"This server is raidable": should you worry?
The "this server is raidable" message comes from a bot like Jalapeno, installed as a user app. It simply flags that your members can use external apps, which could be used to spam via follow-up messages. It's not a flaw in itself, and two settings are enough to protect against it.
Where does external-app spam come from?
Discord lets you install apps directly on your account, the "user apps". Once installed, you can use their commands in any server that allows external apps, even if the app isn't added there.
Some malicious apps take advantage of this: through a command, they send a burst of follow-up messages into the channel, which lets them spam a server without even being invited. The message appears under the app's name, but it's a member who triggered it.
"This server is raidable": what it really means
Bots like Jalapeno offer a command that displays "this server is raidable". In reality, this test just checks one single thing: do members have permission to use external apps? If so, it shows "raidable".
It's misleading. Having that permission enabled doesn't mean your server is defenseless. And above all, watch out for the trap: an administrator account will always show "raidable", because an administrator bypasses all permissions. You could believe there's a problem that doesn't exist, even after fixing it.
How to fix "this server is raidable"
Two solutions, depending on whether or not you want to keep external apps.
- Disable external apps. In the @everyone role permissions (or per channel), remove "Use External Apps". Members will no longer be able to trigger user apps. Be sure to test with a non-administrator account: an admin bypasses the permission and will still see "raidable".
- Add RaidProtect. If you'd rather keep external apps (they have legitimate uses), RaidProtect's anti-spam detects follow-up message spam, traces it back to the member who triggered it, and punishes them automatically. Those who try to "raid" you this way get kicked out immediately.
Frequently asked questions
What does "this server is raidable" mean?
That your members can use external apps, which could be used to spam a channel via follow-up messages. It's not a flaw in itself.
Is Jalapeno's "raidable" test reliable?
It just checks one permission. And if you test with an administrator account, it will always show "raidable", because admins bypass permissions. Take it with a lot of skepticism.
How do you get rid of the "this server is raidable" message?
Disable "Use External Apps" for members (testing with a non-admin account), or add RaidProtect, whose anti-spam spots and punishes these attempts.
Do you really need to disable external apps?
Not necessarily: they have legitimate uses. With an anti-spam like RaidProtect's, you can keep them while staying protected against follow-up message spam.