3 AM. Your channel is gaining 40–50 new subscribers per minute. No ad campaign is running. No public mention happened. The subscriber count climbed 200 in the time it took you to open the bot. You need to stop the flood before understanding it.
What SOS mode actually does
The common assumption is that SOS locks the channel. It doesn't. The channel stays public, the invite link stays active. What SOS does is apply a hard rate limit: no more than 10 joins within any 60-second window. The 11th joiner — and every joiner after — gets an immediate ban. Not a kick, a ban, so those accounts can't come back.
The limit applies to all links — the public channel link and any private invite links. At the same time, SOS enables automatic banning of known abusers from TGuard's shared database, and enables auto-approval of join requests so the pending queue doesn't pile up separately from the rate limiter.
How this differs from regular security settings
In normal mode you can configure rate limits manually — say, 30 joins per 5 minutes. That's useful for background protection. During a live attack there's no time to open settings and tune parameters. SOS is a pre-configured emergency preset: 10 per 60 seconds, all protection options enabled, one tap.
One thing to know: SOS doesn't save your previous settings. After deactivation, limits reset to zero. If you had custom rate limits configured before enabling SOS, you'll need to restore them manually afterward.
When to turn it on
Turn it on when you see a live attack happening: a sudden subscriber count spike with no external cause, a TGuard antivirus alert about a mass influx of known abusers, or an obvious flood at an unusual hour. Every minute without the limit active means more bots settling into your channel — the cleanup afterward takes longer.
SOS doesn't replace baseline security configuration — it's specifically for the moment an attack is already underway.
When to turn it off
Once the join rate returns to normal and you've dealt with the source of the attack. The 10/60 limit is aggressive — if left on during a legitimate viral spike (a post getting picked up by a major outlet, for example), it will start throttling real subscribers too.
After deactivating, run a fake subscriber audit and consider a deleted accounts cleanup to clear out any bots that got through before SOS was activated.
The flood is usually step one, not the whole attack
A bot flood at 3 AM looks like the attack. Often it's the setup for a second move. Thousands of silent accounts joining overnight crater your ERR, and a tanked engagement rate is exactly what a competitor needs to make the next step land: a coordinated report campaign that now has "look, this channel is full of bots" as supporting evidence. Left alone, an invite flood feeds straight into a SCAM label or a mass-report takedown attempt.
That's why speed beats diagnosis here. You don't need to know who's behind it or why while it's happening — you need the join rate back to safe so the flood can't grow into the evidence for something worse. Understand it afterward, from the incident log. Stop it first.
How to activate
- Open @channel_guardian_bot.
- Select the channel under attack from your list.
- Tap "SOS" in the channel menu.
- Tap "Enable SOS Mode" — protection activates immediately.
Frequently Asked Questions
No. The channel stays public and the invite link keeps working. SOS caps the rate at 10 new members per 60 seconds — the 11th and every subsequent joiner within that window gets banned immediately. Regular subscribers arriving at a normal pace go through without issue.
Deactivating SOS resets everything: the rate limit, auto-ban of known abusers, and join-request auto-approval all turn off. Any custom rate limits you had before enabling SOS are not restored automatically — you'll need to set them again manually.
Anti-raid protects against a compromised admin deleting subscribers from inside your channel. SOS protects against an external flood — bots trying to join en masse from outside. Two different attack vectors, and you can run both at once.