Last updated: November 6, 2026 · Category: Guide · Editorial review · About the authors
A Discord honeypot is a trap channel that no real member should ever post in. Spam bots and hacked accounts often post in every channel they can reach, so the moment an account writes in the honeypot, a bot removes it and deletes what it posted elsewhere.
This guide explains how a honeypot channel works, what it catches and what it misses, which sanction to choose, who to exempt, and how to set one up without punishing real members.
Key Takeaways
- A honeypot catches accounts by where they post, not by what they write. That is why it can catch image spam and reworded scam links that keyword filters miss.
- Softban is the safest default for hacked accounts: it removes the account and its recent messages, and the real owner can rejoin once the account is secure.
- A honeypot does not catch a single scam message posted in one channel, DM spam, or an attacker who reads the warning. Pair it with AutoMod and raid settings.
What Is a Discord Honeypot Channel?
A honeypot channel is a visible, writable channel with a clear warning not to post in it. Humans read the warning and leave it alone. Automated spam does not read anything. Scripts and hijacked accounts typically paste the same message into every channel they can access, and the honeypot is one of them.
The idea matters because spam on Discord happens at scale. In its transparency report for April to June 2022, Discord said it disabled 27,733,948 accounts for spam or spam-related offenses, and that 90% of those were disabled proactively, before any user report (Discord Transparency Report, Q2 2022, retrieved 2026-11-01). The figures are from 2022, but they show the scale a single server is exposed to.
A honeypot is also content-neutral. Keyword filters have to guess what spam will say next. A honeypot only needs the spammer to post where nobody else does.
What a Honeypot Catches and What It Misses
A honeypot is strong against one pattern: an account that posts in many channels at once. It is weak against anything slower or more targeted.
| Catches | Misses |
|---|---|
| Spam bots that post in every channel | A scam link posted once, in one channel |
| Hacked member accounts mass-posting a scam | Scam messages sent by DM |
| Image-only spam that text filters cannot read | A human raider who reads the warning |
| Text raids that hit every open channel | Accounts whose highest role is at or above the bot's |
| Reworded or obfuscated links | Accounts that cannot see the channel |
Because of the right-hand column, a honeypot is one layer, not a full defense. Discord AutoMod still handles bad words and links in normal channels. A raid with many fresh accounts calls for the steps in the Discord raid protection guide.
Three Ways to Set Up a Honeypot
There are three common ways to run a honeypot on Discord. They differ mainly in how much you configure yourself.
| Approach | How it works | Trade-off |
|---|---|---|
| Dedicated honeypot bot | A single-purpose bot creates the trap channel and sanctions anyone who posts | One more bot to add and trust; little else to configure |
| Feature of a moderation or tracking bot | A bot you already use offers a honeypot setting | No extra bot, but check which sanctions each plan includes |
| Custom rule in a moderation bot | A rule that matches any message in one chosen channel and triggers a ban | Flexible, but you handle the warning, exemptions, and cleanup yourself |
Dedicated bots exist, for example the Honeypot bot, public on GitHub (retrieved 2026-11-01). Several moderation and tracking bots offer the same idea as a built-in feature. Whichever route you take, adding a bot needs the right permissions; how to add a bot to your server covers the permission screen.
The decisions below apply to all three approaches.
Choosing the Sanction
The sanction decides what happens to a hacked member, so choose it for that case, not only for the spam bot.
| Sanction | What happens | Best for |
|---|---|---|
| Softban | Ban, then an immediate unban. Recent messages are deleted and the account can rejoin | Hacked member accounts (the safest default) |
| Ban | The account is removed and cannot rejoin; recent messages are deleted | Servers that see mostly throwaway spam accounts |
| Kick | The account is removed and can rejoin with any invite | Rarely ideal, because nothing is purged by Discord |
| Timeout | The account stays but cannot talk | Reviewing each case by hand |
| Role | A jail or muted role is assigned | Servers with an existing review channel |
Softban is a ban immediately followed by an unban. It works because a ban is the only Discord action that deletes an account's recent messages across the server in one step. Discord's API allows that purge to cover up to 7 days of history (604,800 seconds), per the Discord developer documentation (retrieved 2026-11-01). The same documentation caps a timeout at 28 days.
For a hacked friend, softban is the kind option. Their spam disappears, and they can come back once they have secured the account. A permanent ban turns a security incident into a lost member. Kick, ban, or timeout compares the underlying actions in more detail.
How Much History to Delete
A short deletion window is usually enough. A honeypot fires within seconds of a spam burst, so the messages to remove are the ones posted in the last few minutes.
A longer window is not automatically safer. On a hacked member's account, the older messages are often the member's own genuine conversations, and a 7-day purge erases them along with the spam. A window of around 10 minutes covers the burst without wiping the person's history.
Who Should Be Exempt?
Exempting staff sounds sensible, but it is a trade-off. A hacked staff account is the one that can do the most damage, because it can reach more channels and its messages look trustworthy.
There are two base settings, and ignored roles can be added on top of either:
- No one exempt. Everyone who posts is sanctioned, staff included. This is the strictest option.
- Staff exempt. Members with moderation permissions, such as Administrator, Manage Server, or Manage Channels, are not sanctioned. This avoids accidents during moderation but leaves a gap for hacked staff accounts.
- Ignored roles (optional). Members with chosen roles are not sanctioned, for example a trusted helper role.
Two Discord limits also apply. Discord does not let a bot act on the server owner or on anyone whose highest role is at or above the bot's highest role. And with a timeout sanction, members who have the Administrator permission cannot be timed out.
Where to Put the Channel and What to Write in It
Put the honeypot near the top of the channel list and make sure every member can see and post in it. A spam script only posts where it has access, so a hidden channel catches nothing.
The warning should be impossible to misread. A short line such as "DO NOT SEND MESSAGES HERE: anyone who posts is removed automatically" works better than a joke or a vague name. If your server is international, offer the warning in more than one language. Mention the channel in your server rules so new members know it exists.
If the channel's name leaks into spam lists, replace it with a new one under a different name.
How to Set Up a Honeypot in InviteForge
InviteForge includes a honeypot on every plan. The setup takes a few clicks:
- Open Dashboard > Protection > Honeypot.
- Click Create the channel.
- Pick a sanction, and optionally ignored members and a log channel.
InviteForge creates the channel at the top of your server with a random name, opens it to everyone, and posts a warning with two buttons. N blocked is a live counter that opens a stats image for the last 7, 14, or 30 days. Translate shows the warning in the member's Discord language. On the dashboard, Regenerate replaces the channel with a new name, and Disable deletes it and turns the honeypot off.
| Setting | Free and Supporter | PRO |
|---|---|---|
| Softban, ban | Yes | Yes |
| Kick, timeout, role | No | Yes |
| Durations | 1 minute to 28 days (timed ban) | 1 minute to 28 days (timed ban, timeout, role) |
| Ignored roles | Up to 25 | Up to 25 |
| Blocked-count stats | 7, 14, 30 days | 7, 14, 30 days |
Kick, timeout, and role are PRO because InviteForge has to delete the messages itself for those sanctions, while ban and softban use Discord's own purge. If a server leaves PRO, the honeypot keeps working with softban.
InviteForge needs Manage Channels and Manage Messages, plus the permission for your sanction: Ban Members (ban and softban), Kick Members, Timeout Members, or Manage Roles. These are not part of the default invite, so add them to InviteForge's role, and keep that role above the members it should act on. The honeypot documentation lists every option.
By default, no one is exempt, staff included, and bots never trigger the honeypot. When an account falls in, InviteForge applies the sanction, deletes the account's messages from the last 10 minutes across the server, and sends the account a DM, when its DMs are open, explaining what happened and how to secure it. The catch is posted in your log channel, if you set one, and appears under Recent catches on the dashboard.
After a Catch: What to Check
Whichever bot you use, read its log after each catch. Three checks are worth a minute:
- Was it a real member? If the log shows a long-standing member, reach out. A catch on a regular member usually means the account was compromised, and the member should secure it before rejoining.
- Did the spam land elsewhere first? Messages older than the deletion window stay up. Remove them by hand.
- Is it part of a wave? Several catches in a short time from new accounts suggest a raid, not a single hacked account. Switch to the raid steps covered earlier, and check whether the accounts are alts with Discord alt-account detection.
Frequently Asked Questions
Will a honeypot channel ban real members by accident?
It can, if a real member ignores the warning and posts in the channel. That is why softban is the safer default: the account is removed and its recent messages are deleted, but the person can rejoin straight away. A clear warning at the top of the channel keeps mistakes rare.
Does a honeypot replace AutoMod?
No. AutoMod reads what a message says, while a honeypot reacts to where a message is posted. AutoMod catches a bad word or link in any channel; a honeypot catches an account that posts everywhere at once. Most servers benefit from both.
What happens to a friend whose account was hacked?
With softban, they are removed, their recent messages are deleted, and they can rejoin once they have secured the account. InviteForge also sends the account a DM, when its DMs are open, explaining what happened and how to secure it.
Can the server owner or an admin be caught?
Discord does not let a bot sanction the server owner or anyone whose highest role is at or above the bot's highest role. InviteForge deletes their message and, if you set a log channel, the log explains why. Other staff can be caught unless you exempt them.
Is the InviteForge honeypot free?
Yes. The honeypot works on every plan with softban or ban. Kick, timeout, and role sanctions need PRO, because InviteForge has to delete the messages itself for those.
Related reading
- Discord Raid Protection: What to Do During a Raid and After
- About InviteForge (contact the team from that page)