Most Discord servers are not broken into with clever exploits. They are lost through a moderator account without two factor authentication, a bot with Administrator, a forgotten webhook, or a new member who can post links to everyone. This checklist covers the settings and habits that stop the attacks we see most often.
It is written for server owners and community teams, and it follows the order we use when we review a server: accounts first, then permissions, then everything that can post or join. Work through it before a launch, after an incident, and whenever your staff changes.
Staff accounts
A single phished moderator gives an attacker everything that moderator can do. Most serious Discord incidents start here.
Every owner, admin, and moderator has two factor authentication turned on, with backup codes stored offline.
The server setting that requires two factor authentication for moderator actions is turned on. Only the server owner can enable it.
Staff use a unique password for Discord and never scan a QR code, paste code into a browser, or download a file because a message asked them to.
Staff who leave lose their roles the same day, and the staff list is reviewed every month.
Nobody shares an account, and the owner account is not used for daily moderation.
Roles and permissions
Permissions decide how much damage one mistake can do. The goal is that no single role, person, or bot can destroy the server alone.
The @everyone role cannot mention @everyone, @here, or all roles, and cannot create invites or public threads unless you decided it should.
Administrator is held by as few people as possible, and by no bot that can work without it.
Manage Server, Manage Roles, Manage Channels, Manage Webhooks, Ban Members, and Kick Members are limited to the roles that need them.
Bot roles sit below your admin roles in the role list, so a compromised bot cannot edit or assign the roles above it.
Channel permission overrides have been checked with the View Server As Role tool, including private staff channels.
New roles start with no permissions and are granted only what the job requires.
Bots and integrations
A bot is an account with permissions that someone else controls. If its developer or its token is compromised, the attacker inherits everything the bot can do.
You can say what every bot in the server is for. Bots nobody uses are removed.
Each bot has only the permissions its features need. Bots that demand Administrator are declined or replaced.
Bots are added only from the developer's official site, never from a link sent in a DM.
Bot and integration permissions are reviewed at least every quarter and after every new bot.
Custom bots keep their token out of code repositories and chat, and the token is reset if it may have leaked.
Webhooks
A webhook URL lets anyone who has it post in your channel under any name and avatar, with no account and no login.
You have an up to date list of every webhook and what uses it. They are listed under Integrations in the server settings.
Unknown or unused webhooks are deleted.
Manage Webhooks is limited to the few people who set up integrations.
Webhook URLs are treated like passwords: never pasted in public channels, screenshots, or public code.
A webhook whose URL may have been exposed is deleted and created again.
Verification and onboarding
Raids and scam waves need accounts inside your server. Verification decides how expensive it is to get them there.
The verification level is at least Medium, and High for servers that are actively targeted.
New members pass rules screening or a verification step before they can post.
New accounts cannot post links, attachments, or embeds until they are verified or have been members for a set time.
Raid protection and activity alerts are enabled in Safety Setup, and the alerts go to a channel your team watches.
Higher risk servers add a dedicated verification system with a captcha and account age checks.
Scam and spam filtering
Most scams are repetitive: fake support, fake giveaways, fake airdrops, look-alike links. Filters should remove the obvious ones before a member can click.
AutoMod blocks mention spam and suspected spam content, and sends its alerts to a private log channel.
Custom AutoMod rules cover the scam phrases and look-alike domains your community is hit with.
Only trusted roles can post links in announcement and high traffic channels.
Members are told, in a pinned and visible place, that your team will never message them first and never ask for a seed phrase, a password, or a payment.
Reports from members reach a moderator quickly, through a clear report channel or command.
Support and impersonation
Scammers copy your team's names and avatars and answer support questions in DMs faster than you do.
Support happens in tickets or a public channel, never in DMs, and members are reminded of it.
Staff are easy to recognize, with a dedicated role shown separately in the member list.
Official links are listed in one read only channel, and announcements only link to them.
You search for look-alike servers and accounts that use your name, and you report them.
Logs and monitoring
You cannot respond to what you cannot see. The audit log tells you who changed what, if somebody is looking.
A private log channel records joins and leaves, bans, role changes, channel changes, and new webhooks or bots.
Someone reviews the audit log on a schedule and after anything unusual.
Sudden changes, such as a join spike or a new role with powerful permissions, raise an alert instead of waiting to be noticed.
Communities that are targeted around the clock have coverage around the clock.
Incident response and recovery
When a raid or a compromised account happens, the first ten minutes decide how bad it gets. Decisions made in advance are faster than decisions made in a panic.
A written plan says who is alerted, who can act, and what is locked first.
Your team knows how to pause invites and DMs with Security Actions, raise the verification level, and lock channels quickly.
At least two trusted people can respond, in different time zones if possible.
The server structure is backed up, so channels, roles, and permissions can be rebuilt.
After every incident you write down what happened and change the setup that allowed it.
Before a launch or a big event
Mints, token launches, giveaways, and AMAs attract attackers on a schedule you announced yourself.
Run this checklist again one to two weeks before the date, while there is still time to fix things.
Announce official links early and repeat that no other link is real.
Tighten who can post links and files during the event window.
Schedule extra moderators for the hours around the launch.
Decide in advance who can call a lockdown.
Want a second pair of eyes?
DiscLabs runs this review for you. Request a free Discord security audit and get a prioritized list of what to fix.
What is the most important Discord security setting?
Two factor authentication on every staff account, together with the server setting that requires it for moderator actions. A compromised moderator account is the most common way a server is taken over, and this is the cheapest way to prevent it.
How often should I review my Discord server security?
Review bots, webhooks, and staff roles at least every quarter. Run the full checklist before a launch or a major event, after any incident, and after staff changes or large permission changes.
Is Discord AutoMod enough to protect a server?
AutoMod is a good first filter for spam and known scam phrases, and every server should use it. It does not judge context, review permissions, or notice a compromised staff account, so it works best alongside human moderation and tight permissions.
Can someone check all of this for me?
Yes. DiscLabs offers a free Discord security audit that reviews your permissions, bots, verification, and moderation setup and gives you a prioritized list of fixes.
A practical Discord security checklist: staff accounts, roles and permissions, bots, webhooks, verification, AutoMod, monitoring, and incident response.