in four weeks
Good community operations are mostly invisible. The rooms that feel calm are not lucky, they are built by someone who decided which problems would never reach a person again. Start with the entrance, and give your team back the hours they have been spending on traffic. More at danieljeong.org.