How to stop a Discord raid, and what to do in the first ten minutes

How a raid actually starts

Most raids begin quietly, days before anyone notices. Someone checks whether your invite is public, how old your newest members are, whether your staff are asleep at 3am, and whether a bot posts a welcome message that mentions people. That is enough to pick a target.

The raid itself usually looks like one of four things: a wave of accounts posting the same message, a wave of accounts joining and doing nothing (to make your member count look broken or to farm invites), a compromised member account sending scam links to everyone it can, or a staff account that was phished and starts deleting channels. Each one needs a different response, which is why a single “ban everyone new” rule fails.

Close the doors before it happens

You do not need to be online for any of this. Every item below can be set once and left alone.

• Put a gate in front of chat. Verification that takes one click is enough to stop scripts that only know how to join and post. Lyx can add a verify panel with /verify setup.
• Set anti-raid thresholds that match your normal traffic. /security antiraid enabled:true joins:10 seconds:30 means ten joins in thirty seconds triggers raid mode. A 50,000-member server can raise the number; a 200-member server should lower it.
• Use a honeypot. /honeypot setup creates a channel that looks like a normal chat but is only visible to bots and new accounts. Anyone who posts there is almost certainly not a human reading the channel list, and Lyx softbans them automatically.
• Turn on the scam and invite filters. /automod toggle enabled:true catches the usual Nitro and Steam links, and /automod links can block every link from members without a role.
• Slow down #general. A five-second slowmode costs your members almost nothing and makes a spam wave far less visible.
• Check who has Administrator. Every extra person with Administrator is a future nuke if their account is stolen. Use the smallest role that does the job.
• Require 2FA for moderators. Discord has a server setting for this. Turn it on before you need it, not after.

Set thresholds that fit your server

The default numbers are a compromise. Watch a normal busy hour in your server — a giveaway or an announcement can bring twenty joins in a minute, and that is not a raid. Set the trigger just above your genuine peaks, not at the lowest number that feels safe.

The action matters as much as the threshold. Locking the server to existing members for ten minutes is usually better than banning everyone who joined in that window: one is reversible, the other is not. Lyx can also hold new joins behind a stricter gate until raid mode ends.

The first ten minutes of a raid

Panic is expensive. Work through this in order; each step buys time for the next.

• Run /security status to see what is already on. Do not start changing settings you have not read.
• Turn on raid mode: /security antiraid enabled:true, or lower the threshold if it is already on but did not fire.
• Lock the channels being hit with /lock, and raise slowmode with /slowmode seconds:30. Do this to the affected channels, not the whole server, unless the whole server is affected.
• Move staff coordination to a private channel. Do not argue in #general where the raiders can read it and enjoy it.
• Ban the accounts you can identify as a group, using /ban with a clear reason. Check account age and join time in the member list first; a member who joined two years ago is not part of a raid that started four minutes ago.
• If a staff account is the problem, remove its roles first, then ban it. Do not delete channels while you are still deciding — deletion is the one thing you cannot undo from the dashboard.
• When the wave stops, end raid mode with /security raid-end rather than leaving the server locked overnight.

Cleanup without collateral damage

Raids leave three kinds of mess: accounts to remove, messages to delete and members to reassure. Handle them in that order, and take your time with the first one.

Pull the join list for the raid window and compare it with message history. Accounts that joined and never spoke are usually safe to remove; accounts that joined, spoke once and left do not need a ban at all. If you banned a real member by mistake, unban them and say so in your announcement — people forgive a mistake that is admitted faster than one that is hidden.

Delete the spam with /purge, check the audit log for anything the raiders managed to change (channel names, role colours, webhooks), and rotate any invite that was posted publicly. If a bot token or webhook was exposed, regenerate it: removing the messages does not remove the access.

What not to do

• Do not mass-ban every account younger than a week. New members are how servers grow, and account age alone is weak evidence.
• Do not give a bot Administrator to “handle security”. Bots get compromised too, and then the nuke comes from inside.
• Do not delete the channel that was hit. Archive it, or lock it; you may need it as evidence for a report to Discord.
• Do not announce the raid in #general while it is happening. It tells the raiders they are working and tells your members to panic.