HoneyPot Guide
HoneyPot is AtomicBot’s trap-based Discord security system.
It monitors a designated channel that normal users should never need to post in.
If an unauthorized user or bot posts in the HoneyPot channel, AtomicBot can immediately:
- Record the incident
- Kick the triggering user
- Delete their recent messages
- Scan the trigger channel first
- Scan other Discord channels afterward
- Send a private security report
- Post an optional public notice
- Save the incident for moderator review
Opening HoneyPot
Go to:
Security → HoneyPot
The HoneyPot console includes:
- Overview
- Settings
- Trusted Actors
- Incidents
- Audit Log
- Retention
Overview
The Overview tab shows recent HoneyPot activity, including:
- Triggers in the last 24 hours
- Triggers in the last 7 days
- Successful kicks
- Failed kicks
- Messages deleted
- Channels scanned
- Trusted actors
- Total incidents
It also shows the current trap configuration and recent HoneyPot cases.
Click a case number to review the full incident.
Settings
HoneyPot Enabled
Turns HoneyPot protection on or off for the Discord guild.
When disabled, messages in the configured trap channel are ignored by HoneyPot.
HoneyPot Channel
Enter the Discord channel ID that should act as the trap.
Any non-protected and non-trusted actor who posts in this channel is treated as a HoneyPot trigger.
This channel should only be used as an intentional trap.
Security Log Channel
Enter the Discord channel ID where private HoneyPot incident reports should be sent.
AtomicBot should have permission to:
- View Channel
- Send Messages
- Embed Links
Kick on Trigger
When enabled, AtomicBot immediately attempts to kick the triggering user.
AtomicBot requires:
Kick Members
Discord role hierarchy also applies.
If AtomicBot cannot kick the user, the failure reason is stored with the incident.
Message Cleanup
When Cleanup is enabled, AtomicBot searches for recent messages posted by the triggering user and removes them where possible.
The HoneyPot trigger channel is cleaned first.
AtomicBot then scans the remaining supported Discord channels.
Cleanup Window
The Cleanup Window controls how far back HoneyPot searches for messages from the triggering user.
Default:
24 hours
For example:
- 6 = previous 6 hours
- 24 = previous 24 hours
- 48 = previous 48 hours
Staff Protection
When enabled, protected staff bypass the HoneyPot trap.
Protected staff can include:
- Discord server owner
- Administrators
- Members with Kick Members
- Members with Ban Members
- Members with Moderate Members
- Configured AtomicBot admin roles
This should normally remain enabled.
Trusted Actor Bypass
When enabled, users and bots listed under Trusted Actors bypass the HoneyPot.
Use this for legitimate automation that may need access to the trap channel.
Public Notice
HoneyPot can optionally post a sanitized public message after a trap is triggered.
Enable:
Public Notice Enabled
You can also configure a specific Public Notice Channel.
If no public notice channel is configured, HoneyPot can use the trigger channel.
The public notice includes the HoneyPot case number but does not expose private infrastructure information.
Trusted Actors
Trusted Actors bypass HoneyPot completely while enabled.
Supported types:
- USER
- BOT
Each trusted actor can include:
- Discord ID
- Friendly name
- Reason
- Enabled / disabled state
- Administrator who added it
- Date added
Use this for legitimate users or bots that may intentionally interact with the HoneyPot channel.
Incidents
Every HoneyPot trigger receives a unique case number similar to:
HP-260902-A1B2C3
The Incidents tab lets you search and filter HoneyPot activity.
You can search by:
- Case number
- Username
- Discord user ID
- Trap channel
You can also filter by:
- Review status
- Successful kick
- Failed kick
- Kick not attempted
Incident Review
Opening a HoneyPot incident shows the full trap event.
Actor Information
The incident can include:
- Username
- Display name
- Discord ID
- Account creation date
- Guild join date
Trigger Information
HoneyPot records:
- Trigger channel
- Channel ID
- Trigger message ID
- Trigger time
- Message content
- Content hash
The content hash provides a stable fingerprint of the trigger message.
Response Information
Incident review also shows:
- Whether a kick was attempted
- Whether the kick succeeded
- Kick failure reason
- Whether cleanup was attempted
- Cleanup window
- Cleanup success
- Messages deleted from the trigger channel
- Total messages deleted
- Channels scanned
- Channels skipped
- Cleanup failures
- Security report status
- Public notice status
- Final action summary
Moderator Review
HoneyPot incidents support four review states.
OPEN
The incident has not yet been finalized by a moderator.
CONFIRMED
The HoneyPot trigger was legitimate unauthorized activity.
FALSE_POSITIVE
The activity was legitimate and should not have been treated as hostile.
DISMISSED
The incident was reviewed and requires no further action.
Moderators can also add notes to each incident.
Audit Log
The Audit Log records administrative HoneyPot changes.
This can include:
- Settings changes
- Trusted actor additions
- Trusted actor updates
- Trusted actor enable / disable
- Trusted actor deletion
- Incident reviews
- Retention cleanup
This provides a history of who changed what and when.
Retention
HoneyPot incident records can automatically expire after a configured number of days.
Default:
365 days
The Retention tab also includes:
Run Cleanup Now
This immediately deletes incidents older than the configured retention period.
Expired incidents cannot be restored after deletion.
Required Discord Permissions
Depending on the enabled HoneyPot features, AtomicBot may need:
- View Channels
- Read Message History
- Send Messages
- Embed Links
- Manage Messages
- Kick Members
Role hierarchy is also important.
AtomicBot cannot kick users whose Discord role prevents AtomicBot from moderating them.
Recommended Setup
For most servers:
- HoneyPot: Enabled
- Trap Channel: Dedicated private/decoy trap channel
- Kick on Trigger: Enabled
- Cleanup: Enabled
- Cleanup Window: 24 hours
- Staff Protection: Enabled
- Trusted Actor Bypass: Enabled
- Security Log Channel: Private moderator channel
- Public Notice: Optional
- Incident Retention: 365 days
HoneyPot vs AtomicShield vs AtomicGuard
HoneyPot
- Trap-based protection
- Immediate action when a protected channel is triggered
AtomicShield
- Behavioral protection
- Floods
- Spam
- Bots
- Webhooks
- Repeat offenders
AtomicGuard
- Content moderation
- Rules
- Categories
- Strikes
- Message policies
Using all three provides the strongest AtomicBot Discord security setup.
Quick Setup
- Open Security → HoneyPot.
- Enable HoneyPot.
- Set the HoneyPot Channel ID.
- Set the Security Log Channel.
- Enable Kick on Trigger.
- Enable Cleanup.
- Choose a Cleanup Window.
- Leave Staff Protection enabled.
- Add any legitimate users or bots to Trusted Actors.
- Trigger the HoneyPot with a test account.
- Review the generated incident.
- Confirm AtomicBot can kick and delete messages correctly.