Link Filter

• Stops scam links, IP-grabber sites, and phishing pages before they spread.
• Lets you run a locked-down server where only a handful of trusted domains are postable.
• Handles URLs hidden inside Discord markdown like [click here](https://bad.example) — the URL is still in the message content.
• Pairs well with Word Filter: a word list catches the pitch, a link list catches the payload.

URLs extracted from the message text. The evaluator runs a regex that finds every http://, https://, or bare www. URL, parses the hostname (lowercased), and compares it to your lists. The first URL that matches your policy fires the rule and is recorded as matched_pattern.

• URLs inside embeds or attachment metadata — only the message's text content is scanned.
• Non-HTTP schemes like ftp://, ws://, mailto:, or steam://.
• Bare domains typed without a scheme or www. prefix — youtube.com on its own is not picked up, only https://youtube.com or www.youtube.com.
• URL shorteners — bit.ly/xyz is compared as bit.ly, not resolved to the destination.
• Homoglyph domains — a lookalike like раураl.com (Cyrillic letters) is treated as its own distinct hostname.

Pick the mode that matches your server's risk profile:

• Blocklist mode (block_all: false) — URLs pass by default; only hostnames in blocked_domains fire the rule. Best for permissive community servers where you want to stop scam and IP-logger hosts without restricting normal sharing.
• Allowlist mode (block_all: true) — URLs fire by default; only hostnames in allowed_domains pass. Best for locked-down servers, kids' servers, or support-only channels where the full list of acceptable domains is short and known.

Permissive server — block a handful of known-bad hosts:

{
  "block_all": false,
  "blocked_domains": [
    "grabify.link",
    "iplogger.org",
    "bit.ly"
  ],
  "allowed_domains": []
}

Strict server — allow only trusted domains:

{
  "block_all": true,
  "blocked_domains": [],
  "allowed_domains": [
    "youtube.com",
    "www.youtube.com",
    "discord.com",
    "github.com",
    "x.com"
  ]
}

Run with Mode: Log Only until you have watched the Event Log for a week and tuned anything noisy. Then flip to Live.

• Strict mode and subdomains — m.youtube.com is blocked when only youtube.com is allowed. List every subdomain your members actually use.
• www. vs bare domain — https://www.example.com parses to hostname www.example.com, while https://example.com parses to example.com. List both forms.
• URLs inside code blocks — a URL wrapped in backticks is still extracted and checked. Staff posting scam examples for review can trigger the rule on themselves unless exempt.
• Trailing punctuation — the extractor includes trailing ., ,, !, and ? in the URL string, so matched_pattern may look slightly off in the Event Log.
• Masked links — [safe text](https://bad.example) is still matched because the raw URL remains in the message content.

• Current behavior: hostname matching is exact, not subdomain-aware. youtube.com in a list does not cover m.youtube.com, music.youtube.com, or www.youtube.com. Each subdomain must be added explicitly.
• Current behavior: only http://, https://, and www. URLs are extracted. A bare domain written as youtube.com with no prefix passes through untouched.
• Current behavior: URL extraction uses a 50ms regex timeout per call. On pathological inputs (extremely long messages or adversarial patterns), extraction is skipped for that message and the rule does not fire.
• Current behavior: matched_pattern is the full raw URL that triggered the rule, not just the hostname. The URL ends up in the Event Log visible to staff — avoid pasting live scam or phishing URLs into test rules.
• Current behavior: query strings and paths are irrelevant — only the hostname is compared against your lists. https://example.com/abc?token=xyz and https://example.com are treated the same.
• Current behavior: allowlist words apply to this trigger. If any allowlist word appears anywhere in the message (substring-matched, lowercase), the rule is skipped entirely. This is the rule-level word allowlist — do not confuse it with allowed_domains, which is the Link Filter's own hostname list.
• Current behavior: with block_all: false and an empty blocked_domains, the rule never fires. URLs are still extracted, but no decision applies. If you see no matches, confirm one of the two modes is populated.

Pair this trigger with any of the five AutoMod actions. delete is the most common pairing for link filtering; mute with a short duration is a good follow-up for repeat offenders (combine with per_user_cooldown_seconds to avoid chain-mutes).

• Word Filter — complementary content scan. Use a word list for the pitch, a link list for the payload.
• Regex Filter — when exact hostname match is not flexible enough (for example, catching a family of lookalike domains).
• Invite Filter — a narrower cousin aimed specifically at Discord server invites.
• AutoMod Actions — the five action types that pair with every trigger, including this one.