How to secure your Discord server against raids, scams and takeovers
A Discord server is the front door of most game communities, and it attracts the same trouble as any busy public place: spam, raids, scammers and attempts to take over staff accounts. A few settings and habits, applied before there is a problem, protect your members and your reputation. The menu names below can shift as Discord changes its interface, so look for the described setting if a label differs.
Know the main threats
| Threat | What it looks like |
|---|---|
| Raids | A wave of new accounts floods channels with spam or abuse |
| Scam links | Fake "free nitro", fake support, fake giveaways |
| Compromised staff accounts | A moderator's account is hijacked and used to post malicious links |
| Malicious bots | A bot with too many permissions deletes channels or leaks data |
| Leaked webhooks and tokens | Someone gains control of a bot or can post as it |
| Impersonation | Accounts copying your staff names and avatars |
Lock down the basics
Verification level
In the server settings, raise the verification level so new accounts must meet a minimum requirement, such as a verified email, before they can talk. Higher levels slow down raids at the cost of a little friction for genuine new members. Many communities pick a medium level and raise it during an attack.
Explicit content filter
Turn on the filter that scans media from all members. It helps catch harmful images automatically.
Default notification settings
Set the default to only mentions, so a mass-mention spam message does not alert everyone.
Community features and rules screen
If you enable community features, use the rules screening so new members must agree to the rules before they participate. This also gives you a place to state expectations clearly.
Roles and permissions
Most takeovers succeed because someone had permissions they did not need.
- Follow least privilege. Give each role only the permissions it needs.
- Avoid Administrator. It overrides every channel permission. Only the owner and perhaps one trusted co-owner should hold it.
- Limit dangerous permissions such as Manage Server, Manage Roles, Manage Webhooks, Mention Everyone and Ban Members.
- Keep a role hierarchy. A role can only manage roles below it, so place moderators below admins and bots in sensible positions.
- Remove
@everyonepowers. Disable permissions like embedding links or mentioning everyone for ordinary members, and open them up for trusted roles. - Review regularly. Check who holds each role every few months.
Require two-factor authentication for moderation
Discord has a setting that requires staff to have two-factor authentication enabled before they can use moderation powers. Turn it on. Then ask every moderator to protect their personal account with an authenticator app, a strong unique password and a password manager. See How to choose strong passwords and use a password manager and Enable two-factor authentication.
AutoMod and filters
Use Discord's built-in AutoMod to block or flag common abuse: spam, mention floods, certain keywords and suspicious links. You can have it delete the message, alert staff and temporarily time out the user. Review its alerts for false positives, and adjust the rules. Complement it with a reputable moderation bot if you need more control.
Bots and integrations
Every bot you add is code with permissions in your server.
- Only add bots from developers you trust, and check what permissions they request.
- Avoid giving bots Administrator. Grant only what they need.
- Audit installed bots now and then, and remove the ones you no longer use.
- Treat your own bot's token like a password. See Create a Discord bot token safely and Secure your bot and its permissions.
- Review webhooks under integrations. Delete unknown ones, since anyone with a webhook URL can post as it.
If you host a bot of your own, Keep your bot online covers reliability.
Protect against scams
Warn your members regularly that:
- Staff will never ask for passwords, tokens or two-factor codes.
- Free currency, free server or "exclusive" giveaway links are almost always scams.
- Download links from strangers can carry malware.
- Real support comes through tickets members open themselves. See How to open a support ticket.
Pin a short message with these points. For a deeper guide, link to How to spot phishing and fake support messages.
Turn off direct messages from server members by default in your own settings, and encourage others to do so.
Prepare a raid response plan
Before a raid happens, write down the steps:
- Raise the verification level and lock the busiest channels.
- Pause invites if the server allows it.
- Remove spam, ban the raiders and check the audit log for how they got in.
- Tell the community briefly what is happening.
- After the wave passes, relax the restrictions and fix the gap.
Make sure at least two trusted people know the plan and can act.
Use the audit log
The audit log records role changes, bans, channel edits and bot additions. Check it after any incident and during routine reviews. Unusual activity from a staff account often means it has been compromised: remove its powers immediately and ask the person to secure it.
Backups and ownership
Keep two people able to recover the server. Do not make one person the only owner without a plan for emergencies. If your server holds important information, such as rules and guides, keep a copy elsewhere. Teams that connect Discord to game servers should also protect those links, such as the hosting account itself. See Keep your account secure.
Quick checklist
| Setting | Done? |
|---|---|
| Verification level raised | |
| Explicit content filter on | |
| Rules screening on | |
| Administrator limited | |
| Moderator 2FA required | |
| AutoMod rules set | |
| Bots and webhooks audited | |
| Scam warning pinned | |
| Raid plan written |
Still stuck? Open a ticket on Discord - run /ticket in any channel, pick a department, and include your Server ID or Invoice ID so we can jump straight in.