How to handle a brigading attack on your subreddit
Every branded subreddit gets brigaded eventually. The question is not whether it happens. The question is whether your team has a written plan for when it does. Most brands find out they do not, at 2 AM, when a viral complaint thread in a different subreddit sends a few hundred hostile visitors into theirs. This post is the brigading playbook we write in week one of every engagement, before the first incident, so the team is not making decisions under pressure.
What brigading actually is
Brigading is a coordinated influx of users from another subreddit or external platform, usually to vote-manipulate, pile on a specific user, or disrupt the normal operation of a community. It violates Reddit's site-wide rules against vote manipulation, but enforcement is slow, and by the time Reddit admins intervene the damage is already done. Per Vice, roughly 1 percent of subreddits are responsible for most brigading incidents across the platform (Vice). That 1 percent is usually the place your brigade is coming from.
Brigading is different from organic criticism. Organic criticism is a lot of people finding your sub individually and having opinions. Brigading is a lot of people arriving at once from a single source with coordinated intent. The defense is different, and conflating the two causes brands to overreact to normal discussion and underreact to actual attacks.
How to recognize a brigade in progress
Four signals together, not any one on its own:
- Sudden traffic spike on a specific thread. Not the whole sub, one thread. Brigades are usually targeted.
- Unusual upvote or downvote patterns. A thread that was at 100 upvotes drops to 20 in an hour without a change in content. Or a brand employee's comment that sat at neutral for a day suddenly hits negative 80.
- Accounts that have never posted in the sub before. Reddit Pro and ModQueue both surface this. If 30 of 40 new commenters are first-time participants in your sub, that is not organic growth.
- Similar comment phrasing or argument structure. Brigades often come with a shared framing. Multiple commenters landing on the same specific accusation within a short window is a strong signal.
You need three of the four before you act. One or two can be coincidence. Three together is actionable.
The immediate response
Once a brigade is confirmed, the first 30 minutes matter more than the next 30 hours. The standard response we use:
- Lock the affected thread. Not delete. Lock. Locking stops new comments while preserving the existing conversation and the evidence trail. Reddit's mod tools support this in one click.
- Restrict the subreddit. Move the whole sub into "restricted" or "comments-only from approved users" mode if the brigade is spreading. r/Ireland famously used a "DEFCON-2" mode in 2025, locking down to comments-only from established users during sustained brigading, and that pattern has become the standard response for mid-to-large subreddits facing similar attacks.
- Preserve evidence. Do not delete posts or comments that are part of the brigade. Archive them. Reddit's admins will ask for links, not summaries, when you escalate.
- Notify your internal team. Whichever back-office channel you use (we recommend a dedicated Slack channel, documented in the Slack back-office model), the community manager flags the incident and the crisis playbook takes over.
Locking and restricting are not censorship. They are crowd control. Reddit's moderation guidelines explicitly permit both during active incidents, and the community understands them.
The AutoMod rules that buy you time
Most brigades can be slowed or stopped outright by AutoModerator rules that were configured before the incident. The standard set we ship includes:
- Account age threshold. Comments from accounts younger than 30 days get filtered into the mod queue automatically. Brigades often come from new or throwaway accounts, and this rule catches most of them without affecting real users.
- Comment karma threshold. Comments from accounts with fewer than 50 or 100 karma get filtered similarly. Set the threshold lower for hobbyist communities and higher for B2B subs where most real users have established histories.
- Rate limiting. Limit any single user to a fixed number of comments per hour on a hot thread. Brigades rely on volume. Rate limiting breaks the tactic.
- Keyword watchlist. If you know the specific phrase or accusation the brigade is pushing, add it to an AutoMod rule that automatically filters comments containing it into the mod queue for human review.
The full AutoMod configuration we use as a starting point is documented in the AutoModerator setup guide. The point is that these rules work because they are in place before the incident. AutoMod rules written during a brigade are already too late.
Reporting to Reddit ModSupport
Reddit ModSupport is the official escalation path for moderators reporting brigading and vote manipulation. The process: file a report through the ModSupport subreddit modmail, include direct links to the affected threads, document the account patterns you have observed, and wait. Reddit admins are slow, especially on weekends, but they do act on documented brigading reports, and the reports go on file. If the same source subreddit brigades you twice, the second report gets escalated faster.
Do not skip this step. Even if Reddit does not act immediately, the reports create a paper trail that supports stronger action later, and it signals to the Reddit admins that your brand takes community health seriously. Brands that build a relationship with ModSupport through proper reports get faster responses during the next incident.
Why branded subs are a particular target
Branded subreddits face brigading risks that general-interest subs do not. Competitors occasionally organize brigades from their own communities to damage a rival. Disgruntled former customers post viral complaints that brigade the brand sub for days. Product launches attract coordinated reviews from rival fanbases, especially in consumer electronics and gaming. A single viral video or X thread can push thousands of hostile visitors at a sub in an hour.
The lesson is not that branded subs are more dangerous than regular subs. The lesson is that branded subs need a crisis playbook specifically tuned to these incident types, because they happen to branded subs at higher frequency than they happen to hobbyist subs. The playbook is documented in what the Duolingo mod revolt teaches brand subreddits and in how to respond to negative Reddit threads.
Long-term protection
Once the immediate brigade is resolved, the longer-term protection is three things:
- A trained mod team that knows the playbook and can execute without waiting for instructions.
- Ongoing monitoring through tools like F5Bot, Reddit Pro alerts, and the Slack back-office so that incidents are detected within minutes, not hours.
- A documented relationship with Reddit ModSupport so that escalations are faster the next time.
None of this is expensive. All of it prevents the failure mode where a single bad response to a brigade becomes a reputational incident that takes months to recover from. Our Reddit monitoring post walks through the monitoring setup in detail.
Conclusion
Brigading is predictable. It happens. It follows patterns. The brands that handle it well are the ones that wrote the playbook in calm conditions and trained the mod team to execute it without hesitation. The brands that handle it badly are the ones writing the playbook during the incident, panicking, over-deleting, under-escalating, and making things worse. The difference between the two is not budget or scale. It is preparation.
How Soar saves you time and money
We write your crisis playbook in week one, before the first incident. Most brands write it during the incident, when they are panicking and making mistakes. Our standard engagement includes a documented brigading response plan, a documented relationship with Reddit ModSupport, and AutoMod rules pre-tuned for the most common brigading patterns we have seen across client subreddits. The cost of one bad brigading response is months of trust-building. The cost of preparing in advance is essentially zero.
The real value is not the playbook itself. It is the trained mod team that executes it calmly on a Saturday night, the Slack channel that catches the incident in minute five instead of hour three, and the institutional pattern recognition that flags the difference between organic criticism and an actual brigade. These are the things that separate a 30-minute incident from a week-long crisis, and they are the things we have learned by running branded subreddits across clients for years.
Soar builds and runs branded subreddits with crisis playbooks baked in from day one. If you want a 30-minute call to audit your current incident preparedness, request a proposal.