Protect Your Server from Raids
How to protect your Discord server from raids with RestoreCord: a verification gate, firewall, auto-kick and logs before, during and after a raid.
RestoreCord protects your Discord server from raids by keeping new accounts out of your channels until they pass verification, and by helping you recover when something gets through. Use this page as a checklist: what to set up before a raid, what to do during one and how to recover afterwards.
Go to Servers › Manage › Firewall
RestoreCord is not a live anti-raid or anti-nuke bot. It cannot stop accounts from joining your Discord server through an invite, and it cannot stop someone who already has admin permissions from deleting channels or banning members. It controls who gets verified access and helps you rebuild afterwards. Pair it with Discord AutoMod, 2FA for moderators, least-privilege roles and, if you need one, a dedicated live anti-raid bot.
What RestoreCord covers
A raid comes from outside: many accounts join at once to spam or harass. A nuke comes from inside: an account with real permissions deletes channels or roles, or bans members. RestoreCord helps with each in a different way.
| Threat | What RestoreCord does | What it can't do |
|---|---|---|
| Raid (mass joins, spam) | Keeps unverified accounts out of your channels, filters who can verify and kicks people who never do | Stop accounts from joining Discord, or delete spam they post where they can already write |
| Nuke (deleted channels, mass bans) | Restores channels, roles and permissions from a snapshot, then pulls members back | Notice or block destructive actions while they happen |
The checklist at a glance
Each plan includes everything from the plans below it. See Plans & Billing for prices.
| When | Layer | Plan |
|---|---|---|
| Before | Verification gate with a Verified or Unverified role | Free |
| Before | Captcha | Free |
| Before | Block VPNs & Proxies, Block Alt Accounts, custom rules | Premium |
| Before | Block Wireless Connections, Minimum Account Age | Enterprise |
| Before | Auto kick for members who never verify | Business |
| Before | Ban list import, Auto-Blacklist on Ban | Premium |
| Before | Server membership rules | Business |
| Before | Webhook logs and Analytics | Free |
| Before | Custom webhook events | Enterprise |
| Before | Snapshots: 1 on Free, 5 on Premium | Free |
| Before | Automated backups | Business |
| During | Pause invites in Discord, ban and blacklist raiders | Free (blacklist needs Premium) |
| During | Enforce Passwords | Enterprise |
| After | Restore a snapshot, pull members, restore roles | Free |
Before a raid
Raid protection has to be in place before the raid starts. Work through these layers in order.
1. Put a verification gate in front of your channels
The gate is what makes everything else work. New members can join your Discord server, but they see nothing except the verification channel until they verify. A raider who joins can only see the verification channel.
Choose how roles change on verify
On the General tab, set On Verify Action:
- Give Role gives the Verified Role when a member verifies.
- Remove Role gives the Unverified Role when a member joins and takes it away when they verify.
- Both gives the Unverified Role on join, then swaps it for the Verified Role on verify.
Hide your channels in Discord
RestoreCord doesn't change channel permissions for you. Set them up in Discord on every channel except your verification channel:
- With Give Role or Both, take View Channel away from
@everyoneand give it to the Verified Role. - With Remove Role, deny View Channel to the Unverified Role. Members can see the channels once verifying removes it.
Check the verification channel
Unverified members must be able to see the verification channel, or they can't verify at all. /setup warns you if they can't. Your bot's role must also sit above the Verified and Unverified roles. See General Settings and Auto-Role After Verification.
2. Turn on the firewall protections
The firewall checks every verification attempt. Raiders often use VPNs, fresh accounts and several accounts per person. These settings filter them out before they get the Verified Role:
| Setting | What it stops | Plan | Dashboard |
|---|---|---|---|
| Captcha | Automated accounts | Free | Go to Security › Captcha |
| Block VPNs & Proxies | Verification through VPNs, proxies and hosting networks. See VPN Blocking. | Premium | Go to Firewall › Block VPNs & Proxies |
| Block Alt Accounts | One person verifying with several accounts. See Alt Detection. | Premium | Go to Firewall › Block Alt Accounts |
| Custom rules | Specific users, IPs, IP ranges, countries, continents, ASNs (network providers), email domains or usernames | Premium | Go to Firewall › Custom Rule |
| Minimum Account Age | Accounts younger than the number of days you set (0 to 365) | Enterprise | Go to Security › Minimum Account Age |
| Block Wireless Connections | Verification from mobile networks such as LTE, 4G and 5G | Enterprise | Go to Firewall › Block Wireless Connections |
Real members, such as people in the same household, can sometimes be flagged as alts. Leave Block Alt Accounts off for a while and watch your webhook logs for Alt Account Warning entries before you turn blocking on. Staff who need to get past a check can use a bypass.
3. Kick people who never verify
Raid accounts usually join and never verify. Auto kick (Business) kicks members who haven't verified within a set time after joining, from 1 minute up to 7 days. Your bot needs the Kick Members permission. You can also send a Kick message with your verify link, so real members who were too slow can come back.
Auto kick only times members who join while it is on. Turning it on in the middle of a raid won't remove raiders who already joined. Set it up beforehand. See Auto-Kick Unverified Members.
4. Block known raiders
Stop people you've already dealt with from verifying again:
-
Import banlist from Discord Server (Premium) turns every user on your Discord ban list into a firewall block rule. Your bot needs Ban Members. Run it again later to add new bans; users already imported are skipped. See Import Discord Bans.
-
Auto-Blacklist on Ban (Premium) adds a block rule whenever someone is banned from your Discord server. Requires your bot.
-
Server membership rules (Business) block members of a server you name, such as a server that organises raids against you. Blocked members see error 990046. Members are asked for an extra Discord permission so RestoreCord can read their server list.
5. Set up logs so you notice a raid
A raid is easier to handle when you see it start.
-
Discord Webhook Logs (Free) post a message to a staff channel when someone verifies, is blocked, triggers a firewall rule or gets a bypass. A burst of blocked or alt entries is a common sign of a raid. See Webhook Logs.
-
Analytics (Free) charts Joined next to Verified per day, so a spike of joins that never verify stands out. On Enterprise, Mass Ping markers show days with
@everyoneor@herepings. The Firewall tab totals allowed and blocked attempts. See Analytics. -
Custom Webhook (Enterprise) sends signed events such as
member.deniedandfirewall.blockto your own endpoint, so your own tools can alert you. See Webhooks.
6. Take a snapshot and keep members recoverable
If a raid turns into a nuke, recovery depends on what you saved beforehand.
-
Snapshots save your channels, roles, permissions and message history. Free includes 1 backup per server, Premium 5. Creating one needs a custom bot on the server. See Backups.
-
Automated Backups (Business) take snapshots on a schedule, so a recent one always exists.
-
Join Servers For User must stay on (it is by default). Without it, members who verify can't be pulled back.
During a raid
Stop the inflow first, then clean up. Removing spam while accounts are still arriving means doing it twice.
Stop new arrivals in Discord
Pause your server's invites in Discord. RestoreCord can't stop people joining through an invite link, but Discord can. While invites are paused, members who verify may see error 990047; turn invites back on once the raid is over.
Remove the raiders
Ban the raid accounts in Discord. With Auto-Blacklist on Ban on, each ban also blocks them from verifying. You can also block a user from verifying with /blacklist add or right-click → Apps → RC - Blacklist (Premium). Staff need the Blacklist Management permission. See Bot Commands.
Tighten verification
Turn on stricter checks until things calm down:
- Captcha (Free) makes every new member solve a challenge.
- Minimum Account Age (Enterprise) keeps out freshly made accounts.
- Enforce Passwords (Enterprise) makes everyone enter a verification password before they can verify. Share it only with people you trust. Too many wrong attempts lock password entry for a while.
Watch the logs
Keep an eye on your webhook log channel and the firewall's Activity Logs. Search by Discord user ID to see which rule or protection matched an attempt. If a real member is blocked, give them a temporary bypass with Grant Temporary Access or /bypass grant.
After a raid
Once nothing new is arriving, recover in this order:
- Secure access. If anyone with admin permissions was involved, remove their roles, reset tokens and check your bots and integrations before you rebuild anything. See Restore a Discord Server.
- Restore structure. If channels, roles or permissions were changed or deleted, restore a snapshot from before the first malicious change instead of fixing it by hand. See Snapshots.
- Pull members back. Members who were kicked or banned, or who left, can be pulled back if they verified through RestoreCord before and haven't revoked access. Unban real members first, because banned members can't be pulled. See Pull Members.
- Restore roles. After a snapshot restore, run Restore Roles within 7 days to give returning members their old roles. See Restore member roles.
- Close the gap. Import your new bans into the firewall, review the firewall activity logs for what got through, and take a fresh snapshot.
If the whole server was deleted, see Server Deleted or Terminated. To start over in a new server, see Move to a New Server.
Discord's built-in settings
Discord has its own raid tools, and they are free. Use them alongside RestoreCord:
- Verification level sets what an account needs before it can talk in your server.
- AutoMod blocks spam, mention floods and keywords in messages, which RestoreCord doesn't do.
- Pausing invites stops new people joining through invite links while you deal with a raid.
- 2FA for moderators requires moderators to have two-factor authentication on their Discord account before they can take moderation actions. If you turn it on, the account that owns your bot must have 2FA too, or the bot can't assign roles.
- Least-privilege roles: give Administrator, Ban Members and Manage Channels only to people who really need them.