How to protect your Discord server from raids

What is a raid

A raid is a coordinated attack on a Discord server. Usually many accounts join at once, often new accounts or bots, and start sending spam, mentioning everyone, posting offensive content or dangerous links. Sometimes the attack comes from inside: someone with permissions who starts deleting channels or kicking members.

The key to stopping it is to act within seconds, something a single person cannot do. That is why it is worth having a security bot that detects it and reacts automatically.

Before the raid: prepare your server

1. Give the bot the right permissions and position. FireFighter needs to be able to kick, ban, mute and manage channels and roles; the website's invite link already grants those permissions. Also, its role must be above the members' roles, because Discord doesn't let anyone be sanctioned by a member with a higher role than the bot.
2. Turn on the anti-raid. Type >>antiraid on. From then on, the bot watches for mass joins, message spam, mass mentions and other suspicious behaviour.
3. Choose the protection mode. With >>antiraid mode normal you get standard protection, suitable for small and medium servers. If your server is large or public, use >>antiraid mode strict, which reacts sooner.
4. Exclude your team. With >>ignore rol @Moderador you prevent the anti-raid from acting against your staff when, for example, they send many messages in a row.
5. Require new members to verify. With >>verificacion configurar @Verificado new members receive a code by direct message and only get access to the server when they enter it. If you prefer, there is also reaction verification. Automated raid accounts almost never get past this step.
6. Set up a log channel. Create a private channel for staff and type >>logs #canal. Bans, kicks, deleted or edited messages and anti-raid actions will be recorded there, which will help you work out what happened afterwards.
7. Set up a trap channel. With >>honeypot crear you create a channel where no legitimate member should write. Spam bots usually post in every channel, so they fall into the trap and the bot sanctions them automatically. Choose the sanction with >>honeypot accion.
8. Make a backup. With >>backup create you save your server's roles, channels and permissions so you can restore them if someone deletes them. This feature is part of the premium plans.

During the raid: contain the attack

1. Turn on lockdown mode. Type >>antiraid mode lockdown. It is the highest level of protection: new members may receive an automatic timeout or ban. Use it only while the attack lasts.
2. Close the affected channels. With >>lock in a channel, members can no longer write in it while you clean up.
3. Sanction the attackers. You can ban or kick several users at once by giving their IDs to >>ban or >>kick, and clean up messages with >>purge.
4. Stay calm and coordinate your staff. Ask your team not to reply to the provokers and to use a private channel to organise themselves.

After the raid: recover and learn

1. Go back to normal mode. When the attack is over, type >>antiraid mode normal (or strict) so new members can join again without problems.
2. Reopen the channels. Use >>unlock in each channel you closed. The permissions it had before are restored.
3. Review what happened. Check the detection history with >>antiraid_stats and go through your log channel to identify everyone involved.
4. Block those responsible. Add them to your server's blacklist with >>blacklist add, attaching evidence, so they cannot come back. With >>check you can check whether an account is already on any blacklist, including FireFighter's global one.
5. Restore what was lost. If channels or roles were deleted, recover them with >>backup load from your backup.
6. Adjust your defences. If the attack got through, raise the mode to strict, review verification and check that the bot's role is still above the others.

Quick checklist

• FireFighter's role is above your members' roles.
• The anti-raid is turned on and in the right mode for your server.
• Your staff is excluded from the anti-raid.
• New members go through verification.
• You have a private log channel set up.
• You have an active trap channel.
• You have a recent backup.
• Only trusted people have administrator permissions.

You will find every command and its options in the documentation. If you have questions, write to us through the website's support chat or on our Discord server.