A Discord anti spam bot watches how fast a member posts, whether they repeat the same message, and how many people they mention at once, then times them out automatically the moment they cross a limit you set. Done well, it catches raid bots and flooders in seconds without touching a member who is just chatting quickly. This guide walks through exactly what counts as spam, how Noxyr's thresholds and timeouts work under the hood, and how to tune them so real members never get caught.

A burst of repeated messages fills a rate meter until it trips and the sender is timed out. rate limit TRIP Timed out

What counts as spam?

Most anti spam Discord setups watch for three separate patterns, and any one of them can trigger a response on its own:

  • Message rate: too many messages from one person inside a short window. This catches copy-paste flooding and scripted raid accounts.
  • Duplicate content: the same message (or a near-identical one) sent over and over. This catches the "join and paste the same scam link in five channels" pattern.
  • Mass mentions: a single message that pings far more users or roles than a normal message would, including @everyone and @here.

A member only needs to trip one of the three. Someone who sends six normal messages in a row but never repeats content and never mentions anyone stays completely untouched.

How Noxyr's anti-spam thresholds and timeouts work

Noxyr tracks a rolling window per member, per server. Every message that member sends inside the window gets added to that window; anything older than the window length drops off automatically. Three checks run against that window on every new message:

  • Max messages / window: if the member has sent more than the configured number of messages inside the window (default: more than 6 in 8 seconds), that's a rate trip.
  • Duplicate limit: content is trimmed, lowercased and had its extra whitespace collapsed before comparison, so "Hello!!" and "hello!!" count as the same message. Once that many duplicates land inside the window (default: 4), that's a trip.
  • Mention limit: Noxyr counts mentioned users and roles in the message. If the message pings @everyone or @here, 100 is added to that count, which guarantees a trip regardless of your configured limit, because nobody sets a mention limit anywhere near that high.

The first check to trip fires the response; the bot does not wait to see if a second one would also fire. When it does, two things can happen depending on your settings:

  • Timeout: the member is timed out for the configured number of minutes (default 10, up to 7 days from the command, capped at Discord's 28-day maximum). This only happens if the bot's role sits above the member's, same as any other moderation action.
  • Message deletion: if enabled (on by default), the bot deletes up to the last 10 tracked messages from that member in the channel where the trip happened. It does not chase down messages the member posted in other channels during the same burst.

After a trip, that member's window resets to empty, so a single burst only ever triggers one action, not one per message over the limit.

Configuring it

Everything above is set with /security antispam or the Security page of the dashboard:

  • enabled — anti-spam is off by default, even when the Security module itself is on, so turning the module on never starts moderating anyone by surprise.
  • max_messages and window_seconds — the rate limit and how long the window is.
  • duplicate_limit — how many repeats before it counts as spam.
  • mention_limit — how many pings in one message before it counts as a mass mention.
  • timeout_minutes — how long the timeout lasts.
  • delete_messages — whether the spam gets cleaned up too.

/security status shows the current numbers for both anti-spam and anti-nuke in one embed, which is the fastest way to check what's actually live before you change anything.

Avoiding false positives

A spam filter that times out real members teaches people to leave. A few things keep that from happening:

  • Admins are exempt automatically. Anyone with the Administrator permission, or a role you've added as an admin role on the dashboard, is skipped entirely. Announcements and giveaway pings posted by staff never trip the mention limit.
  • Bot and webhook messages are never inspected. Only human messages reach the anti-spam check, so an announcement webhook or another bot posting quickly in a log channel is not a concern.
  • Raise the window before you raise the count. If fast typers in a busy general channel are getting close to the rate limit, widening window_seconds a little (say 8 to 12) is usually gentler than raising max_messages, since it gives normal back-and-forth conversation more room without opening the door much wider for a genuine flood.
  • Watch duplicate_limit around template content. Communities that use copy-paste templates (LFG posts, ticket macros, application answers) can brush against the duplicate check. Raise the limit a bit rather than turning duplicate detection off entirely.
  • Turn off delete_messages while you tune. With deletion off, spam still gets timed out but the messages stay visible, which makes it much easier to see exactly what tripped the filter and adjust the numbers with real evidence.
  • Nothing currently posts an alert embed for anti-spam trips the way anti-nuke does. Discord's own audit log still records every timeout the bot applies, so check there (or /security status for current settings) if you want to review what happened.

Discord anti spam bot vs. Discord's built-in AutoMod

Discord's native AutoMod can block messages containing spam-like links or flagged keywords, and it has its own mention-spam rule, all configured in Server Settings. It's genuinely useful and costs nothing to turn on. Where it falls short of a dedicated anti spam Discord bot is that each protection is a separate rule you build one at a time in the rule editor, and none of them track a member's overall behavior across messages the way a rolling per-member window does. AutoMod reacts to a single message in isolation; it has no native concept of "this person has sent six messages in eight seconds" or "this is the fourth copy of the same message this minute."

A bot-based filter like Noxyr's bundles rate limiting, duplicate detection and mention limits behind one switch, applies the same admin exemptions everywhere, and gives you one place (the dashboard or /security status) to see and change every number at once, instead of a stack of independent rules. Running both is not a conflict. AutoMod's keyword and link filters catch things a rate-based filter never will, and a per-member spam filter catches flooding patterns AutoMod isn't built to track.

Common questions

Is anti-spam on by default? No. The Security module is on by default, but anti-spam itself has to be turned on separately with /security antispam enabled:True or from the dashboard.

Will it time out a moderator who is spamming reactions or fast replies? Not if they have Administrator or a configured admin role. Add trusted staff to your admin roles from the dashboard's Roles page if they don't already have Administrator.

Does it delete messages in every channel the member posted in? No, only the channel where the trip happened, and only up to the last 10 tracked messages there.

What's the difference between this and anti-nuke? Anti-spam watches ordinary members sending messages. Anti-nuke watches admin-level destructive actions like mass channel or role deletion. They're configured separately and can run independently; see the full anti-nuke guide for the second half of Noxyr's security module.

Can I set different limits per channel? Not currently; the limits apply server-wide, though deletion only touches the channel where the burst happened.

Anti-spam is one toggle in Noxyr's free Security module, alongside anti-nuke, verification and moderation logs. Add Noxyr free and turn it on from the security docs, or read the full security bot feature page for everything the module covers.