Discord AutoMod and permissions setup: the raid-proof baseline before you add a bot

A solid Discord AutoMod setup takes about twenty minutes, costs nothing and needs no bot. Discord ships keyword and spam filters, mention limits, raid detection, verification levels, rules screening and a moderator 2FA requirement under Server Settings → AutoMod and Server Settings → Safety Setup. This guide covers the baseline every public server should run, the permissions that must never sit on @everyone, and the gaps where a bot still earns its place.

AutoMod: what the built-in filters do

AutoMod acts before a message is posted, across text channels, threads and text chat in voice. Anyone with Manage Server or Administrator can edit rules, but only on desktop. Four kinds of rule matter:

• Commonly Flagged Words: three ready-made lists (Insults and Slurs, Sexual Content, Severe Profanity). Discord does not publish them and they cover English only, but you can exempt words. One rule per server.
• Custom Keyword rules: up to six per server, each with up to 1,000 terms of up to 60 characters and up to ten regular expressions. Matching is substring by default; * wildcards give prefix, suffix and anywhere matching, and multi-word terms match only as an exact phrase.
• Block Spam Content: a machine-learning filter trained on reported messages; English only, and Discord says it misses copy-pasta spread across messages.
• Block Mention Spam: a cap on unique user and role mentions per message, up to 50, with a toggle for automatic mention-raid detection.

Actions: Block message stops the post and shows the author a private notice you can extend by up to 150 characters. Send alert posts who-what-where details to a channel that must be private to staff. Timeout member exists only on Custom Keyword and Mention Spam rules and needs the Timeout Members permission. Each rule can exempt up to 20 roles and 50 channels (threads included), and members with Administrator or Manage Server are always exempt.

The baseline in five steps

1. Server Settings → AutoMod → Commonly Flagged Words → Set Up. Enable all three lists with Block message and Send alert, pointed at a private #automod-log channel you create first.
2. Add a Custom Keyword rule named "Scam links" with the phrases your server actually sees (free Nitro variants, gift-card bait, shortened-link domains). Actions: block, alert and a ten-minute timeout.
3. Enable Block Spam Content with block and alert. Exempt only staff channels where people paste examples.
4. Enable Block Mention Spam. A limit of 5 suits a chat server; LFG servers that ping full squads can go to 10. Add the timeout action; mention raids are the cheapest attack there is, and Discord's raid guide recommends this rule.
5. Turn on Block Words in Member Profile Names under Server Settings → Safety Setup → AutoMod → Edit → Members with your slur list; members whose nickname or username matches must change it before they can talk.

Safety Setup: verification, screening, media filter and 2FA

Verification level

Server Settings → Safety Setup → Verification Level (inside DM and Spam Protection on Community servers) sets what an account needs before it can send messages or join voice:

A verified phone number supersedes every other requirement, and administrators bypass the level. Discord recommends Low for public servers. Medium is the better default for a listed server: it costs real people nothing and defeats accounts created for the raid. Highest turns away many honest people who will not give Discord a phone number.

Rules screening

Community servers can require members to accept rules before they can talk, react or DM anyone: Safety Setup → DM and Spam Protection → Members must accept rules before they can talk or DM, up to 16 rules. Discord notes the extra step can reduce joins, and that bot role gates do not protect members from DMs while this does. Manually verifying a member under Server Settings → Members bypasses it.

Explicit media filter

Safety Setup → Explicit image filter scans images in channels not marked age-restricted, for all members or only members without roles. Community servers have High on by default; set Medium or High everywhere else, because posting explicit images is a standard raid tactic.

Require 2FA for moderator actions

Also in Safety Setup. Once on, moderators and administrators need 2FA on their own accounts to take moderation actions; Discord's developer documentation marks the permissions covered: kick, ban, Administrator, manage channels, manage server, manage messages, manage roles, manage webhooks and manage expressions. You must enable 2FA on your own account first. Have your team use an authenticator app or passkey rather than SMS, which Discord itself rates as better than no MFA, but not by a lot.

Raid protection, activity alerts and security actions

Server Settings → Safety Setup → Raid Protection and CAPTCHA is where you pick the alert channel. When Discord's join-raid detection fires, it posts an alert there and requires a CAPTCHA from new joiners for the next hour; you can switch the CAPTCHA off at any time.

Activity alerts appear as a banner, or a push notification when you are offline, for unusual join or DM volumes, visible to anyone with Administrator, Kick Members, Timeout Members, Ban Members or Manage Server. Discord says large join counts that are not raids trigger them too, so check the Members tab before acting.

Security Actions, in the server dropdown or on the alert itself, let you Pause Invites and Pause DMs between non-friends for a duration you set. Make that pair your first move in any incident: it stops both the inflow and the DM harvesting. Follow with slowmode (Edit Channel → Overview → Slowmode), a higher verification level, and Report Raid from the server menu, which needs Ban Members or Kick Members on desktop in Community servers.

Timeout, kick or ban

• Timeout removes sending, reacting and joining voice or video while the member stays in the server and can still read. The client offers 60 seconds to one week; the API, and therefore bots and AutoMod, up to 28 days. Use it for heat-of-the-moment behaviour from members you want to keep.
• Kick removes the member, who can rejoin with any valid invite. Wrong tool for raiders: they are back in seconds.
• Ban removes the member, lets you delete recent message history and record a reason, and keeps them out. Use it for spam accounts, scams and anyone who dodged a timeout with an alt.

Permissions that must never sit on @everyone

@everyone is the template every new role inherits, so anything enabled there leaks into every role you create later. Audit Server Settings → Roles → @everyone and make sure these are off:

• Administrator: grants every permission and bypasses all channel overwrites. Nobody but the owner and one backup admin should hold it.
• Mention @everyone, @here, and All Roles: Discord's raid guide says to toggle this off for every non-moderator role.
• Manage Webhooks: webhooks post without a bot user or authentication and can override their display name and avatar per message, so this permission is a licence to impersonate staff at machine speed.
• Manage Roles, Manage Channels, Manage Server, Kick Members, Ban Members, Manage Messages: each can damage or take over the server, and each is on the 2FA requirement's list.

The same list applies to bot roles. Discord's moderator guidance is that granting Administrator to any user or bot should be done with the utmost caution and on an as-needed basis. A bot with Administrator is an owner in all but name: if its token leaks, every channel and role is gone. Give each bot only the permissions its documentation asks for and keep its role below your admin roles.

When a bot earns its place

The built-ins see only your server. A bot layer covers four gaps, and every bot below is listed on Discordfinder.

• Captcha on every join, not only during a detected raid. Captcha.bot verifies at the door with an official verification site and configurable difficulty. Wick pairs its verification system with on-join filters that check new accounts against conditions you set.
• Cross-server knowledge. Beemo runs anti-raid algorithms in the background to stop userbot raids, banning suspected raiders while avoiding real users, with no setup required. Double Counter compares device, browser, network and behaviour datapoints to flag alts the moment they join.
• Anti-nuke. Nothing in Discord stops a compromised admin account from mass-deleting channels. Wick's anti-nuke and panic modes exist for that case.
• Rate-limited punishments. AutoMod judges each message alone. Carl-bot adds rate limits for messages, attachments, links, invites and mentions with an escalating punishment list (delete, warn, tempmute, timeout, kick, tempban, ban), a warn threshold, and a defer option that sends borderline cases to a channel where moderators vote.

Add the next layer only when your alert channel shows a problem the previous one missed. Our moderation bot comparison covers the wider field, and which bots a new server needs covers the rest of the stack.

Threat map: built-in setting first, bot second

Every row starts on the left because the built-in setting cannot go offline or lose a token. Run the baseline this week, watch the alert channel for a month, then let the alerts decide which bot you add.

Try it: compare anti-raid and moderation bots side by side on the moderation tag and add the first layer your alert channel asks for.