Why the plugin exists
Servers with large communities get impersonators. Someone joins, copies a moderator's display name and avatar, and starts messaging members privately — usually about a problem with their account, a prize, or a wallet that needs verifying. It works because your members already trust the person being copied, not because the message is convincing.
The Security plugin's job is to catch that copy while it is still happening in your server, so the account can be removed before it reaches anyone.
Turning it on
The switch at the top of the page starts every check on it. Turning it off stops the checks without discarding anything you have configured, so it is safe to use as a pause rather than a reset.
One thing worth knowing: a brand-new server has this switch on but nothing configured, and in that state it checks nothing. The settings below are what make it do something.
Moderators
This is the setting that does most of the work. Pick the roles that should be protected from impersonation — typically Admin, Mod, and any affiliate or partner role people would find credible.
Every member holding one of those roles is then protected automatically. Nobody has to be listed by name, and the protection does not go stale when someone joins or leaves your team.
The same roles do double duty: members holding them are never actioned by the plugin, so it cannot turn on your own staff.
Protected names
For identities that are not covered by a role. A brand name, a partner who is not in your server, a staff member without a distinct role, or a specific name you have seen being copied.
Free servers may protect up to three names. Adding a fourth requires Pro — and if you configured more than three while subscribed and later lapsed, your list is kept intact rather than truncated.
Avatar matching
Names are only half of an impersonation. This compares profile pictures as images, so a re-uploaded, re-compressed or lightly cropped copy of a moderator's avatar still matches — which a filename or hash comparison would miss entirely.
Avatar matching is a Pro feature. It is off by default.
Similarity
How close a match has to be before ScoutBot flags someone, on a scale of 1 to 5. Lower values flag more members and raise more false alarms; higher values require a closer match.
4 is the default and fits most servers. Move it after you have watched the alerts for a few days, not before — the right value depends on how distinctive your moderators' names are, and you cannot tell that in advance. If a server has a moderator called "Alex" you will want a higher value than one whose moderators are called "VoidwalkerPrime".
There are two similarity settings on the page: one for names, one for avatars. They are independent.
Action
What happens when someone is flagged. ScoutBot can do nothing and simply alert you, or it can kick or ban the account automatically.
Automatic action is a Pro feature. Free servers get the alert.
If you are new to the plugin, start with alerts only. Watch what gets flagged for a week, tune the similarity, and only then switch on kick or ban. Turning on automatic enforcement before you know your false-alarm rate is how a legitimate member gets removed.
Channel
Where flag messages are posted. Use a private channel that only moderators and trusted roles can see.
This matters more than it looks: the alert names the flagged member, and posting that publicly turns a detection into an accusation your whole server can read — including the impersonator, who then knows exactly what tripped the check.
Alert role
Optionally mention a role when someone is flagged. Not required, but worth setting if your action is "do nothing" — an alert nobody sees is an alert that does not get acted on.
Whitelist
Members who should never be flagged, by user ID. Useful for alt accounts, and for long-standing regulars whose names are genuinely similar to a moderator's.
To get a user ID: open Discord's settings, go to Advanced, enable Developer Mode, then right-click a member and choose Copy User ID.
A sensible first configuration
- Switch the plugin on.
- Select your Admin and Mod roles as Moderators.
- Set the channel to a private moderator channel.
- Leave Action on "do nothing" and similarity on 4.
- Save, and leave it for a week.
- Read what was flagged. Adjust similarity, whitelist anyone caught wrongly, and only then consider automatic action.
What this plugin does not do
It does not read direct messages, and it is worth being precise about why: no Discord bot can. The API offers no mechanism for a bot to see a DM between two members, and there is no verification level or partner programme that changes it. The defence is placed at the moment the name or avatar is set, in your server, because that is the point a bot can actually observe.