AutoMod lives on the AutoMod tab of the Moderation plugin. It is fourteen independent rule sets that all share the same structure:
Action — what happens on a hit Role permissions — who the rule applies to Channel permissions — where it applies Settings — the knobs specific to that rule
Every rule starts Disabled. Nothing runs until you pick an action. Rules are checked in a fixed order (scam links first, anti-spam last) and only the first rule a message trips acts on it.
| Action | Deletes the message | Writes a warning | Times the member out |
|---|---|---|---|
| Disabled | — | — | — |
| Delete message | ✓ | — | — |
| Warn user | — | ✓ | — |
| Delete message & warn user | ✓ | ✓ | — |
| Timeout user | — | — | ✓ |
| Delete message & timeout user | ✓ | — | ✓ |
Every hit is mirrored into your mod-action log channel, with the rule name and the message that
triggered it. A warning also opens a case of type automod. Warn and timeout actions post a short
notice in the channel that deletes itself after a few seconds.
Cloudy skips a step Discord would refuse anyway: without Manage Messages in the channel nothing is deleted, and a member with a role above Cloudy's (or with Administrator) is not timed out. The hit is still logged, with only what actually happened.
Both scopes use the same two modes, and getting them the wrong way round is the classic AutoMod mistake.
| Mode | Meaning |
|---|---|
| Deny for all roles except … | The rule is enforced for everyone; the listed roles are exempt |
| Allowed are all roles except … | The rule is enforced only for members holding a listed role |
Almost always you want the first mode with your staff roles listed — enforce for everyone, exempt the moderators. Up to 50 roles.
The same two modes, applied to channels. Ids may be individual channels or whole categories — a category id covers every channel inside it, threads included.
| Mode | Meaning |
|---|---|
| Deny in all channels except … | Enforced everywhere except the listed channels |
| Allow in all channels except … | Enforced only in the listed channels |
Up to 100 channels. The classic use of the second mode: an #off-topic channel where the link rule
applies and nowhere else.
The first ten describe messages a member might plausibly send by accident. The last four — grouped under Attack patterns — describe things nobody produces unintentionally, which is why their defaults are tighter and why they are worth having even on a server that leaves every content filter off.
Blocks messages containing words from your own lists. Two lists, matched differently:
| Setting | Limits | Behaviour |
|---|---|---|
| Word list (exact match) | up to 200 entries, 1–64 characters each | Matches whole words only. ass does not trip on class |
| Word list (any part of the word) | up to 200 entries, 1–64 characters each | Matches anywhere inside a word. ass does trip on class |
Press Enter or type a comma after each word. Both lists are case-insensitive, ignore zero-width
characters and also catch common leetspeak (@ for a, 3 for e, 0 for o, $ for s …).
Start with the exact-match list; the partial list produces false positives fast (this is the
"Scunthorpe problem").
Long runs of the same character or the same word repeated.
| Setting | Range | Default |
|---|---|---|
| Max repeated characters | 3–50 | 10 |
| Max repeated words | 2–20 | 3 |
Discord invite links (discord.gg, discord.com/invite, discord.me, dsc.gg).
| Setting | Limits |
|---|---|
| Allowed invite codes | up to 100 entries, 1–64 characters each |
The code is the part after discord.gg/. Your own server's vanity URL is always allowed and does not
need an entry. This is the safest rule to enable first — almost no false positives.
Any http(s):// or www. link.
| Setting | Limits |
|---|---|
| Allowed domains | up to 100 entries, 1–200 characters each |
Subdomains are included: allowing youtube.com also allows music.youtube.com.
Messages that are mostly uppercase.
| Setting | Range | Default |
|---|---|---|
| Uppercase threshold (%) | 10–100 | 70 |
| Minimum letters | 1–100 | 10 |
The minimum stops short messages from tripping it — without it, "OK" is 100 % uppercase. Custom
emoji names (<:OMEGALUL:…>), mentions and links are not counted as letters.
| Setting | Range | Default |
|---|---|---|
| Max emojis | 1–50 | 5 |
Counts unicode and custom emojis together. The rule trips when a message contains more than the maximum — the same holds for every "max" setting on this page.
| Setting | Range | Default |
|---|---|---|
| Max spoilers | 1–50 | 3 |
Counts ||spoiler|| blocks.
| Setting | Range | Default |
|---|---|---|
| Max mentions | 1–50 | 3 |
Counts user, role, @everyone and @here mentions together — each one once, however often it is
pinged, the way Discord's own mention limit counts. @everyone and @here count only as a word of
their own, not inside an e-mail address like admin@here.com. One of the three rules worth enabling
on day one — mass-mention spam is the most common raid tactic.
Corrupted text built from stacked combining characters.
| Setting | Range | Default |
|---|---|---|
| Max combining marks | 1–50 | 6 |
Too many messages in a short window.
| Setting | Range | Default |
|---|---|---|
| Max messages | 2–30 | 8 |
| Time window (seconds) | 2–120 | 10 |
Counts per member across the whole server, not per channel — hopping between channels does not reset the counter. Edits do not count as new messages.
Four rules for behaviour that is never accidental. If you enable nothing else on this page, enable these.
Blocks phishing and scam domains — fake Nitro giveaways, cloned Steam login pages, "free gift" sites.
| Setting | Limits | Default |
|---|---|---|
| Extra domains | up to 200 entries, 1–200 characters each | empty |
| Lookalike detection | on / off | on |
Cloudy ships a built-in list of known scam domains that you cannot edit — a server removing
discordnitro.gift from it helps nobody. Extra domains adds your own on top; enter bare
hostnames, subdomains are matched automatically.
Lookalike detection additionally flags domains that imitate Discord or Steam without being on any
list yet: disc0rd.gg, discord.gg.example.com, steamcommunity.ru, near-miss spellings like
steamcommunlty.com, look-alike letters from other alphabets (a Cyrillic і in dіscord.com) and
the brand next to a lure word (discord-nitro-free.…, steamcommunity-trade.…). Discord's and
Valve's own domains are never flagged, and neither are sites that merely carry the name, such as
steamdb.info or discord.js.org. Leave it on — new phishing domains appear daily and a list alone
is always a day behind.
The same message posted in several channels in quick succession — the signature move of a compromised account.
| Setting | Range | Default |
|---|---|---|
| Max channels | 2–20 | 3 |
| Time window (seconds) | 5–300 | 30 |
Messages shorter than 12 characters are ignored, so a "hi" in three channels is not spam.
Too many attachments in a short window, regardless of what they contain. Counted per attachment — ten images in one post is the same flood as ten posts.
| Setting | Range | Default |
|---|---|---|
| Max attachments | 2–50 | 5 |
| Time window (seconds) | 5–120 | 20 |
The same idea for stickers, which slip past every text-based rule.
| Setting | Range | Default |
|---|---|---|
| Max stickers | 2–50 | 4 |
| Time window (seconds) | 5–120 | 20 |
Rules using a timeout action share one setting:
| Setting | Range | Default |
|---|---|---|
| Timeout duration (minutes) | 1 minute – 28 days (40320 minutes) | 10 minutes |
28 days is Discord's hard cap on communication timeouts, not a Cloudy limit.
Warnings on their own do nothing. Escalation turns an accumulated count into a punishment:
"At X active warnings, do Y."
Up to 10 steps, each with a unique threshold. A step fires when a strike takes the member's
active warning count across its threshold, so each level punishes once. The check runs for every
strike — an AutoMod warning or a /warn — and two warnings landing at the same moment are counted
one after the other, so a step can neither fire twice nor be skipped. The punishment is recorded as a
case of its own.
Editing a message that already cost a strike does not cost another one.
| Field | Range | Notes |
|---|---|---|
| Threshold | 1–100 | Must be unique across steps |
| Action | Timeout · Kick · Ban | |
| Timeout duration | 1 minute – 28 days | Timeout steps only, default 1 hour |
A sane starting ladder:
| Warnings | Action |
|---|---|
| 3 | Timeout 1 hour |
| 5 | Kick |
| 7 | Ban |
0–365 · default 0
Warnings older than this stop counting toward the thresholds. 0 means warnings never expire.
Override the bot's built-in channel messages. Leave a field empty to use the default in your server's language. Each up to 500 characters; the notice deletes itself after a few seconds.
| Notice | Placeholders |
|---|---|
| Warn notice | {user} {rule} |
| Timeout notice | {user} {rule} |
| Escalation notice | {user} {count} {action} |
{user}, watch your language — {rule} is not allowed here.
{user} was muted — {rule}.
{user} collected {count} warnings and was {action}.
{rule} is not available in the escalation notice. Escalation fires for a warning total, not for
a single rule, so the placeholder would have no value to fill in and stays as literal text.Cloudy reads a message after Discord has delivered it. Discord's own AutoMod checks it before it is published. For a scam link that difference is the whole point: one blocks the message, the other deletes it a moment after everyone with the channel open has already read it.
Turn native AutoMod sync on (Moderation → Protection) and Cloudy creates matching rules inside Discord's own AutoMod for the three rule shapes Discord is able to express:
| Cloudy rule | Mirrored |
|---|---|
| Bad words | ✅ both word lists |
| Scam links | ✅ the built-in list and your extra domains — lookalike detection stays with Cloudy |
| Excessive mentions | ✅ the mention limit |
| Everything else | ❌ — stays with Cloudy's engine |
The rest cannot be mirrored because they depend on state Discord's AutoMod does not track: how many messages arrived in the last ten seconds, how many channels the same text appeared in, how many warnings this member already has.
A message Discord blocks never reaches the server, so Cloudy cannot see it: no warning, no case and no mod-log entry is written for it. Cloudy's engine keeps running alongside and still handles whatever gets through — edited messages, lookalike domains, and members exempt from the Discord rule.
Role and channel exemptions are mirrored only for the Deny for all … except modes (Discord accepts up to 20 exempt roles and 50 exempt channels per rule). A rule in the Allowed are all … except mode is mirrored without scoping and applies to everyone.
Cloudy reconciles the mirrored rules every 30 minutes. Setting a mirrored rule to Disabled removes its Discord counterpart on the next sync; switching the option itself off stops syncing but leaves already-created rules in place. With the moderation plugin off, or the licence expired, the next sync removes the mirrored rules. A sync Discord partly refused is retried on the next run. The feature needs the Manage Server permission; without it Cloudy silently keeps the engine-only behaviour instead of failing.
Four rules, conservative actions, escalation on:
| Rule | Action |
|---|---|
| Scam links | Delete message & timeout user |
| Server invites | Delete message |
| Excessive mentions | Delete message & warn user |
| Anti-spam | Delete message & timeout user |
Exempt your staff roles on all four, run it for a week, read the mod log, then tune thresholds before adding more rules.
Scam links is the one to enable even if you disagree with everything else here: it has no false positives worth worrying about, and the message it stops is the one that costs a member their account.