Discord Anti-Spam Bot: Rate Limits, Duplicates and Mass Mentions

Three triggers, one timeout

Noxyr keeps each member's recent messages in memory and acts the moment any limit is passed inside the window. These are the defaults you start with.

When a trigger fires, the member is timed out and cannot send messages, react or join voice until it ends. The log channel gets an entry that names the trigger, so you can see why it happened.

Turn it on

Anti-spam is off by default, as is anti-nuke. The Security module is a master switch that is on, but nothing acts until you enable each protection. That means adding Noxyr never starts moderating your members by surprise.

1. Pick a log channel first. Without one the bot still acts, but you will not know what it did.
2. Enable it: run /security antispam enabled:true, or open the Security page on the dashboard.
3. Check permissions. The bot needs Timeout Members and Manage Messages.
4. Watch the log for a few days and adjust.

Who is exempt

Members with Administrator, or one of the admin roles you configure, are not acted on, and messages from bots are not inspected. There is no separate trust list for anti-spam. To keep a channel out of it, either deny the bot View Channel there or use /security ignore with the Anti-spam rule, which switches the rule off in the channels or categories you pick.

Tuning for real servers

The defaults suit a normal chat. Busy events are different.

• A hype channel during a drop will trip 6 messages in 8 seconds for ordinary people. Raise max_messages or ignore that channel for the event rather than turning the feature off.
• A quiet server with raids can lower the limits. Four messages in six seconds is still far more than most people type.
• A server with strict rules can lengthen timeout_minutes so a repeat offender sits out longer.

Change one number at a time and wait. If you change three, you will not know which one fixed the false alarms.

What anti-spam does not do

It reacts to behavior, not content. It will not know that a polite message is a scam. For that, add the link rules: the anti-link bot removes invites and scam links, and the hacked-account shield deletes the same message or link posted in 3 channels within 2 minutes. Raid mode adds a join-rate check: 10 joins in 30 seconds. All of those are covered in the protection docs.

A worked example

Say a member pastes the same sentence five times. By the fourth identical message they pass the duplicate limit. Noxyr times them out for ten minutes, deletes the copies, and writes an entry in your log channel that says the duplicate trigger fired. A moderator reading the log can see exactly which rule caught them, and decide whether a longer timeout or a warning makes sense.

Now say a hijacked account pings a role six times in one message. The mention limit catches it on the first message, before the ping can wake the whole role a second time.

When the bot seems to do nothing

• It is still off. Anti-spam does nothing until you enable it. Run /security status to check.
• The member is an admin. Administrators and admin roles are never acted on, so test with a plain account.
• The bot lacks a permission. Without Timeout Members it cannot mute, and without Manage Messages it cannot delete.
• The role is too low. The bot cannot time out someone whose top role sits above its own.
• The channel is ignored. Check /security ignore action:List.

Anti-spam also runs inside AI chat channels and ticket channels, so a flood there is treated like anywhere else.

If you are unsure where to begin, keep the defaults for a week. Read the log channel each day, and loosen or tighten one number at a time. The log shows which trigger fired, so you can see whether your community needs a looser message limit or a stricter duplicate limit.

Next steps

The reference is in the anti-spam docs. For strategy, read the anti-spam bot guide, and see how to protect a Discord server from raids. Combine it with verification and anti-nuke for layers. Add Noxyr to try it.