How to Stop Discord Bot Spam and Raids Without Adding Moderator Hours

Why your team is still deleting messages by hand

There is a specific moment worth noticing. A moderator opens the server in the morning, finds forty identical messages, removes them, bans the accounts, and calls it a normal Tuesday.

Nothing about that is normal. It is a machine problem being solved by a person, repeatedly, at a cost the company never puts on paper. The hours are real, the resentment builds quietly, and the room stays open to the same pattern tomorrow morning because nothing structural changed.

The route out is narrow and boring, and it takes an afternoon.

Three arrivals, three different fixes

Spam is not one thing. Sorting it into three groups is what lets each rule stay narrow enough to run unsupervised.

• Volume. Freshly created accounts pushing the same phrase or link into several channels. Stopped by an entry delay and a current term list.
• Waves. A cluster of joins inside a short window, nearly all from recently created accounts. Stopped by account age flagging and a raised entrance requirement.
• Impersonation. A profile wearing your team's name and picture, then opening private conversations. Stopped by a lookalike check, a published rule, and roles that make your real staff visible in the member list.

One broad rule that tries to cover all three will catch real members and teach your team to ignore the log.

The afternoon build

1. Raise the entrance requirement so an account created minutes ago has to wait before it can post.
2. Flag joins from accounts created in the last few days and hold them at low permissions until cleared.
3. Point automated filtering at the specific wording your reports keep surfacing.
4. Add a name and avatar comparison against your staff list.
5. Create a single log channel and send every automated action to it.

That is the whole configuration. The mechanics live in Discord's settings and safety documentation at support.discord.com, and none of it requires custom engineering.

Steps one through four are the gate. Step five is what makes the gate improvable. Skip the log and you will be tuning your safety layer from memory inside a month.

Maintenance is most of the job

Setup is one afternoon. Maintenance is the reason it still works in November.

The blocked term list is not a setting you switch on. It is a living document with three properties, and a list missing any one of them is already out of date.

The source is the part teams miss. Your members meet new scam wording before any filter does, so every report is an entry waiting to be written down. Close that loop and the list stays current on its own. Leave it open and you are back to hand deletion by the end of the quarter.

Keep the document outside server settings, in a place your team can edit and see history: category, terms, added by, source, action, review cadence. Staff names go in on the day someone is hired and come out on the day they leave.

The impersonation rule that does the real work

Filters catch copies. They do not stop a member from trusting one.

So write the sentence down and put it where a member meets it before they need it: staff never start a private conversation, and never ask for payment or credentials. Say it in the rules, repeat it in onboarding, and make your actual team checkable inside the room through visible roles.

That combination turns a convincing fake into a message nobody acts on, which is a better outcome than catching it faster.

Prove it with one number

Human spam touches per week. Count them, write them down, read the trend.

• Falling means new patterns are being absorbed by the gate. Leave it alone.
• Flat means the checks are running and the list is stale. Fix the review loop.
• Rising means your people are the filter again. Raise the entrance requirement first, then look at the list.

One number, owned by the person who owns the list, reviewed at the same time. If nobody can name last week's figure, you do not yet know whether your safety layer works.

The floor under everything else

This is one layer of a community operation, and it is the lowest one.

On top of it sit onboarding and the first forty eight hours, support routing, escalation paths for decisions moderation should not make alone, documentation so answers leave individual heads, and reporting that shows leadership what the room returns. Every one of those assumes the floor holds. A team whose community work feels like permanent firefighting is almost always standing on a floor that does not.

So build in order. Gate, log, weekly review, one number. Then spend the recovered hours on the layers that grow the community rather than defend it.

The calmest communities are not the luckiest ones. Somebody sat down and decided, problem by problem, which things would never reach a human again. That decision is what buys a team the time to do work worth doing. More at danieljeong.org.