# How to set up Discord AutoMod properly

> The built-in AutoMod handles more than most people realise, and configuring it badly is worse than not configuring it. Here is the order to do it in.

- Canonical: https://discordguides.blog/blog/set-up-discord-automod
- Published: 2026-08-30
- Author: The Manual desk
- Facts checked: 2026-08-30
- Sources:
  - Discord Support — AutoMod FAQ (https://support.discord.com/hc/en-us/articles/4421269296535) — checked 2026-08-30
  - Discord developer docs — Auto Moderation resource (https://docs.discord.com/developers/resources/auto-moderation) — checked 2026-08-30
- Publication: The Manual, an independent site not affiliated with Discord Inc.

---
Discord's built-in AutoMod runs at the platform level, before a message is delivered. That makes
it faster and harder to evade than a bot reading messages after the fact — and it means a badly
configured rule blocks legitimate conversation instantly and invisibly.

Configure it in the order below and you will not have to undo anything.

**Before you start:** you need **Manage Server**. Set aside twenty minutes. Do not do this during
an event.

## Know the ceilings before you plan the rules

AutoMod's limits are per server and low enough to change how you design. Plan against them rather
than discovering them halfway through.

| Rule type        | How many per server | Capacity per rule                                           |
| ---------------- | ------------------- | ----------------------------------------------------------- |
| Keyword (custom) | **6**               | 1,000 keywords · 10 regex patterns · 100 allow-list entries |
| Keyword preset   | **1**               | 1,000 allow-list entries                                    |
| Spam             | **1**               | —                                                           |
| Mention spam     | **1**               | Mention limit up to 50                                      |

Six custom keyword rules is the constraint that shapes everything. It is not enough to create one
rule per topic, so rules have to be grouped by **the action they take**, not by subject: everything
you want blocked silently in one rule, everything you want blocked-and-alerted in another,
everything that triggers a timeout in a third. Group by subject and you run out at six and have to
rebuild.

## Turn on the preset filters first

Server Settings → AutoMod. Start with Discord's own presets rather than custom rules, because they
are maintained for you and cover the highest-volume cases.

Three presets exist: sexual content, severe profanity, and slurs. Enable the ones your community's
rules already prohibit. If your rules do not prohibit it, do not filter it — an AutoMod rule that
contradicts your written rules is a support ticket waiting to happen.

For each preset, set the action to **Block message** and nothing else at this stage. Alerts and
timeouts come later, once you know the false-positive rate.

## Add the spam and mention rules

Two more built-in rules that almost every server wants:

- **Mention spam** — set a limit on how many unique user and role mentions a single message may
  contain. Five is a sensible starting point for most communities; raid messages routinely carry
  twenty or more.
- **Suspected spam content** — Discord's own classifier. Enable it; it catches the scam-link
  patterns that custom word filters never keep up with.

## Only now write a custom keyword rule

Custom rules are where servers hurt themselves. Two failure modes account for nearly all of it.

**Substring matching.** A rule blocking `ass` blocks _assassin_, _class_, _passage_ and
_assignment_. Use whole-word matching unless you genuinely intend the substring, and read your
wordlist back asking "what innocent word contains this."

**Blocking a symptom instead of a behaviour.** Filtering a specific scam domain works until the
scammers register a new one, which takes minutes. Filtering the _shape_ of the message — the
mention-spam and suspected-spam rules above — survives.

> Discord's wildcard syntax matters here. `word*` matches a prefix, `*word` a suffix, and `*word*`
> anywhere in the text. The bare form matches the whole word only. Getting this wrong is the single
> most common AutoMod misconfiguration.

### Regex, and what it will not accept

Each keyword rule accepts up to **ten regex patterns**, each up to 260 characters. Two constraints
decide whether a pattern you already have will work.

**No lookarounds and no backreferences.** Discord's engine does not support them, so a pattern
using `(?=...)`, `(?!...)`, `(?<=...)` or `\1` is rejected outright. Most patterns copied from
another moderation tool, a regex site or a language runtime use at least one of these.

**Ten patterns is the whole budget for that rule**, alongside its keywords. A rule carrying ten
narrowly-targeted patterns leaves no room for the eleventh case, which is why broad
behaviour-shaped patterns outlast specific ones here as much as anywhere else.

Test a pattern against real messages before saving it. A regex that is slightly too broad does not
announce itself — it silently blocks a class of legitimate messages, and the members affected
assume Discord is broken rather than reporting it.

### The allow list is the precision instrument

Every keyword rule takes an allow list: terms that are never matched even when a keyword or pattern
would catch them. It holds 100 entries on a custom rule and 1,000 on a preset rule.

This is what makes an aggressive rule survivable. Rather than removing a keyword because it catches
one legitimate word, add that word to the allow list and keep the coverage. A preset filter
catching a term your community uses in a specific and harmless sense is fixed here, in one entry,
rather than by disabling the preset.

## Set exemptions before you enable actions

Every rule takes exempt roles and exempt channels. Set them now, not after the first false positive.

At minimum, exempt your moderator roles from keyword filters. Moderators quote rule-breaking
content when discussing it, and a filter that blocks the mod team from doing moderation is a
genuinely annoying way to discover this.

If you run a channel where the filtered vocabulary is legitimately on-topic — a support channel
discussing scams, say — exempt it explicitly.

## Add the alert channel

Create a private `#automod-log` visible only to staff and set it as the alert channel on every
rule.

This is the step people skip, and it is the one that makes AutoMod maintainable. Without it you
never learn what is being blocked, so you never learn which rule is too aggressive. With it, a
week of alerts tells you exactly which rule to loosen.

## Only then add timeouts

Once you have watched the alert channel for a week and the false-positive rate is near zero, add
timeouts to the rules you trust.

Start short. A 60-second timeout stops a spam burst without punishing someone who tripped a filter
by accident. Escalating to hours belongs in human moderation, not in an automatic rule.

## A three-week rollout that does not break anything

The order above compresses into a schedule. Following it produces a configuration nobody has to
undo.

| Week | Do this                                                          | Watch for                                   |
| ---- | ---------------------------------------------------------------- | ------------------------------------------- |
| 1    | Presets + spam + mention spam, **Block message** only, alerts on | Which preset produces false positives       |
| 2    | Add custom keyword rules, still block-and-alert only             | Substring and wildcard mistakes             |
| 3    | Add timeouts to rules with a near-zero false-positive rate       | Whether a timeout lands on a regular member |

The reason for the gap between weeks is that a false positive rate is only visible over time. A
rule that looks perfect on the day it is written catches a legitimate message on day four, and if
timeouts are already attached, that member is punished for your configuration.

## When a rule is too aggressive

Work through this in order rather than deleting the rule.

**Add the specific term to the allow list.** Fixes the case without losing the coverage.

**Narrow the wildcard.** `*word*` to `word*`, or to the bare whole-word form. Most over-matching is
a wildcard that was never needed.

**Exempt the channel** where the vocabulary is legitimately on-topic.

**Remove the action, keep the alert.** A rule that alerts without blocking still tells you what it
would have caught, which is how you decide whether to re-enable it.

Deleting the rule is the last option, because it costs one of your six slots to recreate later.

## What AutoMod does not do

It reads message content. It does not see edits to nicknames, does not act on user profiles, does
not catch anything posted as an attachment or an image, and does not apply to messages from other
bots or webhooks.

[Anti-raid](/blog/protect-against-raids) — the join-rate spike, the mass of new accounts — is a different problem entirely, and
AutoMod does not address it. That needs a bot with join-gate logic, and it is worth configuring
separately.

Where a bot adds something genuinely beyond the built-in rules, it is usually one of three things:
regex-based custom filters, punishment escalation across repeat offences, or AI-based intent
detection that reads what a message _means_ rather than which words it contains. Vetox offers all
three — 8 rule types and 4 action types in its own Auto-Mod, free on every tier apart from the
escalation counter (1 rule free, 50 on any paid plan), plus AI-based intent moderation on its Black
plan — but configure the platform's own rules first regardless of which bot you run. They are free,
faster, and they apply before anything else sees the message.

The capacity difference is worth knowing when you meet the six-rule ceiling: Vetox's Auto-Mod
carries up to **1,000 keyword entries** with **20 exempt roles and 50 exempt channels**, and its
Automated Actions counts violations _across_ rules in a rolling window — which is the specific thing
AutoMod cannot do, because each of its rules evaluates alone.

## Check your work

Post a test message that should trip a rule, from an account without an exempt role. Confirm it is
blocked and that the alert lands in your log channel. Then post something that _nearly_ trips it
and confirm it does not.

The account matters more than the message here: testing from a moderator role you exempted earlier
is the reason a working rule looks broken, and it heads the list in
[why AutoMod is not catching anything](/blog/discord-automod-not-working) along with the wildcard
syntax and the per-type rule caps.

If you skip that second test, you will find out about the false positives from your members.

## Frequently asked questions

**How many AutoMod rules can a server have?** Six keyword rules, one preset rule, one spam rule and
one mention-spam rule.

**Does AutoMod work when my bots are offline?** Yes — it runs at the platform level, before a
message is delivered, independently of any bot.

**Why is my rule not blocking anything?** Most often the action is set to alert only. Nothing is
blocked until **Block message** is selected.

**Does AutoMod scan images or attachments?** No. It reads message text only, and does not apply to
other bots or webhooks.

**Can AutoMod escalate punishments for repeat offenders?** No — each rule evaluates independently
with no memory across rules or messages. Escalation requires a bot.