The best bots against spam and raids

Spam and raids are two different problems, and the most common mistake is attacking both with the same tool.

Spam is a steady state: advertising for other servers, the same links over and over, often by direct message to several members at once. What helps is a filter blocking invite links and known domains — one that supports exemptions, or you will switch it off within a fortnight.

A raid is an event: hundreds of accounts within minutes, usually freshly created, usually with similar names. No filter helps against that. A threshold does — how many joins per window before the server closes its doors.

The order you set things up in decides how much work this becomes. Start with Discord's own tools: verification level "High" requires a verified phone number and turns away most throwaway accounts with no bot involved. Then AutoMod for the obvious cases. Only then a bot, and only for what is left over: join thresholds, verification with a rules acknowledgement, and an alert in a channel an attacker will not find first.

One point that tends to get lost: the most effective protection against catastrophic damage is not the bot, it is how you hand out permissions. A server where three people hold Administrator is attackable in exactly three places.