How to protect your Discord server from raids and nukes

A raid is a crowd of accounts joining at once to flood your channels. A nuke is worse: someone with permissions, or a bot you trusted, deletes channels and roles, bans members or posts through webhooks. Both are preventable, and most of the prevention is settings you control today.

1. Fix permissions before anything else

Most nukes are not hacks. They happen because a role had more power than it needed. Review who can do what.

• Give Administrator to as few people as possible. Prefer specific permissions such as Manage Messages or Kick Members.
• Keep Manage Roles, Manage Channels, Manage Webhooks and Ban Members for people you would trust with the whole server.
• Check bot roles too. A bot with Administrator can do everything its owner or a leaked token can do.
• Ask moderators to turn on two-factor authentication, and consider Discord's setting that requires it for moderation actions.

2. Make joining harder for throwaway accounts

Raids rely on fresh accounts joining instantly. Raise your server's verification level in Discord's safety settings, and add a gate that new members must pass before they can see or write anywhere. See the guide on setting up verification.

3. Filter the noise automatically

Even a small raid is exhausting when moderators clean up by hand. Rules for spam, mass mentions, links and invite links remove most of the mess before a human sees it. Start with delete or warn, then tighten once you know how your community talks. More in Discord automod settings that reduce spam.

4. Add an anti-nuke bot for the dangerous actions

Automod handles messages. It does not stop someone from deleting every channel. An anti-nuke bot watches destructive actions such as mass bans and kicks, channel and role deletions, webhook changes and unknown bots being added. When a person who is not on your whitelist triggers one, it punishes them and helps you recover. Read what a Discord anti-nuke bot is and how it works.

Korzax includes this as Anti-Nuke: you choose a ban, kick or timeout for each event, whitelist the people you trust, and rely on role and channel backups for recovery.

5. Keep the bot's role in the right place

A bot can only act on members and roles below its own highest role. Place your security bot's role above the roles it should protect and above ordinary members, but do not hand it more permissions than it needs for the features you use.

6. Have a plan for the bad day

1. Decide who can lock the server quickly if something goes wrong.
2. Keep a private channel where moderators and the bot post security alerts.
3. Know how to remove a compromised moderator's roles fast.
4. After an incident, review which permission allowed it and remove it.

No setting makes a server immune. The goal is to reduce what any single account can destroy and to notice quickly when something is wrong.