Everything stingsby does, and how to set it up

Getting started

Once you have access, setup takes about a minute per server.

1. Get stingsby into your server. Ask for early access in the support server. When you're accepted, the maintainer opens stingsby to invites for a short time and sends you the invite link: open it right away and pick your server (you need Manage Server there). Stingsby stays in your server after invites are closed again. It's added with exactly the permissions listed in the next section.
2. Move the bot's role up. In Server Settings → Roles, drag stingsby above all regular member roles. Discord only lets a bot ban people whose highest role is below its own.
3. Create the trap: /honeypot setup. Leave channel empty and stingsby creates #🐝・dont-poke-the-hive at the top of the server, then posts and pins the warning. To use an existing channel instead: /honeypot setup channel:#your-channel.
4. Pick a private staff channel for reports: run /config and choose it in the 📝 Log channel menu.
5. Check everything: /security scan.
6. Test it with an alt account that has no staff permissions. Post in the trap: the alt should be banned, a report should appear in #mod-log, and /honeypot logs should list it. Then press 🔓 Unban on the report to let the alt back in.

Tips for the trap channel

• Keep it at the very top of the channel list. Spam scripts usually go top to bottom. The scan warns you if it isn't in the top 3.
• @everyone must be able to see and send messages there, or spammers can't trigger it.
• The pinned warning and channel topic explain the rule, so honest members stay out.

Permissions & role order

Stingsby is added with exactly these permissions (value 1099511720980):

Where the bot's role goes

This is the most common setup mistake. Staff roles can stay above the bot, because staff are never banned anyway.

/honeypot status, /config and /security scan all flag regular roles above the bot. If you use channel permission overrides, make sure stingsby has View Channel in the trap and Send Messages + Embed Links in the log channel.

Commands

/help only lists the commands you can use. Server admins can change who sees each command in Server Settings → Integrations → stingsby.

General · everyone

Honeypot · Manage Server

Security · Manage Server

Settings · Manage Server

/config opens the settings panel: a private message where each setting has a title, a one-line explanation and its menu or button, with the trap's state at the top and a permission check at the bottom. Every change is saved as soon as you pick it, shown at the top of the panel, and announced in the log channel.

Only the person who ran /config can use the panel. It greys out after 10 minutes without a click; run /config again.

Experimental features · Manage Server

/experimental opens a second panel, just for the 🧪 experimental features. They're still being tested, so each one needs the bot owner's approval for your server first. It works like /config: private, saved straight away, and announced in the log channel.

Clean-up · Manage Messages

• Give amount, minutes or both. With both, a message must match both: amount:50 minutes:10 deletes at most 50 messages, all from the last 10 minutes.
• Pinned messages are always kept, including the honeypot's warning.
• Only the newest 2000 messages of each channel are checked, and archived threads are skipped.
• Discord only bulk-deletes messages under 14 days old. Older ones are removed one by one, which is slower.

When the trap fires

The accounts stingsby catches are usually real members whose accounts were hacked. Choose what happens to them in /config:

Escalating, in detail

• Strikes reset after 90 days without being caught (configurable in ⏱️ Durations), so someone hacked again much later starts from the first step.
• A burst of spam counts as one strike, and a timed-out account can't post, so strikes can't pile up in seconds.
• The DM and the report show which strike it was and what happens next time. That's a strong nudge to secure the account.
• 🔓 Unban and 🔊 Remove timeout undo the punishment but keep the strike. 🕊️ Forgive on the report clears the user's strikes.
• Without Timeout Members, the timeout steps become softbans, and /security scan warns about it.
• A timed-out member can't post but stays in the server and can still DM members. If that worries you, choose Softban.

New accounts: whatever the action, an account younger than the 🆕 New accounts setting (default 1 day) is banned straight away, without strikes. These are almost always throwaway spam accounts, not hacked members. The report and the DM say why.

1. DM to the account: just before the action, stingsby messages the user: which server it was, what happened and why, how to secure their account (change the password, turn on 2FA, remove unknown authorized apps), and how to get back in afterwards. It has to come first, because Discord blocks DMs once the user shares no server with the bot. If their DMs are closed, the action goes ahead anyway.
2. The action, with the reason “stingsby: posted in the honeypot channel (likely compromised account)”. It shows in your Audit Log.
3. Clean-up: everything the user posted in the last delete_hours is deleted, in every channel.
4. Event log: a ban, softban or timeout event is saved with the user's name, ID and the message that triggered it.
5. Report in the log channel: avatar, username and ID, account age, join date, how much history was deleted, the trigger message, and a button to undo it: 🔓 Unban after a ban, 🔊 Remove timeout after a timeout (a softban needs none). A brand-new account is a red flag; an old one usually means a real member's account was compromised.
6. Cool-down: for 30 seconds, more messages from the same user are ignored, so a burst of spam doesn't cause repeated bans.

Undoing a ban: press 🔓 Unban on the ban report. It needs Ban Members, turns grey with the name of whoever used it, and is recorded in the event log. It keeps working on older reports after the bot restarts. You can also use Server Settings → Bans → select the user → Revoke Ban. Either way, the person needs a new invite link to rejoin, and deleted messages can't be restored.

Raids and DM spam

Some attacks never touch the trap: a wave of bot accounts joining at once, or one account DMing every member. Stingsby watches for them, posts an alert in the log channel (pinging the role you choose) and can pause things for you. Set it up with the 🚨 Incidents button in /config. It opens a form: pick the role and type the numbers.

What triggers an alert

• Discord's own detection. When Discord flags a raid or unusual DM activity in your server, stingsby is told straight away.
• Stingsby's join-spike detector. It counts joins itself, so it can warn you before Discord flags anything: a burst of joins, or several brand-new accounts arriving together.

Each alert says what happened, what was paused and until when, and what to check next. If something was paused, the alert has ▶️ Resume DMs or ▶️ Resume invites buttons (Manage Server needed). Pauses end by themselves; Discord allows 24 hours at most. You get one alert per kind every 30 minutes, so a long raid doesn't flood the channel, and every alert is saved to the event log.

Join log

Pick a channel in the 📥 Join log menu of /config (a private staff channel works best, and it can be your log channel). Stingsby then posts every member who joins or leaves. For a join:

How stingsby knows who invited them

Discord doesn't say which invite someone used. Stingsby keeps a count of how often each invite has been used, and when a member joins it checks which count went up:

• One invite went up: that invite and the person who created it.
• The vanity URL went up: your server's vanity URL.
• A single-use invite disappeared: that invite, because Discord deletes it as it's used.
• Several went up at once (people joining in the same second): all of them, listed as candidates.
• Nothing changed: "couldn't tell", for example Server Discovery, or an invite created and used while stingsby was offline. Bots are shown as added by an admin, because they don't use invites.

Leaves

Leaves go to the same channel, as 📤 Member left: when they left, how many members are left, when they joined and how long they stayed (under a day is flagged ⚠️), their account age, and how they joined. When stingsby itself removed them (a trap ban or softban), the post is red and says so.

Leaving never lowers an invite's count. Discord's use count includes everyone who joined through an invite, even people who left later, and stingsby only looks at counts that go up.

Joins and leaves are also saved to the event log: /honeypot logs kind:Joins and leaves lists them, and user: shows one person's joins and leaves. Ban reports show how the caught account joined, so you can spot one invite bringing in several spam accounts.

Who is never banned

• Bots and webhooks
• The server owner
• Anyone with Administrator, Manage Server or Ban Members, so staff can post in the trap, e.g. to update the warning
• Anyone with a role picked in the 🛡️ Exempt roles menu of /config

Everyone else is banned, including long-time members whose account was compromised. That's on purpose: a compromised account looks exactly like its owner. Once they recover it, they can ask to be unbanned.

Event log

Each server has its own log, shown by /honeypot logs and included in reports. Events are kept for 90 days. The log is recorded even when no log channel is set; the log channel is a live feed of the same events.

Security scan

Each problem ❌ costs 20 points and each recommendation ⚠️ costs 8. Grades: Excellent ≥ 90, Good ≥ 75, Fair ≥ 50, otherwise Poor. The scan only reads settings and changes nothing.

Reports

/security report days:7 replies with a summary (bans, failed bans, warnings, setting changes, the busiest day and the security score) and attaches a Markdown file, honeypot-report-<serverID>-<date>.md, with:

• the server, its ID and the exact time range (UTC)
• a summary table and the current configuration
• every scan finding, with explanations
• every banned account: time, result, username, ID and trigger message
• every setting change, clean-up, unban and warning, with who did it

Markdown opens in any text editor and looks tidy on GitHub, in Obsidian or in VS Code, so you can keep it as an audit record or share it with co-admins.

Languages

Stingsby speaks 11 languages, and each server picks its own. Replies, ban reports, the DM to banned accounts, the pinned warning, the Audit Log ban reason and report files all follow the server's language.

Pick the server's language in the 🌐 Language menu of /config.

Automatic is the default. On a Community server it uses the server's primary language when stingsby has it, and English otherwise. The command descriptions in Discord's command menu (the list that opens when you type a slash) follow each member's own app language. Command and option names stay in English in every language, so these docs match for everyone.

Discord's own menu and permission names are quoted the way Discord shows them in each language, so members can find them. Two languages work a little differently:

• Arabic: Discord's app has no Arabic, so command descriptions stay in English and Automatic can't detect an Arabic server. Choose it in /config, and everything stingsby writes is in Arabic. Discord's menu names stay in English, as Arabic speakers see them in the app.
• Portuguese: Discord only offers Brazilian Portuguese, so the command menu is in Brazilian Portuguese for everyone. Servers in Portugal can still get European Portuguese replies by choosing Português (pt-PT) in /config.

Data & privacy

Stingsby keeps a small database with only what it needs to protect your server. Nothing is shared with anyone other than Discord.

• Per server: the trap, log and join log channel IDs, the delete window, whether the trap is on, the language, the action and its durations, the new-account limit, the incident settings, and exempt role IDs.
• Join-spike detector: only the time of recent joins, and whether each account was brand-new, kept in memory for 10 minutes. Nothing about joining members is saved by it.
• Join log (only if you turn it on): each join is saved to the event log with the member's name and ID, and the inviter's name and ID with the invite code; each leave with the member's name and ID and when they had joined. To tell which invite was used, stingsby keeps each invite's code, use count, creator and channel in memory only.
• Event log: time, kind, user ID and username, and details. The trigger message is the only message content stored, only for accounts that fell into the trap, cut to 1000 characters.
• Strikes (escalating action only): user ID, how many times caught, and when last.
• Events are deleted automatically after 90 days; strikes once they expire.
• Removing stingsby from your server keeps its settings, events and strikes for 30 days, in case it's added back, then deletes them. If it's added back in time, everything is restored and the trap comes back paused until your staff arm it again.
• 🗑️ Reset or delete data in /config: Reset settings, keep log deletes the settings but keeps the event log, so you keep your audit trail. 🔥 Delete all data deletes everything straight away. stingsby stays in the server either way.

The full details are in the Privacy Policy, and the rules for using stingsby are in the Terms of Service.

Troubleshooting

Limitations

• Early access only. Stingsby is in an early stage of development and isn't open to the public yet. Features, texts and settings may still change between versions. Ask for access in the support server.
• Spam that skips the honeypot isn't caught, unless the experimental duplicate detection is on and the account posts the same message in 3 or more channels. Keeping the trap at the top and open to everyone makes this unlikely.
• Accidents happen. A member who ignores the warning gets banned. The warning and channel topic are there to prevent it, and bans can be undone.
• One trap channel per server. Threads inside it are covered too.
• Deleted messages can't be restored. 7 days is the most Discord deletes on a ban.
• The scan checks settings, not members. It doesn't need access to your member list.