Discord Security Bot

The same scenario keeps repeating on Discord. Someone's account gets stolen, and within a few seconds it blasts mass mentions and scam links into every channel. By the time a moderator notices, half the server has a "claim your free Nitro" message sitting in their notifications.

The worst part is that the usual protections aren't enough. Most of them assume that a new account is the suspicious one. But a compromised account is often two years old, has ordinary roles and behaves normally on the server – right up until someone else takes it over.

Discord security bot is a tool we wrote for exactly this reason, for our own Gamers Together community. It watches only behavior – not account age, not membership length, not roles. It has been running on our server since July 2026 and has handled this problem on its own ever since. We're making it freely available, source code included.

It runs on your end, on your own machine. No cloud, no database, no data going to a third party.

---

What problem the bot solves

You can tell a compromised account by what it does, and it always does roughly the same thing. The bot targets exactly these signs:

• Mass mentions. A message with @everyone, @here or dozens of tagged people, sent everywhere the account can reach.
• Scam and phishing links. Fake free Discord Nitro, spoofed Steam login pages, domains like disc0rd or steamcommunlty that differ from the real ones by a single character.
• Message bursts. Several messages per second across channels, faster than any human can react.
• Image spam. The same image dumped into several channels at once.

Manual moderation can't keep up with this for one simple reason: the attack is over in a few seconds, and the moderator usually isn't at the computer at that moment. If it happens at three in the morning, nobody deals with it until morning – and by then dozens of people have already clicked the link.

How detection works

For each user, the bot keeps a sliding window of recent messages, ten seconds long by default. Within that window it evaluates four independent signals:

Signal	What it is	When it triggers
Mass mentions	A message mentions 5 or more users, or contains @everyone or @here	Once it happens 3× within the window
Suspicious link	The link matches a known scam pattern or goes through a URL shortener. Optionally it is also checked against Google Safe Browsing	Once 3 such links show up
Message burst	5 or more messages within 10 seconds, across channels	Immediately once exceeded
Image spam	An image sent to 2 or more different channels	Immediately once exceeded

Two things are worth pointing out, because this is exactly where it differs from most anti-raid tools.

It doesn't judge who the user is. No account age, no membership length, no roles. Only behavior over the last few seconds. That's precisely why it also catches the stolen account of a long-time member, which slips past every protection built on "new account = suspicious".

Thresholds are repeated, not one-off. One suspicious link triggers nothing – there have to be three. One message with @everyone doesn't either. This isn't theoretical caution: the first version acted on the very first occurrence, and that led to false alarms. Someone who sends a shortened link once is not a spammer.

What the bot does

The decision depends on how many signals are active at the same time:

Active signals	Action
2 or more	Ban and deletion of the account's last 7 days of message history
exactly 1	24-hour timeout and deletion of that message
none	Nothing

The bot logs every action to a channel you choose – so you always know who it punished and why, and you can undo it.

Moderators and administrators are untouchable. Anyone with the Administrator, Ban Members or Moderate Members permission is completely exempt from checks. The bot won't touch them under any circumstances.

---

Download

The package is free under the MIT license – you can modify it, use it and redistribute it, including for commercial use. It contains the complete source code, install scripts for Windows and Linux, a detailed guide and a set of automated tests.

Both versions contain exactly the same code. They differ only in the language of the guide and the language of the messages the bot writes to the log channel – and you can switch that at any time with a single line in the settings.

If you want to verify that the file wasn't altered along the way, here are its SHA-256 checksums:

discord-security-bot-cz.zip
d24ca9465a1b35665c8282693d0d835d490d227c1b8a2c63918e42c664da954c

discord-security-bot-en.zip
d283be540ef962ea4dfd5159dba4a7b02d4601d5792e0d9c0789a70fb6f2fe9a

---

Step-by-step installation

You don't need to know how to code. The whole installation is running one script and copying two values into a text file. You'll need Python 3.10 or newer and admin rights on the Discord server.

Step 1: Create a bot on Discord

1. Go to the Discord Developer Portal and click New Application. Name it whatever you like.
2. In the left menu, select Bot.
3. Click Reset Token, confirm and copy the token. It's shown only once. It's the password to your bot – never send it to anyone.
4. Scroll down to the Privileged Gateway Intents section and turn on MESSAGE CONTENT INTENT. Save.

The last step is the most important one in the whole guide. Without Message Content Intent enabled, the bot can't see message content, so it recognizes neither links nor mentions. It will start up, look like it's running, and catch absolutely nothing. If nothing works for you later, come back here first.

Step 2: Invite the bot to your server

1. In the left menu, select OAuth2 → URL Generator.
2. Under Scopes, check bot.
3. Under Bot Permissions, check: View Channels, Send Messages, Manage Messages, Ban Members and Timeout Members.
4. Copy the generated URL at the bottom, open it in your browser and invite the bot to your server.
5. In Server Settings → Roles, drag the bot's role above the roles of the members it should watch. Discord never lets anyone act against someone with a higher role. This is the second most common reason the bot "does nothing".
6. Create a channel for action logs, for example #mod-log, visible only to moderators. To copy its ID, turn on Settings → Advanced → Developer Mode in Discord, then right-click the channel and choose Copy ID.

Step 3a: Installing on Windows

Extract the downloaded ZIP into the folder where you want it. Then right-click install.ps1 in that folder and choose Run with PowerShell. If Windows refuses, open PowerShell in the folder and type:

powershell -ExecutionPolicy Bypass -File install.ps1

The script checks Python, sets up the environment, installs the required packages and creates a .env file. Open it in Notepad and fill in two values – the token from step one and the channel ID from step two. Then start the bot:

.venvScriptspython.exe bot.py

Once Logged in as … appears, the bot is running. It keeps watch until you close the window.

Step 3b: Installing on Linux

unzip discord-security-bot-en.zip
cd discord-security-bot
chmod +x install.sh
./install.sh
nano .env
./venv/bin/python bot.py

Running around the clock

On a home computer, the bot only keeps watch while the computer is on. To protect your server nonstop, it needs a machine that's always running – even the cheapest VPS is more than enough, since the bot has minimal requirements.

The package includes a ready-made systemd unit template. Just replace the two placeholder values in it, copy it into place and start it:

sudo cp discord-security-bot.service.template /etc/systemd/system/discord-security-bot.service
sudo systemctl daemon-reload
sudo systemctl enable --now discord-security-bot

The bot will then start on its own after a server reboot and come back up by itself if it crashes. The detailed procedure is described in the README.md file inside the package.

---

Settings

Everything is configured in a single text file, .env. Restart the bot after every change.

Variable	Default	What it's for
DISCORD_TOKEN	–	Required. The bot token from the Developer Portal.
MOD_LOG_CHANNEL_ID	–	Required. The channel where the bot reports its actions. Empty = the bot acts but stays silent.
GUILD_ID	empty	Limits the bot to a single server. Empty = it watches every server it's invited to.
GOOGLE_SAFE_BROWSING_API_KEY	empty	Turns on a second round of link checks against Google's database.
BOT_LANGUAGE	en	Language of the bot's messages: cs or en.
MENTION_THRESHOLD	5	How many mentioned users in one message count as a mass mention.
MENTION_REPEAT_THRESHOLD	3	How many times a mass mention has to appear in the window to count as a signal.
LINK_THRESHOLD	3	How many suspicious links in the window count as a signal.
BURST_COUNT	5	How many messages in the window count as a burst.
BURST_WINDOW_SECONDS	10	Length of the monitored window in seconds.
TIMEOUT_HOURS	24	Length of the timeout for a single signal.
BAN_PURGE_DAYS	7	How many days of history get deleted on a ban.

Before you start lowering the thresholds, consider this: the lower they are, the more innocent people the bot will punish. The defaults came out of live use and are deliberately set to let a borderline case through rather than ban someone who just got heated in a discussion.

---

FAQ

---

Before you deploy it

The software is provided "as is", without warranty of any kind and without support. We provide the code and the guide, we don't run it for you, and we're not liable for any damage arising from its use.

Take seriously what you're allowing the bot to do: ban members and delete messages. That's why we recommend three things:

1. Try it first on an empty test server you create just for that.
2. Make sure your moderators have one of the Administrator, Ban Members or Moderate Members permissions – otherwise they aren't exempt from checks.
3. Let it run for a few days and read the log channel before you start trusting it blindly.

And one last thing: never send your bot's token to anyone and never put it in any public repository. Whoever has it controls the bot – with all the permissions you gave it.