How to Invite and Verify Users on Discord (And Stop Bots Before They Start)

Every Discord server has the same vulnerability by default: anyone with a valid invite link can join and immediately start posting, joining voice channels, and interacting with your community. For a small private server with a controlled link, this is fine. For anything growing or semi-public, it's an open door to spam accounts, bot raids, and members who skip your rules entirely because nothing required them to acknowledge them.

The solution isn't complicated — it's a combination of controlled invite links, Discord's built-in verification levels, and a role-based access gate. Here's how each piece works and how to set them up together.

Quick Answer (For Those in a Hurry)

To invite users, click your server name, select Invite People, copy the link, and share it. To limit who can interact after joining, go to Server Settings → Safety Setup and set a verification level — at minimum, require a verified email. For stronger control, remove permissions from @everyone so new members see nothing until you assign them a Member role manually or through a bot.

Real Situations Where This Actually Matters

Invite and verification settings feel optional until something goes wrong — and then they feel like the most important thing you didn't configure.

Your server got raided. Someone posted your permanent invite link in a public Discord or a forum, and fifty accounts joined in an hour — posting spam, flooding channels, or just creating noise that drove real members away. A permanent, unlimited invite link with no verification requirements is the infrastructure that makes raids easy. Temporary links with use limits, combined with a minimum account age requirement in your verification settings, remove most of the attack surface.

You run a community with rules that actually matter — a study server, a support space, a creative community — and new members ignore them because nothing required them to read them. If joining a server gives someone immediate posting access, there's no friction between arriving and causing a problem. A verification gate that requires new members to react to a rules message or complete a simple step before gaining access creates a moment of intentional action. It doesn't guarantee good behavior, but it filters out the most casual and most automated bad actors.

You manage a paid community, a private group, or a space where access is earned, and you can't rely on the invite link alone to control membership. Links can be screenshotted, forwarded, or leaked regardless of your intentions. A role-based access system means the link alone doesn't grant access to anything — a human decision (or a verified bot action) is required before the server actually opens up.

Before You Set Anything Up: One Thing to Know

Discord's built-in verification levels and role-based access control are separate systems that do different things. Verification levels (set in Safety Setup) filter who can interact based on account age, email verification, or phone verification — they're a quality filter on Discord accounts. Role-based access control determines what verified members can see and do once they're in. Both matter, and neither one replaces the other. A server with high verification but no role gating lets through aged accounts that still spam. A server with role gating but no verification lets in fresh bot accounts that you then have to manually manage.

Use both, configured together, for meaningful protection.

Part 1 — Inviting Users: Setting Up Controlled Invite Links

Step 1 — Open the Invite Menu

Click on your server name at the top of the left sidebar and select Invite People from the dropdown menu.

Step 2 — Review the Default Invite Link

The invite popup shows a generated link. By default, this link has no expiry and unlimited uses — meaning it works forever for anyone who gets it, now or in the future.

Step 3 — Copy the Link for Immediate Sharing

If you need to share the link right now and will configure limits afterward, copy it here. For a one-time invite to a trusted person, the default link is fine. For anything you plan to share more broadly, proceed to the next step before distributing it.

Step 4 — Configure Link Expiry and Use Limits

Click the link settings — usually a gear icon or "Edit invite link" option in the popup. Set an expiration time (7 days is a reasonable default for most invites; 1 day or 1 use for sensitive links) and a maximum number of uses if you want to control exactly how many people can join through this specific link. Generate the configured link and share that version instead of the default.

For ongoing invite needs, go to Server Settings → Invites to see all active links, revoke any you no longer need, and create new ones with appropriate settings.

Part 2 — Verifying Users: Discord's Built-In Safety Settings

Step 5 — Open Safety Setup

Go to Server Settings and navigate to Safety Setup (sometimes listed under Moderation depending on your server type).

Step 6 — Set the Verification Level

Choose a verification level that matches your server's needs. Low requires a verified email — stops the most basic throwaway accounts. Medium requires the account to be registered for more than 5 minutes — stops fresh bot accounts created for raids. High requires a verified phone number — the strongest Discord-native filter, with the most friction for legitimate new members. For most servers, Medium is the right starting point.

Part 3 — Role-Based Access: Manual and Bot-Assisted Verification

Step 7 — Set Up Role-Based Access Control

This is the most powerful verification layer. In your role settings, remove View Channels from @everyone so that new members who join see nothing by default. Create a Member role with full access. Either assign this role manually to each new member you approve, or use a bot to automate the assignment after a verification step.

Step 8 — Create a Verification or Welcome Channel

Create one channel that's visible to @everyone but has restricted posting — new members can read it but not write. Post your rules and verification instructions there. If you're using manual verification, tell members how to reach an admin. If you're using a bot, this is where the bot's verification prompt appears.

What Changes After You Set This Up

The joining experience for new members shifts immediately. Instead of entering the server and having full access to everything, they see only the verification channel. This creates a moment of intentional engagement — they have to read something, take an action, or wait for approval before the server opens up. For your existing community, nothing changes.

On the admin side, the Invites log in Server Settings becomes genuinely useful. You can see which invite link each member used to join, when they joined, and whether links are being used at a rate that suggests leakage. This information helps you trace where members are coming from and identify if a link has been shared somewhere you didn't intend.

Moderation becomes lighter once the entry filter is in place. A significant portion of problematic members are opportunistic — they join because the barrier is zero, not because they specifically targeted your server. Raising that barrier even slightly (a verified email, an account older than five minutes, a rules reaction) eliminates most of this category without meaningfully affecting legitimate new members.

Advanced Tips: Building a Verification System That Scales

Use Carl-bot's autoroles and verification buttons for a clean, automated member onboarding. Carl-bot (free at carl.gg) offers a button verification system where new members click a button in the verification channel to receive the Member role automatically. It handles the role assignment instantly, requires no manual admin action, and logs each verification. This is the most practical setup for servers that grow past the point where manual approval is feasible — setup takes about 15 minutes and then runs without intervention.

Create time-delayed role upgrades to identify engaged members automatically. Carl-bot and MEE6 both offer autorole features that assign additional roles based on time in the server or message count. A member who's been in the server for 30 days and sent 50 messages is clearly a real person who's engaged — automatically granting them a "Regular" or "Trusted" role at that threshold gives them recognition and additional permissions without requiring admin attention. It's a lightweight engagement system that runs itself.

Generate unique invite links for each entry point and name them descriptively. If you promote your server in three different places — a Reddit post, a YouTube video, a Twitter bio — create a separate invite link for each and name them accordingly in the Invites manager. When you review your member list, you'll know exactly where each member came from. If one source starts bringing in problematic members disproportionately, you can revoke that specific link without affecting the others.

Enable Discord's AutoMod to catch spam patterns before they reach your channels. Go to Server Settings → AutoMod and configure rules to automatically delete messages containing spam keywords, excessive mentions, or suspicious link patterns. AutoMod runs before human moderators see anything — it removes low-effort spam immediately and lets your mod team focus on edge cases that require judgment. Pair this with your verification setup for a layered defense that handles the easy cases automatically.

What These Systems Can't Fully Prevent

Verification creates friction, not an impenetrable barrier. A determined person can meet any verification requirement — a phone number can be obtained with a prepaid SIM, an aged account can be purchased on gray-market account trading sites. These measures work against automated and opportunistic bad actors, not against someone specifically targeting your community. For high-risk servers (those dealing with sensitive topics, political communities, or spaces that have been targeted before), professional moderation and stricter manual approval processes are necessary supplements to technical controls.

Bot raids specifically have evolved to account for verification requirements. Sophisticated raid bots use aged accounts with verified emails and phone numbers. Discord's Medium and High verification levels slow these down but don't stop them. The most reliable defense against a coordinated raid remains a combination of verification, active moderation, and the ability to temporarily lock the server (by revoking all active invite links) during an attack.

Verification also can't fix a toxic community once it forms. If members who passed all your verification steps create a hostile environment, that's a moderation problem, not a technical one. Verification controls who enters — community culture and active moderation determine what the environment becomes.

Frequently Asked Questions

A user joined my server but says they can't see any channels — what should I check first? Start with the @everyone role permissions. If you removed View Channels from @everyone as part of your verification setup, new members won't see anything until assigned the Member role. Check whether they've completed the verification step in your welcome channel and whether the role was actually assigned. If the role was assigned and they still can't see channels, check whether there are explicit deny overrides at the channel or category level that are blocking the Member role specifically.

Can I require new members to verify with a phone number before they can join, rather than after? No. Discord's phone verification requirement (the High verification level) applies after joining — it prevents members from interacting, but it doesn't block them from entering the server. There's no Discord-native way to require phone verification before the join step. The closest alternative is manual approval: set up your server so that joining grants nothing, and manually assign the Member role only after reviewing each person, which serves as a de-facto human-screened entry process.

If I revoke an invite link, does it remove members who already used it? No. Revoking an invite link only prevents new people from using it to join. Members who already joined through that link remain in the server with all their existing roles and access. To remove someone who joined through a revoked link, you'd need to kick or ban them individually through normal moderation tools.

My verification bot stopped working and new members can't get their role — is there a fallback? When a bot goes down, any member gated behind it loses their path to verification until the bot comes back. To prevent this from leaving new members stranded, keep a verification channel message from an admin explaining that if the bot is unresponsive, they can ping a moderator for manual role assignment. As a structural precaution, at least one admin should always have the ability to manually assign the Member role without bot assistance — bot outages are rare but they happen.

Does setting a high verification level affect members who are already in the server? No. Verification level requirements apply only to new members joining after the setting is changed. Existing members keep all their roles and access regardless of whether they would meet the new verification requirements. This means you can raise your verification standards at any time without disrupting your current community — the change only affects who can join going forward.

Related Guides

If this was helpful, you might also want to read [How to Create Discord Roles](), [How to Make a Discord Server Private](), and the [Complete Discord Server Management Guide]().

Final Thoughts

Invite and verification settings are the first line of defense for a Discord server, and they're also the most commonly skipped. The default configuration — permanent links, no verification, full @everyone access — is designed for ease of use, not security. Taking thirty minutes to configure limited invite links, set a verification level, and build a role-based access gate changes the quality of who enters your server significantly. It's infrastructure work that pays off every day the server is active, quietly filtering out the accounts that would otherwise cost your moderators hours of cleanup.