How to set up Discord AutoMod properly

Discord’s built-in AutoMod runs at the platform level, before a message is delivered. That makes it faster and harder to evade than a bot reading messages after the fact — and it means a badly configured rule blocks legitimate conversation instantly and invisibly.

Configure it in the order below and you will not have to undo anything.

Before you start: you need Manage Server. Set aside twenty minutes. Do not do this during an event.

Know the ceilings before you plan the rules

AutoMod’s limits are per server and low enough to change how you design. Plan against them rather than discovering them halfway through.

Rule type	How many per server	Capacity per rule
Keyword (custom)	6	1,000 keywords · 10 regex patterns · 100 allow-list entries
Keyword preset	1	1,000 allow-list entries
Spam	1	—
Mention spam	1	Mention limit up to 50

Six custom keyword rules is the constraint that shapes everything. It is not enough to create one rule per topic, so rules have to be grouped by the action they take, not by subject: everything you want blocked silently in one rule, everything you want blocked-and-alerted in another, everything that triggers a timeout in a third. Group by subject and you run out at six and have to rebuild.

Turn on the preset filters first

Server Settings → AutoMod. Start with Discord’s own presets rather than custom rules, because they are maintained for you and cover the highest-volume cases.

Three presets exist: sexual content, severe profanity, and slurs. Enable the ones your community’s rules already prohibit. If your rules do not prohibit it, do not filter it — an AutoMod rule that contradicts your written rules is a support ticket waiting to happen.

For each preset, set the action to Block message and nothing else at this stage. Alerts and timeouts come later, once you know the false-positive rate.

Add the spam and mention rules

Two more built-in rules that almost every server wants:

Mention spam — set a limit on how many unique user and role mentions a single message may contain. Five is a sensible starting point for most communities; raid messages routinely carry twenty or more.
Suspected spam content — Discord’s own classifier. Enable it; it catches the scam-link patterns that custom word filters never keep up with.

Only now write a custom keyword rule

Custom rules are where servers hurt themselves. Two failure modes account for nearly all of it.

Substring matching. A rule blocking ass blocks assassin, class, passage and assignment. Use whole-word matching unless you genuinely intend the substring, and read your wordlist back asking “what innocent word contains this.”

Blocking a symptom instead of a behaviour. Filtering a specific scam domain works until the scammers register a new one, which takes minutes. Filtering the shape of the message — the mention-spam and suspected-spam rules above — survives.

Discord’s wildcard syntax matters here. word* matches a prefix, *word a suffix, and *word* anywhere in the text. The bare form matches the whole word only. Getting this wrong is the single most common AutoMod misconfiguration.

Regex, and what it will not accept

Each keyword rule accepts up to ten regex patterns, each up to 260 characters. Two constraints decide whether a pattern you already have will work.

No lookarounds and no backreferences. Discord’s engine does not support them, so a pattern using (?=...), (?!...), (?<=...) or \1 is rejected outright. Most patterns copied from another moderation tool, a regex site or a language runtime use at least one of these.

Ten patterns is the whole budget for that rule, alongside its keywords. A rule carrying ten narrowly-targeted patterns leaves no room for the eleventh case, which is why broad behaviour-shaped patterns outlast specific ones here as much as anywhere else.

Test a pattern against real messages before saving it. A regex that is slightly too broad does not announce itself — it silently blocks a class of legitimate messages, and the members affected assume Discord is broken rather than reporting it.

The allow list is the precision instrument

Every keyword rule takes an allow list: terms that are never matched even when a keyword or pattern would catch them. It holds 100 entries on a custom rule and 1,000 on a preset rule.

This is what makes an aggressive rule survivable. Rather than removing a keyword because it catches one legitimate word, add that word to the allow list and keep the coverage. A preset filter catching a term your community uses in a specific and harmless sense is fixed here, in one entry, rather than by disabling the preset.

Set exemptions before you enable actions

Every rule takes exempt roles and exempt channels. Set them now, not after the first false positive.

At minimum, exempt your moderator roles from keyword filters. Moderators quote rule-breaking content when discussing it, and a filter that blocks the mod team from doing moderation is a genuinely annoying way to discover this.

If you run a channel where the filtered vocabulary is legitimately on-topic — a support channel discussing scams, say — exempt it explicitly.

Add the alert channel

Create a private #automod-log visible only to staff and set it as the alert channel on every rule.

This is the step people skip, and it is the one that makes AutoMod maintainable. Without it you never learn what is being blocked, so you never learn which rule is too aggressive. With it, a week of alerts tells you exactly which rule to loosen.

Only then add timeouts

Once you have watched the alert channel for a week and the false-positive rate is near zero, add timeouts to the rules you trust.

Start short. A 60-second timeout stops a spam burst without punishing someone who tripped a filter by accident. Escalating to hours belongs in human moderation, not in an automatic rule.

A three-week rollout that does not break anything

The order above compresses into a schedule. Following it produces a configuration nobody has to undo.

Week	Do this	Watch for
1	Presets + spam + mention spam, Block message only, alerts on	Which preset produces false positives
2	Add custom keyword rules, still block-and-alert only	Substring and wildcard mistakes
3	Add timeouts to rules with a near-zero false-positive rate	Whether a timeout lands on a regular member

The reason for the gap between weeks is that a false positive rate is only visible over time. A rule that looks perfect on the day it is written catches a legitimate message on day four, and if timeouts are already attached, that member is punished for your configuration.

When a rule is too aggressive

Work through this in order rather than deleting the rule.

Add the specific term to the allow list. Fixes the case without losing the coverage.

Narrow the wildcard. *word* to word*, or to the bare whole-word form. Most over-matching is a wildcard that was never needed.

Exempt the channel where the vocabulary is legitimately on-topic.

Remove the action, keep the alert. A rule that alerts without blocking still tells you what it would have caught, which is how you decide whether to re-enable it.

Deleting the rule is the last option, because it costs one of your six slots to recreate later.

What AutoMod does not do

It reads message content. It does not see edits to nicknames, does not act on user profiles, does not catch anything posted as an attachment or an image, and does not apply to messages from other bots or webhooks.

Anti-raid — the join-rate spike, the mass of new accounts — is a different problem entirely, and AutoMod does not address it. That needs a bot with join-gate logic, and it is worth configuring separately.

Where a bot adds something genuinely beyond the built-in rules, it is usually one of three things: regex-based custom filters, punishment escalation across repeat offences, or AI-based intent detection that reads what a message means rather than which words it contains. Vetox offers all three — 8 rule types and 4 action types in its own Auto-Mod, free on every tier apart from the escalation counter (1 rule free, 50 on any paid plan), plus AI-based intent moderation on its Black plan — but configure the platform’s own rules first regardless of which bot you run. They are free, faster, and they apply before anything else sees the message.

The capacity difference is worth knowing when you meet the six-rule ceiling: Vetox’s Auto-Mod carries up to 1,000 keyword entries with 20 exempt roles and 50 exempt channels, and its Automated Actions counts violations across rules in a rolling window — which is the specific thing AutoMod cannot do, because each of its rules evaluates alone.

Check your work

Post a test message that should trip a rule, from an account without an exempt role. Confirm it is blocked and that the alert lands in your log channel. Then post something that nearly trips it and confirm it does not.

The account matters more than the message here: testing from a moderator role you exempted earlier is the reason a working rule looks broken, and it heads the list in why AutoMod is not catching anything along with the wildcard syntax and the per-type rule caps.

If you skip that second test, you will find out about the false positives from your members.

Frequently asked questions

How many AutoMod rules can a server have? Six keyword rules, one preset rule, one spam rule and one mention-spam rule.

Does AutoMod work when my bots are offline? Yes — it runs at the platform level, before a message is delivered, independently of any bot.

Why is my rule not blocking anything? Most often the action is set to alert only. Nothing is blocked until Block message is selected.

Does AutoMod scan images or attachments? No. It reads message text only, and does not apply to other bots or webhooks.

Can AutoMod escalate punishments for repeat offenders? No — each rule evaluates independently with no memory across rules or messages. Escalation requires a bot.