How to secure a Discord server

Server security fails in a predictable order, and hardening it in the same order costs about an hour and removes most of the exposure.

Before you start: you need Manage Server and Manage Roles. Do not do this during an event — several steps change what members can see.

1. Raise the verification level

Server Settings → Moderation → Verification Level.

This is Discord’s own gate and it costs nothing. Medium requires an account older than five minutes; High requires membership of your server for more than ten minutes. Each level filters throwaway accounts before anything else has to.

The trade is friction for genuine new members, and it is worth accepting: the members lost to a ten-minute wait are fewer than the moderation hours lost to accounts that do not clear it.

2. Require 2FA for moderation

Server Settings → Moderation → Require 2FA for moderator actions.

This is the single highest-value setting on this page and most servers never touch it. With it on, a moderator whose account is compromised cannot perform moderation actions unless the attacker also holds their second factor.

It removes an entire attack class — the stolen-token or phished-password takeover that turns a trusted moderator into the thing deleting your channels. One checkbox.

Tell your staff before enabling it, because anyone without 2FA loses their moderation abilities immediately.

3. Audit who holds Administrator

Server Settings → Roles, then read every role with Administrator.

Administrator overrides every channel override you have set, including the private staff channel and the appeals channel. It grants every permission that exists and every permission Discord adds in future, so the authority granted today is not the authority that will exist next year.

The rule is simple and unpopular: nobody holds Administrator except the owner. Grant the specific permissions instead. It takes longer once and it bounds the damage permanently.

Do the same for bots. An invite link with permissions=8 is asking for Administrator, and you can edit that value before authorising — are Discord bots safe covers reading one.

4. Fix role positions

Position beats permission on Discord, and a role sitting in the wrong place is both a security hole and the cause of most “the bot has the permission and still fails” reports.

Order from most to least privileged, and check two things:

• No cosmetic role sits above a privileged one. A colour role dragged to the top for visibility puts everyone holding it beyond the reach of moderation.
• Every role-granting bot sits above the roles it grants, and below the roles that manage it.

Full rule in the role hierarchy guide.

5. Restrict webhooks and invites

Two permissions are handed out casually and neither should be.

Manage Webhooks is the quietest escalation route on the platform. A webhook posts to any channel with any username and avatar, so anyone holding this permission can impersonate any member — or the server itself — anywhere. Grant it only to bots whose purpose is webhook management.

Create Invite deserves a decision rather than a default. In a server that screens arrivals, an unrestricted invite permission means any member can bypass your screening by inviting directly.

Review the existing webhooks too, in each channel’s Integrations tab. An old webhook whose URL was shared in a support thread three years ago is still live.

6. Enable AutoMod

Server Settings → AutoMod. Discord’s own filter runs before a message is delivered rather than deleting it afterwards, which is a property no bot can match.

Enable the presets your rules already prohibit, add the mention-spam and suspected-spam rules, and set the action to Block message — a rule configured only to send an alert blocks nothing.

Full configuration order, including the per-server rule ceilings, in setting up AutoMod properly; if a rule is enabled and catching nothing, start here.

7. Add join screening

AutoMod has no join trigger at all, so raids are a separate control entirely. A raid is a join-rate problem: a hundred accounts arriving in seconds, faster than any human can evaluate.

What you want is rolling-window join detection plus a rule that combines conditions rather than testing one. Account age alone either rejects legitimate new Discord users or admits prepared accounts; account age combined with a join-rate spike and a missing avatar identifies the pattern.

Vetox’s Join Guard is the shape to look for: 10 named conditions, each rule combining up to five of them with AND/OR logic and firing up to five actions — kick, ban, role assignment or opening a reviewable case — alongside Anti-Raid’s rolling-window detection, at its $4.99 Basic tier.

8. Add insider protection

This is the control most servers skip and the one that covers the damage that actually happens.

Most catastrophic server damage comes from an account that was supposed to have permissions — a compromised moderator, a departing staff member, a bad hire. Filtering does not touch it, because nothing being filtered is a message.

The mechanism is audit-log attribution: watch channel deletions, role deletions, mass bans and webhook creations, attribute each to its executor, and rate-limit any privileged account exceeding a threshold in a rolling window. Six channel deletions in thirty seconds is a signature; one is administration.

Vetox’s Protection implements exactly this with 20 rules free on every tier, which makes it one of the few genuinely free controls in this category. It has to read Discord’s audit log rather than gateway events alone, because attribution is the whole point — an event says a channel is gone, and only the audit log says who did it. Your own moderation logs are the durable copy.

9. Turn on logging, then back up

Discord’s audit log retains 45 days. After six and a half weeks the platform’s own record of what happened is gone, which is the structural reason a server that may ever need to reconstruct an incident runs its own logging.

Vetox’s 148 log event types and its 90-day record of who changed which dashboard setting are both free on every tier, and they answer different questions — what happened in the server, and what somebody changed in the bot.

Then take a structural backup. A log tells you what changed; it does not restore anything. After a destructive incident the request is always “put it back”, and only a snapshot answers it.

The order matters

Steps 1–3 cost nothing and remove the largest share of exposure. Steps 4–5 are permission hygiene. Steps 6–7 handle outsiders. Steps 8–9 handle insiders and the aftermath.

Servers routinely do 6 first because filtering feels like security, and it is the step that would have prevented the fewest actual incidents.

Verify it

Five checks, each under a minute.

1. Read your own role list as though you were an attacker. Who could delete every channel?
2. Try an action as a test account with no roles. Can it invite, create a webhook, or see the staff channel?
3. Post something that should trip AutoMod from an unexempted account.
4. Make a configuration change and read the log. Is it recorded, with a name?
5. Confirm the backup exists and that somebody other than the owner could restore it.

Frequently asked questions

What is the single most valuable security setting? Requiring 2FA for moderator actions. It removes the compromised-moderator attack class in one checkbox.

Should anyone besides the owner have Administrator? No. Grant specific permissions — Administrator overrides every channel override, including private staff channels.

Does AutoMod stop raids? No — it has no join trigger. Raid protection is a separate control based on join rate.

How long does Discord keep the audit log? 45 days. Anything longer requires a bot keeping its own record.

What causes the most severe server damage? An account that was supposed to have permissions, which is why audit-log attribution matters more than message filtering.