Discord anti raid playbook: how to protect your server from raids in 2026

Good discord anti raid protection in 2026 has three layers: Discord's own safety settings tuned before anything happens, one or two specialist bots for the gaps Discord leaves, and a written plan your moderators can run in the first five minutes. The single fastest move in any raid is Security Actions → Pause Invites plus Pause DMs, which works from the server menu on desktop and mobile. Below: the four raid types, the settings and bots that stop each, a minute-by-minute checklist and the clean-up.

This playbook assumes the baseline from our AutoMod and permissions setup guide (word filters, verification, rules screening, moderator 2FA, safe @everyone permissions) is in place, and builds the raid-specific layer on top.

The four raids you will actually see

Discord's raid guide defines a raid as "a large number of users or bots" joining "at once for disruptive or malicious intents". The Community Guidelines ban "coordinating server joins for the purpose of harassing server members", forbid self-bots and user-bots, and prohibit selling server “raid” tools. None of that stops a raid in progress, and each type needs a different first response.

The first three come from outside. The fourth comes from inside your own role list, and it is the one that destroys servers rather than annoying them; no account-age filter touches it.

The native layer, tuned for raids

Raid Protection and Activity Alerts

Server Settings → Safety Setup → Raid Protection and CAPTCHA is where you choose the alert channel. When Discord's machine-learning join-raid detection fires, it posts an alert there and requires a CAPTCHA from new joiners for the next hour. Discord says it is still "gradually rolling out Raid Protection alerts to community servers", so check the setting exists in your server rather than assuming it.

Activity Alerts are separate and available to every server: a banner, or a push notification when you are offline, for abnormal numbers of joins or DMs. Only members with Administrator, Kick Members, Timeout Members, Ban Members or Manage Server receive them. Two consequences:

1. Every moderator should check User Settings → Notifications → Community Activity Alerts on their phone. An alert that only reaches a sleeping owner is no alert.
2. Give moderators read access to the alert channel, as Discord recommends, or they get the banner without the details.

Discord also says alerts fire on large joins that are not raids, such as a streamer shout-out or a feature on a server list. Look at the Members page before you start banning.

Pause, do not revoke

There are two ways to stop joins, and neither involves deleting your invite.

• Server Settings → Invites → Pause Invites needs Manage Server and currently works on desktop only. It stops every invite link, embed, vanity URL and Server Discovery join until you press Enable Invites. The links themselves do not change, and anyone who clicks one is told invites are paused.
• Security Actions, in the server dropdown, on the Members tab or on the alert message itself, pauses invites, DMs between non-friends, or both, for a period you choose. It works on mobile. Discord's API caps these timed pauses at 24 hours.

Revoking an invite is permanent: every place it appears, from directory listings to your YouTube descriptions, goes dead. On Discordfinder an invalid invite hides the listing until the owner fixes it. Pause first, then revoke only the specific code the raid came through; the Members page shows which one. Why a permanent invite matters explains what rotating your main link costs you.

Verification level as a raid brake

Medium (verified email plus a five-minute wait) suits everyday use. During a raid, raise it to High: everyone must also have been in the server for more than ten minutes before they can talk, which buys your team ten minutes against every new joiner. Highest adds a verified phone number. Discord's verification levels article notes that a verified phone number "supersedes all other requirements", so phone-verified raid accounts skip the ten-minute wait on High. Return to your normal level once the raid is over, as Discord's guide advises.

Apply to Join for small and private servers

Server Settings → Access → Apply to Join makes every newcomer answer your questions and wait for approval on the Members page. Discord is rolling it out gradually and it can only be switched on from the desktop app. It is the strongest join filter Discord offers for a private community, and too slow for a public one.

Three permission details that decide a raid

• Role hierarchy. Discord's rule is that members "cannot ban, kick, or change nicknames of users with equal or higher roles, even if they have those permissions". Bots follow the same rule. An anti-nuke bot whose role sits below your admin role cannot stop that admin, so drag the bot's role above every staff role in Server Settings → Roles.
• Lockdown only works if channels do not override it. Channel permissions are applied on top of server permissions, so removing Send Messages from @everyone in Server Settings → Roles does nothing in a channel that explicitly allows it for @everyone or for the role raiders receive on joining. Check your public channels now with View Server As Role, not in the middle of a raid.
• Bypass Slowmode. Since 23 February 2026 only the Bypass Slowmode permission skips slowmode; Manage Messages, Manage Channel and Manage Threads no longer do. Give it to staff roles, or emergency slowmode slows your moderators as much as the raiders.

Account security for everyone with power

The 2FA requirement in Safety Setup stops someone who only has a password. It cannot help once an attacker holds a logged-in session. Discord's QR Code Login FAQ warns never to approve a QR login you did not generate yourself, and its hacked account guide names fake "games" and "free Nitro" links and files as the usual way in. Staff rules: passkeys or a security key rather than SMS, no QR logins from anyone else, no "test my game" downloads. Changing a password logs out every device, the first fix for a stolen session.

The bot layer: what is current in 2026

Discord's tools see only your server and only act on joins and messages. Bots fill four gaps: always-on verification, cross-server raid detection, anti-nuke and backups. Each bot below is listed on Discordfinder.

How Wick handles a nuke

Wick's feature documentation says its anti-nuke watches channel and role creation and deletion, bans and kicks, and vanity URL changes, and places offenders in a Quarantine role. Premium adds webhook creation and deletion tracking, member prune detection and strict role tracking. In Panic Mode, Wick locks the server so that only the owner and Wick keep authority, then restores from its latest saved state; with Wick's backups switched off, its docs call the restore "a finicky process". The Join Gate filters accounts with no avatar, accounts younger than an age you set, bots added by unauthorised users, unverified bots, accounts containing invites and usernames you list, each with its own timeout, kick or ban. The bot-additions filter matters most: it stops a hijacked moderator account inviting a nuke bot.

A sensible stack

One join-side bot (Beemo, or Wick's Anti-Raid if you pay for it), one anti-nuke (Wick), and one backup source (Xenon, or Wick's own backups). Avoid running two bots that both auto-ban joiners; you lose track of which one banned whom. Our moderation bot comparison covers the wider field.

During a raid: the minute-by-minute checklist

Pin this in your staff channel. Decide the branch in the first ten seconds: are accounts flooding in from outside, or are channels and roles disappearing?

Branch A: join, spam or self-bot raid

Minute 0–1

1. Open Security Actions from the alert or the server dropdown. Turn on Pause Invites and Pause DMs for the longest period offered.
2. Post one line in the staff channel ("raid, invites paused, I am on bans") so two moderators do not duplicate work or undo each other.

Minutes 1–3

3. Server Settings → Safety Setup → Verification Level → High.
4. Slowmode on every channel being hit: Edit Channel → Overview → Slowmode. Options run from 5 seconds to 6 hours; 30 seconds to 1 minute stops a flood without freezing the room.
5. If messages still get through, remove Send Messages from @everyone (or your default member role) to lock the server.

Minutes 3–10

6. In Server Settings → AutoMod, add the raid's repeated phrases or links to a Custom Keyword rule with Block message, Send alert and Timeout member. Lower the mention-spam limit.
7. Before deleting anything, report two or three representative messages with Report Message and paste their message links into your staff channel. Discord asks you not to file multiple reports about the same issue.

Minutes 5–20

8. Open the Members page. Sort by Member Since (Newest first), then filter by Joined Discord (account age) or Join Method (the invite code they used). Tick the raid accounts and press Ban Members. This needs both Manage Server and Ban Members, and Discord asks for your 2FA code or password each time.
9. Ban, never kick. A kicked account can rejoin through any valid invite the moment you unpause. A single ban can delete up to seven days of the user's messages, and bots can ban up to 200 users per API call with the same deletion window.

Minutes 15–30

10. Server dropdown → Report Raid. It needs Ban Members or Kick Members, works only on desktop and only in Community servers.
11. Revoke the one invite code the raid came through, and leave your main invite paused rather than deleted.

Branch B: compromised staff account or bot (nuke)

Minute 0–1

1. Whoever ranks highest strips every role from the account doing damage, or bans it. Only someone above it in the hierarchy can.
2. If the culprit is a bot, remove it from Server Settings → Integrations, which shows every bot, who added it and when.
3. Pause invites and DMs as in Branch A while you work out how far the damage goes.

Minutes 1–10

4. Server Settings → Integrations → Webhooks: delete any webhook you did not create. The page lists who created each one.
5. Server Settings → Audit Log, filtered by the compromised user, shows everything the account did and in what order.
6. Tell the account's owner to change their password (this logs out every device), remove unknown apps under User Settings → Authorized Apps, and file a ticket at dis.gd/hackedaccount.

Minutes 10–60

7. Restore from your backup. Wick's restore leaves out messages and role assignments; Xenon's free backup leaves out messages, bans and role assignments, so expect to re-assign some roles by hand.

If the owner's own account is the one compromised, no bot can help, because nothing outranks the owner. Only Discord support can, through the hacked-account form above.

After the raid: the after-action checklist

1. Lift emergency settings in reverse order: AutoMod rules you tightened, @everyone Send Messages, slowmode, verification level, then invites and DMs. Discord does not notify people who tried to join while invites were paused, so post a note where your audience is.
2. Read the audit log now. Discord keeps audit log entries for 45 days, then they are gone. Screenshot the raid window and any staff actions you may need to explain later.
3. Check for false positives. Review the latest entries under Server Settings → Bans against your regulars and unban anyone caught by mistake.
4. Mark the alert as resolved in Security Actions and leave a note for other moderators on what happened and how it was handled.
5. Report through the right channel. Report Raid for the incident, Report Message for individual content, Discord's application reporting page for a malicious bot, dis.gd/hackedaccount for hijacked staff, and discord.com/report for illegal content if you are in the EU. One report per issue; do not ask members to mass-report.
6. Audit dangerous permissions. List who holds Administrator, Manage Roles, Manage Webhooks, Manage Server and Ban Members. Remove inactive staff and any bot that does not need them.
7. Write a five-line incident note: when it started, what detected it, the minute of the first action, what got through, and the one setting you will change. Next time is faster.
8. Take a fresh backup of the cleaned-up server.

How much protection your server needs

Discord's raid guide ends on people, not settings: recruit trusted moderators so someone is online "to immediately prevent or de-escalate a raid". Settings and bots buy time; a moderator awake in the right time zone uses it, which is how large community servers ride raids out.

Try it: compare the bots on the anti-raid tag, pick one join-side bot and one backup, then browse the moderation tag for the rest of your stack. Listing is free, and Discordfinder re-checks every listed server invite every 15 minutes.