Bots power your Web3 Discord, but they can also be the fastest path to a breach. Use this practical guide to lock down permissions, hosting, OAuth2, and monitoring so bots stay safe and useful.
Bots touch everything in a modern server, from onboarding and token gating to announcements and moderation. In Web3 communities, a compromised bot can push phishing links, assign powerful roles, wipe channels, or open the door for coordinated raids in minutes. Attackers target bot tokens, overprivileged permissions, unvetted third party bots, and sloppy OAuth2 use. The result is brand damage, stolen assets, and member churn. Treat Discord bot security as part of your core security stack, not a nice to have.
Start by listing what each bot actually needs to do, then grant only the minimum permissions to enable those tasks. Avoid Administrator altogether, and break out needs into granular permissions like Send Messages, Manage Roles, Create Public Threads, or Manage Webhooks. Place each bot’s role just above the highest member role it must assign, and keep it below staff roles so it cannot escalate privileges. Limit where commands can run. Go to Server Settings, Integrations, select the bot, then restrict commands to specific channels and set which roles can use them. For bots that post announcements, allow them to speak only in the target channels, and remove message permissions everywhere else.
Modern Discord lets you control bot behavior without custom code. In Server Settings, Integrations, select your bot and manage channel access per command. Disable commands server wide, then allow them in the channels that make sense, such as a support channel or a staff room. For sensitive commands like role assignment or wallet recheck, require a staff role by default. Use per command default member permissions so regular members cannot trigger high impact actions. Review this configuration monthly, and any time you add a new command or channel.
Open the Discord Developer Portal and audit each application. Under Bot settings, disable privileged gateway intents you do not need. Only enable Guild Members or Message Content if the bot’s features absolutely require them, and turn off Presence if you do not use it. Prefer slash commands and context menus over message listeners to reduce exposure to the Message Content intent. Generate invite links with only the scopes you need, usually bot and applications.commands. In the invite link, keep permissions to the minimal integer that matches your least privilege plan. If your website needs sign in with Discord, use a separate OAuth2 client with identify and guilds, store tokens securely, and never bundle that scope in the bot’s invite.
Bot tokens are bearer secrets. Store them in a cloud secrets manager, not in code or environment files committed to git. Rotate tokens on a fixed schedule and whenever staff roles change. Use a separate Discord application and token for staging so developers never run production tokens on local machines. Isolate the bot runtime in its own account or namespace, restrict outbound network access, and turn on two factor for all cloud and repository accounts. Pin dependencies with a lock file, enable automated security updates, and scan packages for known issues. Add structured logging and a health check endpoint so you can detect failures before members feel downtime.
Only install third party bots from the official App Directory or the vendor’s verified site. Never accept bot invites from DMs. Confirm the application ID in the invite matches the one listed in the vendor’s documentation. Before production, add the bot to a staging server that mirrors your role ladder and key channels, then test every command and permission edge case. During the invite, carefully review the permission prompt, uncheck anything not required, and regenerate an invite with a lower permission integer if needed. After onboarding, restrict its commands and channels in Integrations, and document the owner, purpose, permissions, and review date in your bot inventory.
Token gating bots often request broad permissions, which creates risk if you are not careful. For role assignment, give Manage Roles only, and position the bot role between staff and member roles so it cannot grant staff power. Avoid Administrator permission for verification bots. Require all verification flows to start in a visible verification channel with pinned instructions, and block DMs from initiating verification. Use trusted providers with public documentation, transparent status pages, and clear security practices. Configure rechecks on a schedule that balances accuracy and rate limits, such as daily or on demand by staff, and log every grant or revoke with user ID, wallet address hash, and the rule that fired.
Create guardrails so a misconfigured or compromised bot cannot cause mass damage. Add per command cooldowns and per user limits for risky actions. Set thresholds that require a second factor, such as a staff confirmation, for bulk role changes or mass messages. Restrict Manage Webhooks to staff and the specific bot that needs it in its target channels, and regularly list and remove unknown webhooks. Enable server Audit Log reviews and forward bot logs to a central system, then alert on patterns like mass mentions, sudden spikes in command errors, or a bot posting links outside of its allowed channels. Keep a weekly report of bot activity so you can spot drift in behavior or permissions.
If a bot behaves suspiciously, act fast. In the Developer Portal, reset the token immediately and remove the bot from the server if it is performing hostile actions. In Server Settings, Integrations, revoke its authorization and delete any webhooks it created. Review the Audit Log for new roles, permission changes, and channel edits linked to the bot, then revert the changes and lock down affected channels. Post a status update in announcements that explains the issue and tells members to ignore recent messages or links from the bot. After containment, rotate any other shared secrets, run a dependency and access review, and only reintroduce the bot with a fresh application, a reduced permission set, and a clear maintenance owner.
Protect your Web3 server with Discord bot security. Lock down permissions, intents, OAuth2, hosting, and monitoring to block raids and scams with confidence.