# How to set up a honeypot channel in Discord

> A hidden channel only bots and hacked accounts post in. Five minutes to set up, catches what filters miss.

Source: https://frostbite.bot/guides/discord-honeypot-channel/

## What a honeypot is

Spam scripts and hacked-account tools post to every channel the account can see. They do not read channel names. So you create a channel that no real member has a reason to post in, tell real members not to, and treat anything posted there as proof of compromise.

It catches the cases filters cannot: a brand-new scam with no known image or phrase, a link on a domain registered this morning, a message in a language your word list does not cover. The content does not matter. Posting there at all is the signal.

## Set up the channel

1. **Create a text channel.** Name it something a script will not skip and a human will not touch. `#do-not-post-here` or `#bot-trap` both work. Avoid names like `#general-2` that a confused member might use.
2. **Put it low in the channel list**, ideally inside a category near the bottom. Scripts iterate in order, so this is usually where a wave ends up before staff notice.
3. **Permissions.** Everyone can view and send. If real members cannot see it, hacked members cannot post in it either, and the trap does nothing. Staff roles should be exempt so a moderator clicking the wrong channel is not punished.
4. **Post a warning inside it.** One pinned message: this channel is a trap, do not post here, anything posted is removed and the account is actioned. Frostbite posts a localized version of this for you when you register the channel.

## Register it with Frostbite

```
/filter sethoneypotchannel channel:#do-not-post-here
/filter punish honeypot action:Timeout timeout_minutes:60
```

The first command arms the trap and posts the warning. The second picks what happens beyond deleting the message. The options are:

- **None.** Delete and alert only. Start here for the first week.
- **Timeout.** Stops the wave immediately and is reversible. The right default for most servers.
- **Kick**, optionally with `reinvite:True`, which DMs the member a one-time invite before the kick so a hacked member can come straight back once their account is secure.
- **Ban.** Only worth it if you never see hacked accounts, only spam bots.

Whatever you pick, the member receives a DM first explaining what happened, with your appeal link if you set one with `/filter setappeallink`.

## Why timeout beats ban here

Most honeypot trips on an established server are hacked members, not bots. A ban punishes the victim and, unless someone remembers to lift it, loses you a real member. A one-hour timeout stops the posting for as long as the recovery takes, and the DM tells them how to do it. There is a [full guide to the hacked-account case](/guides/hacked-account-posting-scams/).

## Check it works

Run `/filter status`. It shows the honeypot as armed, the action you chose, and flags if Frostbite is missing a permission it needs in that channel, which is the usual reason a trap silently does nothing.