Discord server security checklist (2026)
Originally published at guardian.esnoffical.com/guardian/discord-server-security-checklist. By ESN Systems, makers of ESN Guardian. Updated November 2, 2026. Most Discord servers that get nuked or raided were not beate
Originally published at guardian.esnoffical.com/guardian/discord-server-security-checklist.
By ESN Systems, makers of ESN Guardian. Updated November 2, 2026.
Most Discord servers that get nuked or raided were not beaten by anything clever. A mod without 2FA got phished, a big role had a permission it never needed, or a forgotten bot still had Administrator. This checklist covers the settings that matter, in the order we would fix them.
Want a score instead? Take the 2-minute security check and get a letter grade with your fixes β
1. Accounts and 2FA
- Turn on βRequire 2FA for moderator actions.β Server Settings β Safety Setup. Only the server owner can change it, and no bot can do it for you. It stops a stolen password alone from being enough to ban members or delete channels.
- Ask every staff member to use an authenticator app, not just SMS, and to never scan QR codes sent in DMs. QR login scams are one of the most common ways staff accounts are taken over.
- Know who your owner account is. The owner account can't be limited by any bot or role, so it needs the strongest login on the server.
2. Roles and permissions
- Strip dangerous permissions from @everyone. Administrator, Manage Server, Manage Roles, Manage Channels, Ban, Kick, Manage Webhooks and Mention @everyone should all be off on the @everyone role.
- Check channel overrides too. A single channel where @everyone has Manage Webhooks or Mention @everyone is enough for a spam raid. Open each channel's Permissions tab and look at the @everyone row.
- Keep Administrator to one to three people. Give mods the specific permissions they use (Timeout, Manage Messages) instead of Administrator.
- Keep big roles harmless. Roles that lots of members hold (Members, Level 10, Booster) should never carry Ban, Kick, Manage Roles or Manage Channels.
- Order your roles. Staff roles above member roles, and your security bot's role above everything it has to protect. A bot can't act on a role above its own.
3. Bots and webhooks
- Review every bot's permissions. Server Settings β Integrations. Most bots don't need Administrator. If a bot's token leaks, whatever it can do, an attacker can do.
- Remove bots you no longer use. Unused bots keep their permissions forever.
- Delete old webhooks. Server Settings β Integrations β Webhooks. A webhook keeps working after the person who made it leaves, and anyone with its URL can post through it.
- Limit who can add bots. Adding a bot needs Manage Server. Keep that permission to a small, trusted group.
4. Joins and raids
- Set the verification level to Medium or higher. Server Settings β Safety Setup. New accounts then have to wait before they can type.
- Turn on the explicit image filter for all members. Raids often open with shock images.
- Put new members behind a gate. A captcha or verify button stops most raid bots before they can see your channels.
- Plan a lockdown. Decide in advance who can pause invites and lock channels, and how. In a raid you won't have time to work it out.
- Set default notifications to βOnly @mentionsβ on bigger servers, so a spam wave doesn't ping everyone's phone.
5. Recovery
- Keep a backup of your structure. Channels, roles and their permissions take hours to rebuild by hand. Refresh the backup after big changes.
- Have a private log channel. Bans, kicks, deletes and bot alerts in one staff-only place, so after an incident you can see exactly who did what.
- Write down the emergency steps. Pin a short plan in your staff channel: who to contact, how to lock down, how to restore. If it ever happens, read what to do when your server gets nuked.
ESN Guardian checks most of this list for you. Every protection is included on every server.
Add Guardian to DiscordGrade your server first
Where ESN Guardian helps
You can do everything above by hand, and the 2FA setting can only be done by the owner. Guardian covers the parts that need watching all the time:
-
/audit rungrades your server from A+ to F on the checks above: 2FA for mods, verification level, media filter, dangerous @everyone permissions and channel overrides, crowded dangerous roles, bots with dangerous permissions, unverified or recently added bots, and webhooks. -
/audit fixapplies the fixes you pick, and/audit undoreverts them. -
Anti-nuke stops an account or bot that starts mass deleting, banning or creating webhooks, and
/rewindputs back what was changed. -
Anti-raid and verification catch join waves, quarantine them and put new members behind a captcha (
/captcha,/gate). -
/safemode lockdownlocks the server in one command when you need it.
Once Guardian is in your server, your real grade also shows on the dashboard.
Questions
What is the most important Discord security setting?
Requiring 2FA for moderator actions. Most nukes start with a staff account that was phished, and 2FA stops a stolen password from being enough. Only the server owner can switch it on.
How many admins should a Discord server have?
As few as possible, usually one to three people you would trust with the whole server. Give moderators the specific permissions they need instead of Administrator.
Should bots have Administrator?
Only if they truly need it. A security bot needs high permissions to restore what gets deleted, but most other bots work fine with a few specific permissions. A leaked token for a bot with Administrator can wipe a server.
How can I check my server's security quickly?
Take the quick 2-minute check at guardian.esnoffical.com/grade for a letter grade and a list of fixes, or add ESN Guardian and run /audit run for a grade based on your server's real settings.
Running your own Discord bot? ESN Hosting runs Discord bots 24/7, from $0.50/mo β
More guides
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.