Can I combine multiple verification methods?

You can layer Discord's native verification level with one bot gate, and you should — they act at different points and do not conflict. What you should not do is run two bot gates at once. Members then get prompted twice, completion rates fall noticeably, and you gain nothing because the second gate sees only traffic the first already approved.

What is the difference between RestoreCord Free and paid verification?

The verification flow itself is identical, and so is member recovery — neither is capped on the free plan. What paid tiers add is scale and rule depth: more servers, more snapshots, deeper message history, and the advanced firewall rules from Business upward. The core gate is not a paywalled feature.

What data does verification collect?

The Discord user ID and the OAuth authorization needed to re-add the member later, plus the network signals your firewall rules evaluate. Optional fields such as email can be disabled entirely by the server owner if you do not need them. Members can revoke authorization and request per-server data removal themselves, without going through you. Full detail is in the privacy policy.

What if a legitimate member cannot verify?

That is what bypass passwords are for, and you should configure one before you enable any strict rule. Give it to moderators and to anyone who reports being blocked — it lets an individual through without weakening the rule for everyone. The alternative, disabling the rule whenever someone complains, is how carefully-tuned filtering quietly becomes no filtering.

Does verification prevent all raids?

No, and a gate sold as though it does is a gate you will over-trust. Verification proves an account completed a flow — not that a person is unique or trustworthy. A determined attacker with aged accounts and residential proxies gets through. What verification does is raise the cost of abuse enough that most attempts go elsewhere, and leave you a recovery path for the ones that do not.

How to Set Up Discord Server Verification (2026)

TL;DR

Every verification type filters some abuse. Only one leaves anything behind: an OAuth2 gate produces an authorization that lets you re-add those members if the server is ever lost. Same friction for the member as a CAPTCHA, radically different value to you. Set up Discord's native level first because it is free, then add an OAuth gate, then add firewall rules gradually against abuse you have actually seen.

What verification is really doing

A gate is not a yes/no door, it is a funnel of decisions you configure. Understanding it that way is what stops people from over-trusting it.

Verification funnel

Clicked the verify button1,000
Raw traffic hitting your verification page
Completed Discord OAuth842
Real Discord accounts, consent recorded
Passed firewall rules731
IP, ASN, country and user-agent rules applied
Passed VPN and alt checks664
Proxy, VPN and duplicate-account signals
Granted the verified role664
Recoverable later if the server is lost

Illustrative numbers, not measured averages — your own rates depend entirely on which rules you enable. The point is the shape: each layer is a decision you configure, and everyone who reaches the bottom is recoverable later.

Be clear-eyed about the limit: verification proves an account completed a flow. It does not prove the account belongs to a distinct, trustworthy person. It raises the cost of abuse — worthwhile, but not identity.

The four types compared

Type	Member friction	What it stops	What it leaves behind	Best for
Discord verification levels	None	Brand-new and phone-less accounts	Nothing	Every server, as a free baseline
Reaction roles	One click	Almost nothing automated	Nothing	Rule acknowledgement, not security
CAPTCHA bots	One puzzle	Naive automation	Nothing	Bot-heavy spam with no recovery need
OAuth2 verification	One authorization	Automation, plus whatever your rules add	A recoverable authorization	Servers that would not survive losing their members

The fourth column is the whole argument. A CAPTCHA and an OAuth authorization ask roughly the same of a member; one produces nothing durable and the other produces the thing that saves your community later.

Setting up an OAuth2 gate

Setup sequence

1
Lock the channels
Remove View Channel from @everyone on protected channels, and set up a holding area.
2
Create the bot
Your own Discord application, added with the permissions it needs and nothing more.
3
Publish the verify message
Explain what members authorize and why. Clarity raises completion rates measurably.
4
Test end to end
Verify from a spare account on mobile data, then confirm the bypass password works.

Do step one before step two. Publishing verification while protected channels are still public teaches members it is optional.

Create your account and add the server. RestoreCord's free plan covers one server with the full verification and recovery workflow.
Set up a custom bot. A separate Discord application with your own name and avatar. Included on every plan — verification under your identity rather than a shared bot builds noticeably more trust.
Position the bot role correctly. It must sit above the verified role it will assign. This is the single most common setup failure.
Prepare the channels. Remove View Channel from @everyone on everything protected, and leave one visible landing channel.
Publish the verify message. Say what the authorization does in plain language. “This lets us re-add you if the server is ever lost” converts far better than an unexplained button.
Configure the verified role. It should grant exactly the access the protected channels require.
Test from a spare account. On mobile data, not your own network — that is how you catch rules that block real members.

Adding rules

Rules are where a gate stops being decorative. Add them one at a time, against abuse you have actually observed.

Firewall decisions during verification

Every verification attempt is evaluated against your configured rules before the member is let in. Redis bypass entries are checked first, so allowlisted members never hit the rule chain.

The order to add them in

VPN and proxy detection first. The broadest win for the least tuning, and it catches the majority of coordinated attempts.
ASN rules second. Raids frequently share a hosting provider. Blocking that ASN costs you very few genuine members.
Country rules last, and sparingly. They are blunt and will catch members who travel.
User-agent conditions for specific patterns once you have logs showing one.
A bypass password from day one, before any of the above.

Five mistakes that cost members

1. No holding channel

A member who joins and sees nothing at all assumes the server is broken and leaves. Always leave one visible channel explaining what to do.

2. Too strict, too early

Every rule costs some legitimate joins. Starting with country blocks and aggressive alt thresholds on a server that has never been raided trades real members for hypothetical safety.

3. Not testing before going live

Test from an account that is not yours, on a network that is not yours. Half of all broken verification setups are a bot role positioned below the role it needs to assign.

4. Ignoring the logs

Firewall decisions are logged for a reason. If completions drop after you add a rule, the log tells you which rule and why — rules tuned from evidence always beat rules tuned from intuition.

5. No bypass password

Without one, the only response to a blocked legitimate member is disabling the rule. Do that three times and you have no filtering left.

Our verdict

OAuth2, with rules added gradually

All verification types filter. Only OAuth2 leaves behind an authorization that still helps you on the day the server is gone — for the same friction a CAPTCHA costs.

The authorization makes every verified member recoverable later, uncapped on any plan
Firewall rules on IP, ASN, country, and user-agent act on real raid signals
Bypass passwords keep strict rules from becoming a support queue
Custom bots let verification run under your own branding on every plan
Discord's native verification level stays free underneath it all

Where that flips: If your only problem is naive spam bots and you have no interest in recovery, a CAPTCHA gate is simpler and does that job. VaultCord offers CAPTCHA via Turnstile if you want both in one product.

Start free Compare plans

Set Discord's native level today — it is free and takes a minute. Then add the gate that keeps working after the server does not. Start free, or compare the options in the verification platform comparison.

Frequently asked questions

Sources and verification

Vendor features and limits were checked against these primary or first-party references. Recheck time-sensitive details before purchasing.

How to Set Up Discord Server Verification