Discord Server Security Checklist

Level 1: Permission hygiene (do this today)

Nearly every catastrophic Discord incident traces back to an account having permissions it did not need. This level is free, takes twenty minutes, and removes more risk than everything below it combined.

1. List everyone with Administrator. Server Settings → Roles. For each one, ask what they would actually be unable to do without it. Most answers are “nothing”.
2. Replace Administrator with specific grants. Most moderators need Kick Members, Timeout, Manage Messages, and nothing else.
3. Audit dangerous permissions individually. Manage Server, Manage Roles, Manage Channels, Ban Members, and Manage Webhooks are the ones that turn a compromise into a nuke.
4. Check role hierarchy. A role can only act on roles below it. Make sure your bot and moderator roles sit where you think they do.
5. Review every bot. Any bot with Administrator you cannot justify gets removed. Bots are accounts too.
6. Lock @everyone down. The default role should have the minimum needed to see and use public channels.

Level 2: Authentication and access control

Level 1 limits what a compromised account can do. Level 2 makes compromise less likely in the first place.

• Enable server-wide 2FA requirement. Server Settings → Safety Setup. Moderation actions then require 2FA on the acting account.
• Set Discord's verification level to Medium or higher. Free, native, and filters a meaningful amount of low-effort abuse.
• Turn on the explicit content filter for all members.
• Add OAuth verification if your onboarding needs more than Discord's native gate — and remember it also produces the authorization that makes recovery possible.
• Protect your own account hardest. The owner account is the highest-value target in the server.

One caveat worth being honest about: verification proves an account completed a flow, not that a person is unique or trustworthy. It raises the cost of abuse; it does not establish identity.

Level 3: Backup and recovery

Levels 1 and 2 reduce how often something goes wrong. Level 3 decides what it costs when something goes wrong anyway — and that is not optional, because no set of controls is perfect.

• Take a snapshot today. A manual one now beats a perfect schedule configured next month.
• Schedule automatic capture at a frequency matched to how fast your server changes.
• Know what your plan covers. Message depth and attachment coverage vary by tier — check before you rely on them.
• Set up member recovery. Structure and members are separate problems; a backup alone restores an empty server.
• Restore one into a spare server. This is the step that converts a backup from a belief into a control, and almost nobody does it.

Level 4: Anti-raid and anti-nuke

With the foundations in place, live detection becomes worth adding. It is at level 4 rather than level 1 because a detection bot in a server with sprawling permissions is protecting the wrong thing.

• Add one live tool — Wick and Security Bot are the strongest options, and both have usable free tiers.
• Configure join-rate thresholds against your actual traffic, not defaults.
• Set up a lockdown procedure and make sure more than one person knows how to trigger it.
• Route security events to a logging channel that moderators actually read.
• Test the automated actions on a staging server before letting them run on your real one.

See the anti-raid bot comparison for which tool fits which threat model.

Level 5: Firewall rules and filtering

Rules at the verification gate stop abuse before detection has to catch it. This level is where you convert observed attack patterns into explicit policy.

• Start with VPN and proxy detection. The broadest win for the least tuning.
• Add ASN rules against observed abuse. Raids frequently share a hosting provider; blocking that ASN costs you very few real members.
• Use country rules sparingly. They are blunt and they will catch legitimate members travelling.
• Set a bypass password on day one. It is what keeps a strict rule from becoming a support queue.
• Read the decision logs. Rules tuned from evidence beat rules tuned from intuition.

Level 6: Ongoing monitoring

• Review the audit log weekly — it is the cheapest anomaly detector you have.
• Re-audit permissions quarterly, and always after a staff change.
• Rotate bot tokens on a schedule, and immediately if one may have leaked.
• Confirm your snapshots are actually running rather than silently failing.
• Rehearse the incident runbook once a year. Who contains, who preserves evidence, who restores, who communicates.

Priority by server size

The free baseline that covers most of it

Security is not a state you reach, it is an order you work in. Do the free hour today; everything else can wait until you have evidence you need it. Start free and get verification and your first snapshot in place.