Honeypot channel (anti-spam)

The Honeypot plugin is a spam trap. The idea: spam bots post in every channel the moment they join, while real users read first. So you create a channel that legitimate members would never post in — and anyone who does is treated as a likely bot.

Beta — tested, but still young.

Auto setup

The quickest way: open Anti-Spam in the sidebar → Honeypot tab and click Auto setup. CloudMod then:

• creates a 🚫・do-not-post channel at the very top of your main server. Everyone can see it and write in it — that's the point of a trap. If a trap channel is already set, it's reused instead.
• posts a warning card there as Honeypot (its own webhook with a honey-pot avatar). It tells members that the channel is a spam trap, names the action you picked, asks them to simply ignore it, and shows how many spam bots all CloudMod honeypots have caught so far (more under The warning card).
• switches the plugin on and confirms it in your Honeypot log.

Click it again after changing the action and the warning is updated — no second post. Without Manage Webhooks the warning is posted by CloudMod itself, and the log says why. Auto setup counts toward your plan's plugins just like switching the plugin on.

Our own warning never triggers the trap: bot and webhook messages are always ignored.

Set it up by hand

1. Create a channel real users won't post in. Name it clearly (e.g. 🚫 do-not-post) and place it at the top so it's the first thing a bot hits.
2. Enable the Honeypot Channel plugin in the Plugin Market.
3. Open Anti-Spam in the sidebar → Honeypot tab, pick that channel and choose what should happen.
4. Save. With Post the warning card on (the default), CloudMod posts the warning card in that channel for you — see below.

Posts in a thread of the trap channel count too.

The warning card

The card tells members in plain words that the channel is a trap, names the action you picked, and asks regular members to simply ignore it. Under the text sits a grey button, for example 🍯 Caught on all CloudMod servers: 1,234. That is the number of spam bots the honeypots of all CloudMod servers have caught so far — not just yours.

• Only a catch where the action actually worked counts. If it failed (a missing permission, say), it doesn't.
• The number never goes down.
• It is refreshed in the background, at most about once an hour per card, so a card can be a little behind.
• The button is greyed out on purpose: it only shows the number, there is nothing to click. (If Discord ever refuses the button, the same number shows as a small line of text instead.)

Picking the channel yourself? Turn on Post the warning card on the Honeypot tab (on by default). When you save, CloudMod posts the card in the channel you picked and keeps it up to date when you change the action. Pick a different channel and the card in the old one is removed. CloudMod never creates a channel this way — only Auto setup does. Turn the switch off if you'd rather write your own warning; CloudMod then leaves the channel alone.

Action when someone posts

Pick one action (configurable per server):

• Ban (default) — the user's messages from the last hour are also purged server-wide, since spam bots usually post across many channels. In Network mode with Network bans (cross-server) on, a ban on your main server also applies on every sub-server; a ban on a sub-server stays there.
• Kick — remove them (they can rejoin).
• Timeout — mute them for a set number of minutes (default 60, up to 40320 = 28 days).
• Quarantine role — assign a role (e.g. a read-only lockdown) for manual review.

The trap message is deleted together with the action. If CloudMod can't carry out the action (a missing permission, or the member's role sits above CloudMod's), nothing is done at all — no DM, no deletion — and the log shows 🍯 Honeypot triggered — action failed in orange with the reason.

DM the user is off by default. Turn it on to send a notice before the action. Your text can use {user_mention}, {user_name} and {guild_name}.

Who is never affected

The honeypot never acts on:

• Admins (members with Manage Server)
• Whitelisted users (Project settings → Whitelist (trusted users))
• CloudMod admins (the users listed under Project settings → Admins & permissions)
• Bots and webhooks (including the warning posted by auto setup)

Filter-exempt roles do not protect anyone here — the trap is meant to catch hijacked trusted accounts too.

Every trigger is posted to the Honeypot logging category (Automod group) as 🍯 Honeypot triggered, with the action taken.

Make sure the bot has the permission for your chosen action (Ban Members / Kick Members / Moderate Members / Manage Roles) plus Manage Messages, and that its role sits above the members it should act on. Auto setup additionally needs Manage Channels (and Manage Webhooks for the Honeypot webhook).