Guides · 8 October 2026 · 4 min read

What is a Discord honeypot channel, and how do you set one up?

A honeypot channel is a trap that people avoid and spam scripts walk straight into. It's one of the simplest and most reliable ways to catch compromised accounts before their scam links reach your members.

The idea in one sentence

A honeypot channel is a channel that everyone is told, with a clear pinned warning, never to post in. People read the warning and stay out. Spam scripts don't read anything: they paste their message into every channel they can reach, so the first account to post in the honeypot is almost certainly a script, not a person, and a bot can remove it on the spot.

Why it works so well against compromised accounts

Most spam on Discord today doesn't come from brand-new bot accounts. It comes from real members whose accounts were taken over: someone scanned a fake QR code, logged in on a fake page, or ran a "game" that stole their login token. The scammer then runs a script on that account.

That makes the usual defences weak:

  • The account looks trusted. It may be years old, have roles, and have passed your verification long ago.
  • The wording changes all the time. Word filters and link blocklists are always one step behind the next fake domain.
  • It's fast. A script can reach every channel in seconds, before a moderator even sees the first message.

A honeypot doesn't care what the message says or how old the account is. It reacts to behaviour that people don't have: posting in the one channel everyone was told to avoid. That's why it catches scam waves that keyword filters miss, with almost no false alarms.

Won't it catch my real members?

Very rarely, and it's easy to undo. A good honeypot setup protects honest members in several ways:

  • A pinned warning and a channel topic explain the rule, and the channel's name says it too (stingsby's default is 🐝・dont-poke-the-hive).
  • Staff are never caught: the server owner, anyone with Administrator, Manage Server or Ban Members, bots, and any roles you exempt. See who is never banned.
  • Every action is reported to your staff with the message that triggered it and a one-click Unban button.
  • You can choose a milder action than a ban: a softban (removed and messages deleted, but free to rejoin) or a timeout. See when the trap fires.

How to set up a honeypot channel with stingsby

Discord can't do this on its own: AutoMod has no rule for "anyone who posts in this channel". You need a bot that watches the channel and acts. With stingsby it takes about a minute:

  1. Add stingsby to your server. It's in early access: ask for it in the support server.
  2. Move its role up in Server Settings → Roles, above your regular member roles. A bot can only ban members whose highest role is below its own. See permissions and role order.
  3. Run /honeypot setup. Stingsby creates the trap channel at the top of your channel list, and posts and pins the warning.
  4. Pick a private staff channel for reports in /config.
  5. Run /security scan to check that everything is in place.
  6. Test it with an alt account that has no staff permissions: post in the trap, check the report, then press Unban.

The full walkthrough is in the getting started guide.

Best practices for a trap channel

  • Keep it at the very top of the channel list. Spam scripts usually work from the top down, so the trap is the first channel they hit.
  • Let @everyone see it and send messages there. A trap nobody can post in catches nobody.
  • Don't hide it in a collapsed category or behind a role. It has to be reachable by any account that could be compromised.
  • Keep the warning short and clear, in your server's language. Stingsby writes it in the language you pick.
  • Have a log channel, so staff see every catch and can undo a mistake straight away.

What a honeypot doesn't catch, and what to add

A script that skips the trap channel won't fall into it. Two things cover most of that gap:

  • Duplicate message detection: the same message posted in 3 or more channels within 30 seconds is treated like a trap hit, even if the trap was skipped. It's off by default in stingsby; staff turn it on in /config.
  • Raid alerts: waves of new accounts and DM spam never touch your channels at all. Stingsby pings your moderators and can pause invites or DMs. See raid and DM spam alerts.

Keep Discord's own AutoMod on as well: it's good at blocking known bad words and mention spam. A honeypot works alongside it, not instead of it.

More guides