Honeypot
Honeypot pins a decoy channel to the top of your server with one rule: don’t post here. Real members read it and move on. A hijacked account running a scam script posts everywhere it can — including here — and that is the mistake. The message is deleted, the account is banned, and its last day of messages goes with it.
Immune before it even reads the message: owners, admins, and anyone who can ban members or manage the server or its channels.
The whole thing turns on one channel nobody should ever use.
The decoy
/setup drops a channel at the top of the list, above your rules, and pins one warning: post here and you are gone. Members clock it in two seconds and never think about it again.
The tell
A hijacked account is not reading channel descriptions. It is a script pushing the same scam into every channel it can reach. The decoy is the one place a real person would never post, so anything that does gives itself away.
The close
Honeypot deletes the message, DMs the account why it was removed, bans it, and wipes its last day of history. The whole event is written to your log channel as a record you keep.
It will not ban someone who could ban it back.
Before Honeypot looks at a single message, it asks one question: does this account hold any real power in the server? If it does, the account is left alone. A moderator who fat-fingers a message into the trap is never at risk — the check runs on permissions, so it covers everyone Discord already trusts.
- Server owner
- Administrator
- Ban Members
- Manage Server
- Manage Channels
- Other bots & webhooks
The parts that matter once it is actually running.
It confirms it can ban before it tries
If the offender’s top role sits above Honeypot’s, Discord refuses the ban. Rather than fail quietly, Honeypot skips the action and surfaces the role-order problem in /status so you can move its role up.
The trap puts itself back
Delete the channel and it returns on the next trigger. Drag it down the sidebar and it climbs back to position one. There is no upkeep and no channel to babysit.
Every ban stays on the record
Each catch is written to Postgres — the account, its ID, the message it sent, and the timestamp — and it stays there for good. Not a log file that rolls over at midnight.
You set how it behaves
/configure changes the log channel, the wording of the ban DM, the embed colour, and whether it DMs at all. It is buttons and dropdowns, and it saves to the database the instant you click.
There is nothing to run
Add it and run /setup. No database to stand up, no host to keep alive, no file to edit. It is already running on our infrastructure.
Let the next hijacked account walk right into it.
Add Honeypot, run /setup once, and the trap is live on your server.
Add to Discord