Discord server security checklist: 15 steps to protect your community
A practical checklist to secure a Discord server: permissions, 2FA, bot vetting, verification, AutoMod, raid readiness, scam protection and audit logs.
By the Double Counter teamUpdated 11 min read
Key takeaways
- Most destroyed servers were not “hacked”: an account with too many permissions was phished, or a bot was given Administrator.
- Start inside: least-privilege roles, two-factor authentication for staff and a short list of trusted bots prevent the worst outcomes.
- Then guard the door: a verification gate with alt and VPN detection stops raids, spam accounts and returning banned members.
- AutoMod, slowmode and link restrictions for newcomers handle what gets through; Security Actions handle emergencies.
- Security is a routine. Review roles, bots and logs every few months and after every staff change.
When a Discord server is wrecked, the story is almost always one of three: a moderator clicked a phishing link, a bot had more power than it needed, or the front door was open when a raid arrived. None of these need a sophisticated attacker, and all of them are preventable with settings you already have.
This checklist goes through fifteen steps in priority order. The first half protects the server from the inside, the second half from the outside. You can do all of it in an afternoon.
Lock down roles and permissions
1. Strip @everyone to the minimum
Every permission on @everyone is a permission for an account that joined ten seconds ago. Remove Mention @everyone, @here and All Roles, Create Invite, Manage anything, and consider removing Embed Links and Attach Files for unverified members.
2. Treat Administrator as radioactive
Administrator bypasses every channel override and can undo everything on this list. Give it to the owner and as few people as you can name without thinking. Moderators almost never need it: Kick, Ban, Timeout and Manage Messages cover day-to-day work.
Handle these permissions with the same care, because each one can be turned into a nuke:
- Manage Roles: grants any role below the holder's own.
- Manage Channels: deletes channels and their history.
- Manage Webhooks: posts as anyone, in any channel it applies to.
- Manage Server: changes the name, the invite settings, and adds bots.
- Ban Members: mass bans are the classic end of a compromised moderator account.
3. Get the role order right
A member can only act on roles and members below their highest role. Keep staff roles at the top, bot roles just high enough to do their job, and cosmetic roles at the bottom. Check the result with View Server as Role.
Secure the accounts that hold power
4. Require two-factor authentication for moderation
In Server Settings → Safety Setup, enable the 2FA requirement for moderator actions. A stolen password alone can then no longer ban members or delete channels. The server owner must have 2FA enabled to switch it on.
5. Train staff against account theft
Most takeovers start with a message, not an exploit. Make sure everyone with a staff role knows the rules:
- Never scan a QR code sent by someone else. A Discord login QR code logs the sender into your account.
- Never run a file, a script or a “game to test” sent by DM.
- Never paste anything into the browser console, and never share a token.
- Discord staff do not DM people to ask for passwords, and no real verification asks you to log in on another site.
6. Remove access when people leave
Staff changes are when permissions rot. Remove roles the day someone steps down, and review the member list of every staff role a few times a year.
Vet bots, webhooks and integrations
7. Add bots deliberately
A bot is an account with permissions that someone else controls. Before inviting one, check that it is verified by Discord, widely used, documented, and that the permissions it requests match what it does. Be very reluctant to grant Administrator to any bot. Limit who can add bots at all: that is what Manage Server controls.
8. Audit webhooks and remove what you do not use
Open Server Settings → Integrations and delete webhooks and bots nobody remembers adding. A webhook URL is a password: anyone who has it can post in your channel, so never paste one in a public place or a public repository.
Guard the door: verify new members
9. Set a verification level
Medium (verified email, account older than five minutes) is a sensible default. Raise it during an attack.
10. Build a verification gate
New members should see one channel until a verified role unlocks the rest. This one change makes join floods harmless, because the accounts have nowhere to post. Follow the verification setup guide.
11. Check who is behind each new account
A gate that only checks for a human lets banned members straight back in. Add alt detection and VPN blocking at the gate so that a returning member is recognised whatever account they use. Background reading: alt accounts, ban evasion and VPN blocking.
Filter what gets posted
12. Configure AutoMod
Discord's AutoMod runs before a message is delivered. Enable the spam filter, mention-spam protection with an automatic timeout, the commonly flagged words lists that fit your community, and a custom keyword rule for the scam phrases you see most. Send its alerts to a staff channel.
13. Limit what newcomers can do
- Slowmode in busy public channels.
- No links, embeds or attachments until a member has a trusted role.
- The explicit media filter set to scan all members.
- A honeypot channel: a channel no human has a reason to post in, where any message leads to an automatic ban or timeout. It catches compromised accounts that spam every channel they can see.
Prepare for the bad day
14. Write a one-page incident plan
Decide in advance who does what during a raid or a takeover, and pin it in the staff channel. The core of it fits in five lines: pause invites with Security Actions, lock the affected channels, remove the accounts involved, strip roles from any compromised staff account, then tell your members what happened. Our raid protection guide has the full sequence.
15. Keep logs, and read them
The audit log records who changed what, for a limited time. Complement it with a log channel for joins, bans, role changes and verification results, and always fill in ban reasons. Then put a recurring reminder in your calendar: every three months, review roles, bots, webhooks and the last quarter of logs.
The checklist at a glance
- Strip
@everyoneto the minimum. - Give Administrator to almost nobody.
- Order roles so that staff are above bots and bots above members.
- Require 2FA for moderator actions.
- Train staff against QR codes, files and fake logins.
- Remove access as soon as someone leaves the team.
- Vet every bot and refuse Administrator requests.
- Audit webhooks and integrations.
- Set the verification level to Medium or higher.
- Build a verification gate with a verified role.
- Add alt detection and VPN blocking at the gate.
- Configure AutoMod and its alerts.
- Restrict links, files and speed for newcomers.
- Write and pin an incident plan.
- Keep logs and review everything quarterly.
If you only have ten minutes today, do numbers 2, 4 and 10. They remove the three most common ways a server is lost.