Discord raids: how they work and how to protect your server
What a Discord raid is, how raid bots and nukes work, how to prepare your server, what to do during an attack, and how an anti-raid bot helps.
By the Double Counter teamUpdated 10 min read
Key takeaways
- A raid is a coordinated wave of accounts joining a server to spam, harass or disrupt it. A nuke is different: it destroys the server from inside using stolen or abused permissions.
- Most raids rely on throwaway accounts, automation and anonymised connections, which is exactly what a verification gate filters out.
- Preparation matters more than reaction: lock down @everyone, require verification, enable AutoMod and limit who holds dangerous permissions.
- During a raid, pause invites first, then clean up. Discord's Security Actions do this in two clicks.
- Server raiding breaks Discord's Community Guidelines. Report it, but do not rely on reports to end an attack in progress.
A Discord raid rarely lasts more than a few minutes, and that is enough. Hundreds of accounts join, every channel fills with slurs, shock images or scam links, your members get mass-pinged, and your moderators are left deleting messages by hand.
Raids are also one of the most preventable problems on Discord. This guide explains how they are organised, how to set a server up so that a raid fizzles at the door, and what to do if one gets through.
What is a Discord raid?
A Discord raid is a coordinated attack in which many accounts join a server in a short time to flood it. Discord's Community Guidelines call it “server raiding” and classify it as harassment. The accounts may be real people organised in another server, or automated accounts driven by a script.
Raids come in a few recognisable forms:
- Join floods. Dozens or thousands of accounts join within minutes. The join itself is the opening move; the spam follows.
- Message and mention spam. Walls of text,
@everyonepings where permissions allow, images and invite links, posted faster than humans can delete them. - DM raids. The accounts join only to harvest the member list and send scam or phishing messages to your members privately.
- Voice raids. Accounts join voice channels to blast audio.
Raid or nuke: two different attacks
A nuke is often confused with a raid. In a nuke, the attacker does not flood the server from outside: they gain powerful permissions inside it and use them to delete channels, ban members and wreck roles in seconds.
| Raid | Nuke | |
|---|---|---|
| Comes from | New accounts joining through an invite | An account or bot that already has permissions |
| Typical cause | Public invite, no verification gate | Compromised admin account, malicious bot, over-generous roles |
| Damage | Spam, harassment, scared members | Deleted channels, mass bans, lost history |
| Main defence | Verification, AutoMod, paused invites | Least privilege, 2FA for staff, careful bot vetting |
Both deserve attention, and they need different defences. The server security checklist covers the permission side in detail.
How raids are organised
Understanding the attacker's side explains which defences work.
- The accounts are disposable. Raiders use freshly created accounts, bought in bulk or generated by tools, because every one of them will be banned.
- The software is automated. So-called raid bots or raid tools are scripts that control many user accounts at once (self-bots), which Discord prohibits. They join, pass simple gates and post on a timer.
- The connections are anonymised. Running hundreds of accounts from one address would get them blocked together, so raids run through proxies, VPNs and datacenter servers.
- The entry point is a public invite. A vanity URL, a listing site or an invite posted on social media is all a raid needs.
Each point is also a weakness. New accounts, automation, anonymised networks and a single entry point are all things a server can check before a newcomer is allowed to post.
Raid protection: prepare the server before it happens
1. Put verification in front of every channel
This is the single most effective measure. If @everyone cannot see or write anywhere except a verification channel, a raid that joins has nothing to flood. Automated accounts on proxies and day-old throwaways fail the check and never receive the verified role. Read how to set up verification for the exact permissions.
2. Remove dangerous permissions from @everyone
In Server Settings, make sure the @everyone role cannot mention @everyone, @here and all roles, create invites you do not control, or post links and files in channels where newcomers land.
3. Turn on Discord's own safety features
- Verification level at Medium or higher, so brand-new accounts have to wait before posting.
- AutoMod with the spam and mention-spam filters enabled. Mention spam protection can block the message and time the sender out.
- Raid protection and activity alerts in Safety Setup, which notify a staff channel when join activity looks abnormal.
4. Add raid detection at the gate
A verification bot sees every join, so it is well placed to notice a pattern. Double Counter detects coordinated join waves automatically and alerts your staff, while its alt and VPN checks keep the individual accounts out.
5. Protect the staff accounts
Require two-factor authentication for moderation, give Administrator to as few people as possible, and keep bot roles no higher than they need to be. This is what turns a raid into a nuisance instead of a nuke.
What to do during a raid
Have this written down somewhere your moderators can find it at 3 a.m.
- Pause invites. In Server Settings, use Security Actions to pause invites (and DMs if members are being messaged). This stops new accounts joining while you work. Do this before anything else.
- Slow the channels down. Enable slowmode or temporarily remove Send Messages for the affected roles. If raiders never got a verified role, this may be unnecessary.
- Remove the raiders in bulk. Sort the Members page by join date, select the wave and ban it. Banning rather than kicking also removes recent messages if you choose that option.
- Check on your members. Tell them what happened, remind them not to click links received by DM, and reopen invites once joins are back to normal.
- Report it. Report the accounts and, if you know it, the server where the raid was organised. Keep message links and user IDs as evidence.
What to look for in an anti-raid bot
“Anti-raid” covers very different tools. Ask what a bot actually checks:
- Does it stop accounts before they can post? Reacting to spam is slower than preventing the join from mattering.
- Does it look beyond account age? Aged accounts are cheap. Device, network and behaviour signals are much harder to fake at scale.
- Does it detect VPNs, proxies and datacenter addresses? Most automated raids depend on them.
- Will real members get through quickly? A gate that takes a minute and a puzzle loses legitimate newcomers every day, raid or not.
- What permissions does it ask for? A security bot that requests Administrator is itself a risk.
Many servers pair two tools: a general moderation bot for message filtering and logging, and a verification bot for the join gate.