Auto Moderation
Everything that acts on its own lives in the Auto Moderation section of the dashboard sidebar. Each page has its own switch, so you can turn on only what your server needs.
| Page | What it does |
|---|---|
| Antispam | Catches shouting, message bursts, mass mentions, repeated messages and unwanted links |
| Filters | Blocks the words, phrases and patterns you choose |
| Anti-raid | Notices a wave of joins and deals with every account in it |
| Anti-nuke | Stops one account from mass deleting, mass banning or handing out dangerous permissions |
| Advanced Automod | Rules you build yourself from triggers, conditions and actions |
| Mention Filter | Stops chosen members from being pinged, see Server Tools |
| Honeypot | A trap channel for spam bots, see Server Tools |
Antispam, Filters, Anti-raid and Anti-nuke each have a Watch an example button. It plays a short pretend conversation and shows what Natsumi would do, using the settings on the page, including changes you have not saved yet, so you can try a setting before it goes live. Each example has its own switch for the thing it shows, which starts on; turn it off to see what gets through without it. That switch only changes the example, never your settings. You can also type your own messages into the Antispam and Filters examples.
Members with Administrator or Manage Server are never checked by Antispam or Filters. Everything these pages do is logged as an Automod Action in your modlog, and none of them store message text.
Antispam
Antispam has five detectors. Each one removes the message that set it off and then does what you pick: nothing more, warn, time out, kick or ban.
| Detector | Fires when | Default |
|---|---|---|
| Caps spam | A message is mostly capital letters | 70% capitals in a message of 10+ characters, delete |
| Message burst | Someone sends many messages in a few seconds | 5 messages in 5 seconds, time out for 10 minutes |
| Mention spam | One message pings many members or roles | 5 mentions, warn |
| Duplicate flood | The same message is posted again and again | 3 copies in 30 seconds, delete |
| Blocked links | A message has a Discord invite, a link to a website you block, or any link | Off |
Message burst and Duplicate flood remove every message in the burst, not just the last one. Emoji, mentions and links do not count as capital letters, and a member or role pinged twice counts as one mention. "Block all links" still lets GIFs from Tenor and Giphy, Discord's own media and links to Discord messages through, and a blocked website also blocks its subdomains.
Each detector can ignore roles and channels of its own, and the General card has roles and channels Antispam skips entirely.
Repeat offender
Repeat offender counts every Antispam violation, whichever detector caught it. Once a member reaches the number you set within your time window, they get the harsher punishment you picked instead of the detector's own. Each new violation keeps the count going, so a member who keeps spamming keeps getting it.
Notices and edits
With Tell the member in the channel on, Natsumi posts one line saying why the message went, such as "your message was removed for too many capital letters", and removes it again after 10 seconds. Check edited messages catches clean messages edited into spam afterwards; an edit never counts as a new message for Message burst or Duplicate flood.
Filters
A filter is a list of words, phrases or patterns with its own punishment. You can have up to 10 filters with 100 entries each.
| Match | Catches |
|---|---|
| Whole words | The word or phrase on its own, so "ass" does not catch "class". Extra spaces inside a phrase still match |
| Anywhere in the text | The text anywhere, even inside other words |
| Regex | Regular expressions, up to 15 per filter. Patterns that could hang the bot are refused when you save |
Matching ignores capital letters unless you turn on Match capital letters exactly. Each filter has a Try it box that shows whether a message you type would be caught, without sending anything.
Every match removes the message. After that a filter either does the same thing every time, or counts strikes: you pick how many strikes lead to a warning, a timeout, a kick or a ban, and how long strikes last. Each filter can also tell the member with a one-line notice in the channel, which never repeats the word that matched and is removed after 10 seconds. Filters never send DMs: members who close DMs to server members cannot get one from a bot.
Filters run before Antispam, and a message caught by a filter is not checked again by Antispam.
Anti-raid
Anti-raid starts raid mode when too many accounts join too quickly.
| Protection | Raid mode starts at |
|---|---|
| Low | 15 joins in 30 seconds |
| Medium | 10 joins in 20 seconds |
| High | 6 joins in 15 seconds |
| Custom | Your own numbers |
Raid mode handles every account in the join wave, and everyone who joins while it lasts, in the way you choose: alert staff only, time them out, kick them or ban them. A ban also removes their last hour of messages. Raiders who are removed get no welcome message and no verification ping.
It can also:
- Lock the server down. Takes sending messages, reactions and threads away from @everyone, and gives back exactly those permissions when raid mode ends. Channels that give @everyone their own permission to talk stay open.
- Turn on slowmode in every text channel, and set each one back afterwards. Channels whose slowmode staff change during the raid are left alone.
Raid mode ends a set number of minutes after the last raider joined, even if Natsumi restarted in between. Use /raid status to see it and /raid end to end it straight away, for example after a false alarm. Both need Manage Server.
To leave busy events alone, set Only count new accounts: accounts older than that many days then never count towards a raid and are never punished for joining during one.
Anti-nuke
Anti-nuke watches the audit log and punishes anyone who does too many destructive things in a short time, which is what a hacked staff account or a rogue bot usually does.
| Action | Default limit |
|---|---|
| Deleting channels | 3 in 10 seconds |
| Creating channels | Off |
| Deleting roles | 3 in 10 seconds |
| Creating roles | Off |
| Banning members | 3 in 10 seconds |
| Kicking members (kicks and prunes) | 5 in 10 seconds |
| Creating webhooks | 5 in 10 seconds |
| Granting dangerous permissions | 3 in 10 seconds |
| Opening up @everyone | 1 in 10 seconds |
| Adding bots | 1 in 60 seconds |
| Deleting emoji (emoji and stickers) | 10 in 10 seconds |
A dangerous permission is Administrator, Manage Server, Manage Roles, Manage Channels, Manage Webhooks, Ban Members, Kick Members or Mention Everyone.
The punishment is one of: strip their roles (the default, which stops the damage at once and is easy to undo), quarantine them (strip roles and give a role you pick), kick or ban. Bots keep the permissions of their own managed role, so a bot is kicked instead of stripped. A bot added by someone who is not trusted is also kicked straight back out, unless you turn that off.
Add your trusted staff first
Anti-nuke counts what everyone does, staff included. The server owner is always trusted. Add your other admins and the bots you rely on as trusted members or roles, or a big cleanup by one of them can set it off.
Anti-nuke needs View Audit Log, since Discord only tells bots about audit log entries when they have it, and Natsumi's role must sit above the roles of anyone it should be able to stop.
Moving from the old page
The old Auto Moderation page had six rules. They moved into the new pages automatically and keep working as they did:
| Old rule | Now |
|---|---|
| Slowmode | Antispam, Message burst |
| Mass Mention | Antispam, Mention spam |
| Server Invites, Links, Banned Websites | Antispam, Blocked links |
| Banned Words | Filters, a filter called "Banned words" with the same strikes |
"Mute after 1 violation" (or kick, or ban) became the detector's own action. Higher counts became Repeat offender. Until you save the new pages, Natsumi keeps reading your old settings, so nothing changes in the meantime.
Advanced Automod
How rules work
Advanced Automod is for anything the pages above do not cover. It is configured entirely on the dashboard; there is no automod slash command.
Every rule is built from three parts:
- A trigger. What Natsumi watches for, such as a message matching a word list, a member joining with a suspicious username, or someone posting the same message five times in a row.
- Conditions. Optional filters that narrow when the rule applies, such as only for accounts younger than a week, or never for moderators.
- Actions. What happens when the rule fires, from deleting the message to banning the author.
Rules are evaluated in order, and a single rule can carry several actions, so one match can delete the message, warn the member and post to a log channel at once.
Triggers
Message content
| Trigger | Fires when |
|---|---|
new_message | Any new message is posted |
edited_message | An existing message is edited |
word_denylist | A message contains a word from a list you define |
word_allowlist | A message contains anything outside an allowed list |
message_regex | A message matches a regular expression |
message_not_regex | A message fails to match a regular expression |
all_caps | A message is mostly capital letters |
message_length | A message is longer than a limit |
message_mentions | A message contains more than a set number of mentions |
message_attachments | A message carries more than a set number of attachments |
message_has_attachments | A message carries any attachment |
message_no_attachments | A message carries no attachment |
Links and invites
| Trigger | Fires when |
|---|---|
any_link | A message contains any link |
server_invites | A message contains a Discord invite |
website_denylist | A message links to a blocked domain |
website_allowlist | A message links anywhere outside an allowed domain list |
Spam and flooding
| Trigger | Fires when |
|---|---|
spam_messages | A member sends messages faster than a threshold |
consecutive_identical_messages | The same message is repeated |
user_mentions_spam | One member spams mentions |
user_links_spam | One member spams links |
user_attachments_spam | One member spams attachments |
channel_messages | A channel exceeds a message rate |
channel_mentions_spam | A channel is flooded with mentions |
channel_links_spam | A channel is flooded with links |
channel_attachments_spam | A channel is flooded with attachments |
Members and names
| Trigger | Fires when |
|---|---|
new_member | A member joins the server |
join_username_word_denylist | A joining member's name contains a blocked word |
join_username_word_allowlist | A joining member's name falls outside an allowed list |
join_username_regex | A joining member's name matches a pattern |
join_username_not_regex | A joining member's name fails to match a pattern |
join_username_invite | A joining member's name contains an invite link |
nickname_word_denylist | A nickname contains a blocked word |
nickname_word_allowlist | A nickname falls outside an allowed list |
nickname_regex | A nickname matches a pattern |
nickname_not_regex | A nickname fails to match a pattern |
Other
| Trigger | Fires when |
|---|---|
discord_automod | Discord's own AutoMod flags a message |
violations_in_duration | A member accumulates violations within a time window |
Conditions
Conditions narrow a rule without changing what it watches for.
| Condition | Applies the rule only when |
|---|---|
account_age_below | The account is newer than a given age |
account_age_above | The account is older than a given age |
member_duration_below | The member joined recently |
member_duration_above | The member has been in the server a while |
require_roles | The member holds one of the listed roles |
ignored_roles | The member holds none of the listed roles |
ignore_bots | The author is not a bot |
only_bots | The author is a bot |
ignore_channels | The message is outside the listed channels |
ignore_categories | The message is outside the listed categories |
ignore_threads | The message is not in a thread |
active_in_channels | The message is in one of the listed channels |
active_in_categories | The message is in one of the listed categories |
active_in_threads | The message is in a thread |
ignore_forwards | The message is not a forwarded message |
only_forwards | The message is a forwarded message |
Actions
| Action | Effect |
|---|---|
delete_message | Delete the offending message |
delete_multiple_messages | Delete several of the member's recent messages |
warn_user | Issue a warning, recorded in their history |
timeout_user | Time the member out for a set duration |
kick_user | Remove the member from the server |
ban_user | Ban the member |
give_role | Add a role, useful for quarantine roles |
remove_role | Remove a role |
set_nickname | Replace an offending nickname |
send_message | Post a message in the channel |
send_alert | Post to a staff or log channel |
enable_slowmode | Turn on slowmode in the affected channel |
add_violation | Add to the member's violation counter |
reset_violations | Clear the member's violation counter |
Escalation
add_violation and violations_in_duration are what make escalation work. Have your first rule add a violation when it fires, then add a second rule that triggers on violations_in_duration and applies a heavier action once a member accumulates enough of them inside your chosen window.
That keeps a single mistake cheap while making a pattern of them expensive, and it means the escalation thresholds are yours to set rather than fixed.
Best practices
Start with the defaults
Antispam's defaults suit most servers. Turn the page on, watch the modlog for a few days, then tighten or loosen single detectors.
Exempt your bots and staff channels
Give the roles of bots that post a lot, and channels where spam is expected (such as a bot commands channel), an exemption, so they are not caught by Message burst or Duplicate flood.
Trust your staff before turning on Anti-nuke
Add your admins and trusted bots first. Leave the punishment on stripping roles until you are sure the limits fit how your staff work.
Try new filters first
Use a filter's Try it box, and in Advanced Automod give a new rule send_alert as its only action at first, so a broad word list or regex shows itself before it affects real members.
Avoid over-moderation
Too many strict rules frustrate the members you want to keep. Balance protection with usability.