How to Stop Scam Links in Discord

By BotDrop · Updated October 17, 2026 · Free guide, no purchase needed

Scam links are the most common way gaming servers get hurt: a "free Nitro" message, a fake Steam login page, or a friend's hacked account posting the same link in every channel. Discord gives you free tools to stop most of them. This guide walks through the settings in the order we'd set them up, and takes about 15 minutes.

Good news first: Discord already runs a suspicious link filter in every Community server. It blocks links to known malware and phishing sites from a regularly updated list. New scam sites appear every day, though, so the steps below close the gaps.

Step 1: Turn on AutoMod's spam filters

AutoMod is Discord's built-in filter. It checks messages before they're posted, in text channels, threads and text chat in voice channels. You need the Manage Server or Administrator permission, and you have to use Discord on a computer: AutoMod rules can't be edited on mobile.

1. Open Server Settings → AutoMod.
2. Turn on Block Spam Content. It's trained on messages people have reported as spam, such as "free Nitro" ads and invite spam. Choose Block message and Send alert.
3. Turn on Block Mention Spam and set a limit, for example 5 mentions per message (the maximum is 50). Raiders often ping dozens of people with a scam link.

Discord says plainly that the spam filter isn't perfect. Repeated copy-paste spam across channels, for example, can slip through. That's what the custom rule in the next step is for.

Step 2: Add a custom rule that blocks risky links

Under Custom Keyword Rule, click Set Up. You can fill it with plain keywords, regex patterns, or both.

Keywords for common scam bait

Start with phrases scammers reuse. AutoMod matches a multi-word phrase only when the exact phrase appears, and a * at the start or end matches word variations (nitro* also catches "nitrogift").

free nitro
nitro gift
steam gift
free skins
*airdrop*

Tip: when you spot a new scam message, highlight the word, right-click it and choose Flag Word to add it to a rule straight away.

Regex patterns for links

Regex lets one line match many variations. AutoMod uses the Rust flavor of regex, with case-insensitive matching already on. You can add up to 10 patterns per rule, and Discord limits their length, so keep them short. These three cover most link scams:

(discord\.gg|discord(app)?\.com/invite)/\S+
\[[^\]]*\]\(\s*<?https?://
https?://\S+

• Line 1 blocks invites to other servers, a favourite of spam accounts. If your own invite gets caught, add it to the rule's allow list.
• Line 2 blocks masked links, where the text you see (like "steamcommunity.com") hides a different address.
• Line 3 blocks every link. Use it only together with exemptions: exempt your #clips or #links channel and trusted roles such as @Regulars, so new members can't post links but known members can.

Choose what happens

• Block message, with a short custom message (up to 150 characters), for example: "Links are off for new members. Post it in #links or ask a mod."
• Send alert to your mod-log channel (Step 5).
• Timeout member is optional. It's only available on custom keyword rules, and it's handy against hacked accounts that spam.

Test before you rely on it. Admins and members with Manage Server are always exempt, so your own test messages won't be blocked. Discord recommends testing from a normal, non-moderator account: send a few messages that should be blocked and a few that shouldn't.

Step 3: Set a verification level

Verification levels stop brand-new throwaway accounts from chatting right away. Open Server Settings → Safety Setup → Verification Level. In a Community server it's under Safety Setup → DM and Spam Protection.

A verified phone number skips the other checks at every level. For most gaming servers, Medium or High is a good everyday choice. Raise it to High or Highest during a raid, then lower it again afterwards.

Step 4: Tighten a few permissions

Scams spread faster when a hacked account can ping everyone or create webhooks. In Server Settings → Roles, check @everyone and every non-staff role:

• Turn off Mention @everyone, @here, and All Roles. Discord recommends giving this only to trusted roles.
• Give Manage Webhooks, Manage Server and Administrator to as few people as possible. Discord's safety team specifically suggests auditing who can manage webhooks.
• Consider turning off Embed Links for new members, so a link they post doesn't show a convincing preview card.
• As the owner, turn on the 2FA requirement for moderation in Safety Setup. Then a moderator's stolen password alone can't be used to ban people or delete channels. You need 2FA on your own account first.

Step 5: Make a private mod-log channel

Create a text channel such as #mod-log and make it visible only to your moderator role. Then:

1. Pick it as the alert channel in each AutoMod rule. Every alert shows who posted, what they tried to post and where, with an Actions button to time out, kick or ban, and a Report Issues button if AutoMod got it wrong.
2. If you see Raid Protection under Safety Setup, send its alerts to the same channel. Discord is still rolling it out to Community servers, so not every server has it yet.
3. Use Server Settings → Audit Log to see who changed roles, channels or webhooks.

One quiet channel for everything means a moderator can spot a hacked account within minutes, not hours.

Warning signs of a scam link

Share these with your members, for example in your rules channel:

• "Free Nitro" or a Steam gift from someone you don't know, or from a friend who suddenly writes differently. A real Nitro gift appears in chat as a gift card with an Accept button, and real purchases only happen inside Discord or its official Amazon store.
• Look-alike addresses with one letter swapped or added, such as discorcl or steamcommunnity, or an unusual ending.
• Pressure and threats: "your account will be banned", "I reported you by mistake, talk to this admin", "claim in the next 10 minutes".
• "Log in with Steam" on a site that isn't Steam's. Fake login pop-ups can look perfect, so check the address bar.
• "Scan this QR code" or "try my game, here's the download". Discord's safety team warns never to scan a QR code from someone you can't verify.
• A new account posting the same link in several channels within a minute.

Discord will never ask for your password or payment details in an unsolicited message.

If someone already clicked

1. Time out or remove the account that posted it and delete the messages.
2. Tell the member who clicked to change their password and turn on two-factor authentication. If they typed in Steam details, they should secure their Steam account too.
3. Report the messages to Discord. Add the domain to your custom keyword rule so it can't be posted again.

Sources

• Discord: AutoMod FAQ
• Discord: Filter Messages Using Regular Expressions (Regex)
• Discord: Why was my message not delivered? (suspicious link filter)
• Discord: Verification Levels
• Discord: How to Protect Your Server from Raids 101
• Discord: Safer Ways to Shop on Discord (phishing signs)
• Discord Safety Center: Protecting Against Scams on Discord
• Discord Safety Center: Four steps to a safer server (2FA for moderators)

Checked against these pages on October 17, 2026. Menus in Discord and Steam move from time to time; if a button has a slightly different name, look for it nearby.