How to recover a compromised Discord server

A compromised server is an emergency with a specific correct order, and the instinct — start rebuilding what was destroyed — is the wrong first move. Rebuilding while the attacker still has access wastes the work, and it destroys the evidence you need to close the route.

Before you start: you need to be the owner or hold Administrator, from an account you are certain is not the compromised one. If you are not sure, that is the first thing to establish.

Phase 1 — Stop the access (first five minutes)

Remove the roles, do not ban first.

Strip every privileged role from the suspected account. This stops the damage immediately and is reversible, which matters for two reasons: the account may belong to a member who was phished rather than an attacker, and a ban can complicate reading the audit trail while you are still working out what happened.

Ban later, once you know.

Revoke every invite. Server Settings → Invites, delete all of them — not only the recent ones. Creating an invite for later re-entry is a standard first action, and it is invisible among a normal server’s invite list.

Remove or disable the webhooks. Check every channel’s Integrations tab. A webhook created during the incident continues to post after the account is gone, because the URL is the credential and needs no account at all.

Raise the verification level to High temporarily. It slows a follow-up wave while you work.

Do not delete anything yet.

Phase 2 — Establish what happened (next fifteen minutes)

The audit log has a deadline. Discord retains entries for 45 days, and the record of this incident ages out with everything else. Before you change anything further, capture it.

Read Server Settings → Audit Log, filtered to the relevant account, and record:

• Which channels were deleted or created, and when
• Which roles were created, deleted or modified
• Which members were banned or kicked
• Which webhooks were created
• What permission overrides changed

Screenshot or export it. If you run a bot with its own logging, that record is the better source because it is not on a 45-day clock — Vetox’s 148 log event types and its 90-day trail of who changed which dashboard setting both survive well past Discord’s window, free on every tier.

Two things the audit log will not tell you, and it is worth knowing before you look:

• A member deleting their own message produces no entry, so message-level questions are largely unanswerable.
• MESSAGE_DELETE is aggregated with a count per moderator per channel, so the entry count is not the action count.

Both are reasons to have your own logging running before an incident rather than after — see setting up moderation logs.

Phase 3 — Restore (the next hour)

Deleted channels are gone. Discord does not restore them and their message history goes with them. This is the point at which a server either has a backup or has a rebuilding project.

With a structural backup, restore the shape — categories, channels, roles, permission overrides — and the work is minutes rather than an evening. History does not come back, but the server is usable and members can return.

Without one, rebuild in this order: categories, then channels, then roles, then permission overrides. Doing permissions last is deliberate; rebuilding them per-channel as you go produces an inconsistent result that becomes its own incident three weeks later.

Restore role assignments carefully. If members lost roles, reassign from a record rather than memory. A bot that logs role changes has that record; without one, ask rather than guess, because quietly under-restoring someone’s role reads as a demotion.

Say something publicly. A short, factual message — what happened, what is being done, what members should check — is worth more than a perfect restoration performed in silence. The most damaging hour of a compromise is usually the one where members cannot tell whether the server is safe.

Phase 4 — Close the route

The incident is not over until the entry point is closed, and there are only a handful.

A compromised account. The most common by far. The member re-secures the account — password change, session invalidation, 2FA — before any role is returned. Do not restore permissions to an account until its owner confirms it is secured.

A malicious or compromised bot. Remove it. Check Server Settings → Integrations for anything you do not recognise, and anything holding Administrator.

An over-permissioned role. Someone who should not have been able to do this could. Fix the grant, not just the person.

A webhook URL that leaked. Delete the webhook; it cannot be rotated because the URL is the identity.

Then apply the controls that prevent a repeat, in the order set out in securing a Discord server. Two of them matter most here:

Require 2FA for moderator actions. Server Settings → Moderation. A compromised moderator account without the second factor cannot perform moderation actions at all. This single setting prevents most repeats of exactly this incident.

Add audit-log-based insider protection. Watching channel deletions, role deletions, mass bans and webhook creations per executor in a rolling window is what turns a nine-minute incident into a thirty-second one. Vetox’s Protection ships 20 such rules free on every tier — it rate-limits a privileged account exceeding a threshold rather than waiting for a human to notice.

What not to do

Do not delete the server. It is irreversible and it is almost never the right answer.

Do not mass-ban members. An attacker’s damage is not undone by removing the people who watched it, and a wrongly banned member rarely returns.

Do not rebuild before capturing the audit log. The evidence has a 45-day clock and your changes will bury it.

Do not restore access to an unsecured account, however senior the person is. The account is the route until they prove otherwise.

Do not skip the public message. Silence during an incident is read as an unresolved incident.

Afterwards

Two things, within the week.

Write down what happened, while it is fresh: the route, the timeline, what worked and what you could not answer. The gaps in what you could reconstruct are the specification for your logging.

Take a backup and schedule it. The single strongest predictor of how badly a compromise goes is whether a structural snapshot existed beforehand, and it is the cheapest thing on this page to arrange in advance.

Frequently asked questions

Should I ban the compromised account immediately? Remove its roles first. That stops the damage, is reversible, and the account may belong to a phished member.

Can Discord restore deleted channels? No. Channels and their history are gone; only a structural backup rebuilds the shape.

How long do I have to read the audit log? 45 days from the action. Capture it before you start changing anything.

Why revoke old invites too? Creating an invite for later re-entry is a standard first action and is invisible among a normal invite list.

What prevents this happening again? Requiring 2FA for moderator actions, plus audit-log-based protection that rate-limits a privileged account acting destructively.