Protection

A filter judges one message. Protection judges a pattern: three hundred accounts arriving inside a minute, the same line pasted by fifty of them, a follower count that climbs while nobody is watching.

It is the fourth tab on Filters & Modes, beside the filters, and most of it is Twitch only, because the platform calls it needs (Shield Mode, chat settings, blocking an account) exist there and nowhere else.

Protection belongs to the channel owner. A moderator who opens the tab sees a note rather than controls: Protection settings are managed by the channel owner. You do not have access to them here. The chat commands at the end of this page are the part a moderator can use.

The three postures

Every protection feature sits on the same ladder, and you set each one independently:

Posture	What it does
Observe	Records what it sees in the threat log. Changes nothing in your chat
Suggest	Asks you first, in Stream Manager. You choose whether it acts
Auto	Acts right away, then tells you what it did and how to undo it

Three features carry a posture, and these are the settings you get out of the box:

Feature	What it watches	Ships as
Raid defense	Message bursts from accounts your chat has never seen	Suggest
First-time chatter gate	The first time an account speaks in your channel	Observe
Account-age gate	Accounts younger than the minimum age you set	Observe

The account-age gate has one extra field, Minimum age (hours), and it starts at 0, which turns the gate off. Nothing is judged on age until you put a number there.

The gates and the filters are two different things

The Account-age gate and the First-time chatter gate above are protection postures, and they mark rather than act until you raise them. The Account-age filter and the First-time chatter filter on the Filters tab are ordinary filters with their own action and their own exemption, exactly like the caps filter. Use the filters when you want a delete or a timeout on a rule you wrote. See Moderation.

What a threat level actually means

Pyre scores a burst from 0 to 3, and the score is built from two groups of signal that are deliberately not equal.

Crowd signals describe how many and how fast:

• a spike in messages a minute
• a burst from accounts your chat has never seen
• a burst of new follows

Content signals describe what is being said. Today there is one: the same message repeated by many accounts.

The rule that matters is how they combine. Crowd signals on their own cap at level 1, at any size. A content signal is what unlocks level 2, and level 3 needs the content signal plus at least two crowd signals.

A real raid cannot climb past level 1

This is by construction, not by tuning. Three hundred delighted humans arriving from another stream produce every crowd signal at once and no content signal, so the highest score they can reach is 1. Since Pyre suggests a lockdown at level 2 and locks down on its own at level 3, a legitimate raid never triggers either. The thing that separates a raid from a bot wave is not the size of the crowd, it is that the bots all say the same thing.

You can move the thresholds, and the defaults are suggest at level 2, act at level 3.

The threat log

The bottom of the tab keeps 30 days of protection events, four columns wide: the time, the level, What Pyre saw and What it did. The first column of an empty log says the honest thing: Nothing yet. Level 0 is what Pyre noticed, level 3 is what it stopped.

Reasons are written out rather than coded, so a row reads A spike in messages a minute; the same message repeated by many accounts. and the outcome column reads Recorded only., Suggested a lockdown. or Locked down.

The same events also land in the Activity log under Tools, under a Protection chip, alongside the rest of what the bot did that day.

Follow-bot blocking

This is the one protection feature that ships on, and it is the one that is allowed to act on a single account without asking you, because it works on evidence a crowd cannot fake: whether the account is in a follow-bot registry, and how old it is. Three hundred real humans trip neither.

Every new follower, and every follower a sweep walks past, goes down the same ladder, in this order:

Checked in order	Verdict
A known good service bot (Nightbot, StreamElements, Moobot, Fossabot and about fifteen more, curated by Pyre)	Left alone
A moderator of your channel	Left alone
An account on your Never block these list	Left alone
In the known-bot registry, confidence 0.5 or higher	Blocked
Account under 48 hours old and follows arriving at 10 a minute or more	Blocked
Account under 48 hours old, on its own	Flagged
Follows arriving at 10 a minute or more, on its own	Flagged
Anything else	Left alone

The first three rungs are short circuits, not tie breakers. Nothing below them can touch an account that matched one, whatever any list says about it. They exist because blocking is done with your own account rather than your moderator powers, so unlike a ban it is not refused against your own modded bot. The curated list covers the hosted services every channel shares, and the moderator rung covers the custom bot account no list could ever enumerate.

A flag is not an action. It records the account for you and moves on.

Why it blocks instead of banning

A ban is a permanent, public judgement on a person, and platforms feed their own ban-evasion detection from it. A block is quieter and it is reversible: it removes the follow, stops that account following you again, and leaves nothing on the viewer’s record. When Pyre is acting on a heuristic rather than on something a human watched happen, the reversible action is the honest one.

The exception is the account that ignores the hint. If an identity Pyre has blocked turns up in your chat and talks, that one is banned.

Where the known-bot list comes from

Two sources, and they do not carry the same weight:

• A public follow-bot name feed, refreshed on a weekly job. Roughly 6,600 names, and Pyre records them at confidence 0.6.
• A pinned community mirror, used when the live feed is unreachable. Far larger, years old, and recorded at confidence 0.4.

Because the ladder only blocks at 0.5 and above, a name Pyre knows only from the mirror is flagged and never blocked on that evidence alone. Anything added by hand outranks both feeds, and a failed refresh keeps the old data rather than emptying the table.

Never block these

The allowlist under the follow-bot card is per channel and explicit: Protection skips these accounts entirely. No block, no timeout, no held message, whatever the posture says. Add a username, and the card reminds you of the thing most people ask next: Your mods are already on this list. You do not need to add them.

The sweep

New followers are checked as they arrive, which does nothing about the ones bought before you found Pyre. The sweep walks the follower list Twitch already holds and puts every account through the same ladder.

It runs from three places:

• Run sweep on the Protection tab, any time you press it.
• Automatically, five minutes after a stream ends, and no more than once every 20 hours. The delay is deliberate: the minutes right after you go offline are the busiest of your session, and it lets a late follow burst settle so the accounts are read at their real age.
• Resuming itself, from wherever the last run stopped. A restart mid sweep does not start over.

The card keeps the running count of scanned, blocked and flagged plus when the last sweep ran, and each run writes its own line into the activity log: swept 1204 followers. Blocked 12, flagged 3. A clean pass gets a line too, and it never renders as “blocked 0”:

swept 1204 followers. Nothing suspicious

Undoing a block is done on Twitch, not here

The Protection tab has no undo button. A block Pyre made is an ordinary entry on your Twitch Blocked Users list, under Security and Privacy in your Twitch settings, and removing it there removes it for good.

Do one more thing while you are at it: add that account to Never block these. Otherwise the next sweep looks at the same evidence and reaches the same conclusion.

The panic button

Protection’s high-blast-radius action is a lockdown, and on Twitch it is three things at once: Shield Mode, 30 second slow mode and 10 minute followers-only.

You reach it from two places.

The Protection card in Stream Manager. It has three states. Quiet, it reads Protection armed, lists your postures and says Nothing unusual in the last hour. with a Lock down now button, because Lock down is always here, armed or not. When a burst crosses your suggest threshold it turns amber, says Raid burst detected, names the level and the reasons, and offers Lock down or Dismiss. Once locked it turns red, names what is in force and offers Stand down.

Chat. !panic (or !lockdown) and !standdown, moderators and above. They are silent for anyone below, rather than answering with a refusal.

Two things about these five verbs (!panic, !standdown and the three in Suspicious users) are deliberate and will not change. They have no off switch, even though they are listed in the Built in commands card, and they claim their spelling ahead of a custom command of the same name. A panic button that a forgotten setting or an imported !panic row can quietly disarm is worse than a shadowed custom command, and worse than no panic button.

On success the bot says what actually landed:

Chat locked down: Shield Mode, 30s slow mode, 10m followers-only. Use !standdown to put it back.

Stand down puts it back exactly

Before it changes anything, Pyre reads your current chat settings and stores them. Standing down replays that snapshot rather than guessing at sensible values, which is why the card promises Stand down puts your chat back exactly as you had it: slow off, followers-only off, shield off. If you had slow mode on at 5 seconds before the raid, you have it on at 5 seconds afterwards.

Two honest failures

No snapshot. A lockdown is never blocked by a read, so if Pyre could not get your settings first it locks down anyway and records that it has nothing stored. Standing down then says so instead of inventing a state: Pyre has no record of how this chat was set before the lockdown, so it won't guess.

Not Twitch. Kick and YouTube expose no chat-mode API Pyre can drive, so a lockdown there applies nothing and says this platform has no chat modes Pyre can set. rather than reporting a lockdown that did not happen.

What protection will not do

• It never bans anyone off the raid path. A burst can cost your chat slow mode and a Shield, never a viewer’s account.
• It never acts on a moderator or above.
• It never turns Shield Mode back off by itself. Standing down is a decision a person makes, and the go-live check in Ads and raids is there to remind you if one was left on.
• On Observe, it changes nothing at all. That is the whole posture.

Related

• Moderation for the filters, chat modes and blocked terms.
• Suspicious users for the per-viewer half: what Twitch flags, what Pyre flags, and the monitor and restrict actions.
• Stream Manager for the cockpit the Protection card lives on.