Captcha and anti-raid: stop bots before they get in

An image captcha on join

As soon as a member joins your server, HurixBot shows them a code in a scrambled image (lines, dots, tilted characters) in the verification channel. The member types it with the "Verify" button, or straight into the channel: their message is deleted right away, and text that doesn't look like a code doesn't cost them an attempt.

Once verified, they get the automatic roles of the Welcome module. Until they pass, they don't have them: automated accounts stay outside.

Four difficulty levels

• Permissive: pick the right code among five choices;
• Standard: a 5-character code to copy;
• Aggressive: 6 characters, symbols included;
• Maximum: 8 characters with symbols.

Characters that look alike (I, l, O, 0, 1) are never used. You also set the number of allowed failures (1 to 10), automatic kick after too many errors, the delay between two attempts, how long the captcha lasts and the five messages sent to the member. The captcha is personal: another member can't solve it for them.

Raid mode spots suspicious waves

Nine detectors keep watching for what gives a raid away, each with its own threshold over a time window you choose:

• mass joins and invites created in bursts;
• the same invite used a large number of times (with the Invites module);
• identical messages sent by several accounts;
• simultaneous voice joins;
• sticker, emoji, file or link spam coming from several accounts.

Automatic quarantine, human decision

In automatic mode, going over a threshold turns raid mode on: the accounts involved are quarantined. HurixBot removes the roles it can manage, remembers them and gives the quarantine role; during the raid, every new arrival goes there too. Prefer to stay in charge? Manual mode just alerts your staff.

The bot never kicks anyone on its own. Your staff gets an alert with the cause and the number of isolated accounts, then decides: release a member (their roles are given back), turn the mode off, or run /raid purge, restricted to administrators and confirmed before it acts.

Accounts older than an age you set, trusted roles, staff and bots are never affected. And the mode turns itself off after a quiet period.

Ready in one command

/raid setup creates the quarantine role and channel, hides the other channels from that role and posts an explanation message. After that, /raid on, /raid off, /raid status and /raid release are all you need day to day, and everything can also be driven from the dashboard's Raid Mode tab.