Protecting Your Discord Server from Raids: End-to-End Setup Guide
This article was translated automatically from the Turkish original. Read the Turkish original
Quick answer
Protecting a Discord server against raids is a three-layered job. First come Discord's native settings: verification level, @everyone permissions, and 2FA for moderators. Next is a bot that detects mass joins and locks down the server, and finally, a gate that verifies new members before they get a role. In VeyroBot, the second and third layers are located in the Anti-Raid tab. If the number of joins you specify occurs within 10 seconds, sending messages for @everyone is disabled in all text channels, and an alert is sent to the moderation log channel. If captcha is enabled, new members will not automatically receive a role until they verify the visual code. This guide sets up these three layers in order.
This topic in VeyroBot:Discord Anti-Raid Bot →
Raid or nuke?
These two attacks are often confused, but their protections are different. A raid (raid) comes from the outside: a large number of accounts join in a short period, flood channels with spam, and mention everyone. A nuke comes from the inside: an authorized account or a bot with administrator permissions is compromised, and channels and roles are deleted. VeyroBot's Anti-Raid is designed for the first type; against the second type, the Staff Protection in the same tab strips dangerous roles from staff members who exceed limits and allows you to restore deleted channels and roles. Discord's native settings are the first line of defense for both types and are measured in the panel's Health Score card.
Layer 1: Discord's native settings
| Setting | Recommended | Why |
|---|---|---|
| Verification level | At least "Medium": account must be registered for 5 minutes and have a verified email to chat | Most raid accounts are created minutes prior; this single setting stops the majority of spam bots from chatting. |
| @everyone permissions | "Administrator", "Manage Server", "Manage Roles", "Manage Webhooks", "Ban/Kick Members", "Manage Channels", and "Mention @everyone" disabled | A single dangerous permission left enabled for @everyone turns any new member into a potential attacker. |
| 2FA for moderation | Enabled (only the server owner can toggle this) | If a moderator's account is compromised, the attacker can directly ban members and delete channels; 2FA prevents this. |
| Bots with Administrator permissions | Remove bots you do not use, and restrict the permissions of the remaining ones | If a bot's token is leaked, the Administrator permission affects the entire server. |
The status of these four items is displayed as the Health Score in the Overview tab of the VeyroBot panel; there is a one-click fix for the verification level and @everyone permissions, which can be reverted within 24 hours. The fix is applied using your actual Discord permissions; panel access alone is not enough.
Layer 2: VeyroBot Anti-Raid lock
There are four settings in the Panel → Anti-Raid Shield tab:
- Raid detection threshold (joins in 10 seconds). Between 3 and 30, default is 10. When the threshold is exceeded, the server is locked down: sending messages and adding reactions for @everyone are disabled in all text channels, and the number of joins and the threshold are logged in the moderation log channel. The lock is a one-time event; it will not trigger again until you unlock it.
- What to do with new accounts below the account age limit. "Do nothing (lock only on threshold breach)", "Kick from server", or "Ban". This choice determines the action taken against accounts below the age limit, not the raid lock itself: if Kick or Ban is selected, such an account will be removed from the server as soon as it joins, even if there is no active raid.
- Minimum account age (days). Between 0 and 30, default is 3. If you enter 0, no age check is performed.
- Visual captcha gate. Explained in Layer 3; to enable this, a member role must be selected in the Auto Roles tab.
Use the /unlock command to lift the lock: while the lock is active, this command restores all locked channels to their pre-lock permissions (explicitly allowed channels remain allowed, denied ones remain denied) and resets the flag so that the next wave can be detected.
Layer 3: Captcha gate
When captcha is enabled, a six-character visual code is sent to the new member via direct message. The member enters the code using a button; they will not be given the auto role until they verify, meaning they cannot chat if they cannot view channels without a role. No one is kicked: there is no time limit, and members can verify whenever they want. A new code is generated after three incorrect attempts. If their direct messages are closed, the code is sent as a temporary message to the welcome channel (or the system channel if none exists) and deleted after 10 minutes. For the gate to function, the Auto Roles module must be enabled and a member role must be selected; if the role is deleted later, the gate is silently disabled, and the Health Score will reflect this in the "Captcha gate" check.
How to choose a threshold?
- Small community (a few hundred members): on a normal day, you won't even see 2–3 joins in 10 seconds; a threshold of 5–6 is safe.
- Medium scale: the default of 10 is the right starting point for most servers.
- Servers with stream events: when a streamer shares a link, there can be 15–20 legitimate joins in 10 seconds; raise the threshold to 20–25 and monitor the log on those days, otherwise you will lock out real users.
False positive management
If the lock is triggered falsely, the cost is low: /unlock restores all channels to their previous permissions, and no one is kicked. If you selected "Kick/Ban" for account age, the cost is high: a newly created legitimate account will also be removed. Therefore, we recommend leaving this option set to "Do nothing" for the first week and starting with captcha, only enabling the account age penalty after experiencing a raid, and with a low day limit (1–3).
Who is it for, and who is it not for?
Suitable for:
- Gaming or streaming-focused servers with public invite links circulating.
- Communities that want to verify a new member is human before they receive a role.
Not suitable for:
- Private invite-only servers; captcha only adds friction there, and Discord's "Medium" verification level is sufficient.
- Those looking solely for protection against internal nukes; the lock in this guide targets external joins, so you should enable Staff Protection for that instead.
Frequently asked questions
Does locking down the server stop joins as well?
No. The lock disables the write and reaction permissions for @everyone in text channels; joins will continue, but newcomers won't be able to chat. To stop joins completely, temporarily pause your invite links.
What happens to a member who fails the captcha?
They remain on the server but do not receive the auto role. No one is kicked; they can try again using the button at any time, and will receive a new code after three incorrect attempts.
Does the lock affect staff members too?
The lock disables the @everyone permission at the channel level. Those with Administrator permissions are unaffected; roles with explicit "send messages" permissions defined for their role in that channel will also continue to chat. Only moderators who rely solely on server-level write permissions will be unable to chat during the lock.
Is Anti-Raid enabled on every server?
The module is enabled and configured via the panel; plan details are on the premium page. If it is disabled, the Health Score will show this in the "Anti-Raid shield" check.
What should be done after a raid?
Check the join list in the log, clean up with /ban if necessary, restore channels to their previous permissions with /unlock, and readjust the threshold and account age based on that wave.
Last updated: September 15, 2026. The described behaviors belong to the version of VeyroBot on that date. For a summary of the module, setup steps, and panel screenshot, see the Anti-Raid page, and for message content filters, see the AutoMod page.
For these topics in VeyroBot
Discord Anti-Raid Bot
VeyroBot locks your text channels when the 10-second join threshold is passed and alerts your moderation log; /unlock restores every channel’s old permissions.
Discord Anti-Nuke Bot
If staff delete many channels or roles fast, VeyroBot removes their dangerous roles and alerts you with evidence; you rebuild deleted items in the dashboard.
Discord AutoMod and Automatic Moderation
Profanity, spam, advertising and mass-mention filters; tiered punishments and one shared case history. Protect your server automatically with VeyroBot.
