Nukes & Raids
This guide covers what nukes and raids are, how they happen, and what you can do about them.
Anti-Nuke
Section titled “Anti-Nuke”A nuke is when someone (or a bot) with high Discord permissions in your server destroys a server; deleting channels, roles, and so on. Usually they’ve gone rogue, been hacked, or obtained those permissions illicitly.
How anti-nuke bots work
Section titled “How anti-nuke bots work”Bots that offer anti-nuke protection usually react to actions taken by your staff. You configure thresholds that answer questions like “how many channels would a staff member reasonably delete within a given timeframe?” The same goes for creating, editing, moving, and deleting categories, roles, channels, or server settings.
When the bot detects a staff member exceeding the expected threshold, it takes action. These actions are usually configurable, but the goal is generally to revoke the offender’s elevated permissions or neutralize them as a threat — the assumption being that they’ve gone rogue, been hacked, or obtained their permissions illicitly.
In effect, this reactively prevents further damage. It’s also why anti-nuke bots ask for high permissions and to be placed above other staff: so they have the permission to remove the offender’s permissions, or the offender altogether.
Limitations of anti-nuke
Section titled “Limitations of anti-nuke”- Deleted channels can’t be restored. The channel and its messages are gone for good — at best you can re-create the channel.
- Deleted messages are gone for good. Even if the channel survives, messages deleted in it can’t be restored.
- Deleted roles can’t be restored. You can create a new identical role, but the hard part is re-assigning it to people — especially for roles given out by bots or other automated means. It can be worked around if a bot tracked who had which roles, but that’s usually not feasible in large servers.
- Deleted servers can’t be restored. Contrary to popular belief, Discord’s server templates don’t really help: a template only exists while the original server does, only creates new servers, and only captures the skeleton (channels, roles, permissions, stickers, emojis, config) — it doesn’t add members, restore their roles, or restore messages.
- Stolen vanity invites stay stolen. If someone removes a custom invite link and then claims it in another server, neither you nor a bot can restore it on your own. You can, however, reach out to Discord support, who will likely return it.
Generally speaking, bots can’t undo things. What usually happens is that they try their best to re-create or edit things back toward the original state.
Preventing nukes
Section titled “Preventing nukes”- Don’t hire untrusted staff. The first line of defence is simply not giving people you can’t trust high permissions. Brand-new servers may not have any “trusted” members yet — but they usually don’t need staff yet either.
- Education and awareness. One of the most effective things you can do. Make yourself and your team aware of phishing, info-stealers, malware, and compromised credentials.
- Give limited permissions. Limit each role to only what it reasonably needs. Chat moderators usually don’t need to create and delete channels, for instance — can’t the owner or an admin handle the rare case later?
- Bots: limit permissions! The same applies to bots — don’t give them more than they reasonably need. This is explored further below.
- Encourage 2FA for staff. Enabling 2FA on Discord accounts mitigates some attack vectors, though it’s not a silver bullet.
- Require 2FA for your staff. You can make 2FA mandatory: with Community mode enabled, staff must have 2FA to use Discord features Discord considers “dangerous” (banning members, managing channels, and so on). See Moderator 2FA.
- Use anti-nuke bots. They most likely can’t undo damage already done, but they can often prevent further damage. Check your bot’s configuration carefully, and make sure it has enough permissions.
- Verify role hierarchy. An anti-nuke bot’s Discord role should usually sit above all your staff. It can’t act against members whose highest role is equal to or above its own.
- Use different passwords, especially for email. Ideally no passwords are reused, but at the very least the email accounts tied to your accounts should have unique passwords — so you retain the ability to reset passwords, and attackers can’t misuse password resets to spread.
Bots and their permissions
Section titled “Bots and their permissions”These days it’s common to have several bots in a server, sometimes covering the same niche. Like your staff, bots should operate with the least privilege needed. (Does a music bot really need to manage roles and channels?)
Many bots ask for Administrator when you add them, even when they don’t need it. Limiting a bot’s permissions matters for limiting the attack surface, in case the bot is malicious, gets hacked, or has an exploitable flaw.
Why do they want Admin?
Section titled “Why do they want Admin?”Legitimate bots that ask for Administrator usually do so because of:
- Future-proofing — so new features that need new permissions work without re-prompting.
- Convenience — it’s easier than figuring out exactly which permissions are needed and keeping that list updated.
- It needs a lot of permissions — so it uses one Administrator permission instead of “overwhelming” you with a long list.
- It has many features — including ones you may not use. General-purpose bots often ask for Admin to cover basic moderation features, even if you moderate with another bot.
- Simpler programming — with all permissions, the bot needs less logic for handling missing ones.
How can I avoid giving Admin to bots?
Section titled “How can I avoid giving Admin to bots?”The easy way
Section titled “The easy way”Add the bot, then go to the Discord server role generated for it and change its permissions there: remove Administrator and add the ones you think it needs for the tasks you intend to use it for.
The technical way
Section titled “The technical way”A more involved option is to change the permissions before you add the bot. This works if you
add the bot via your browser: on Discord’s “add bot” prompt, you can edit the URL, which
contains the permissions the bot is requesting. Change it from Administrator (8) to another
number that grants the permissions of your choice.
A raid is a coordinated flood of accounts joining to disrupt or harass a server. If you run a relatively small server of friends or a niche community that doesn’t see much limelight, you generally don’t need to worry much — raiding small communities usually offers little “entertainment” or purpose. It’s not a rule, though: it can still happen because of your server’s theme, interpersonal conflicts, or other reasons.
How anti-raid bots work
Section titled “How anti-raid bots work”Anti-raid bots often have you configure a threshold of expected new joins — how many new members per 15 minutes or hour. Some operate automatically and self-adjust over time to what they see as the average, plus a buffer. Some operate per invite code rather than for the whole server (how many joins through a specific invite code).
When joins surpass the threshold, the anti-raid system kicks in. What happens is usually configurable, but you’d often set up something like:
- pause or delete invite code(s),
- quarantine the newly joined users (assigning a role that revokes most access),
- send alerts to staff.
Spamming / locking
Section titled “Spamming / locking”Some bots also treat message spamming as part of triggering raid mode. Since raids mostly do harm by sending messages, some bots offer channel locking too — typically enabling slow mode on pre-defined channels or categories, or turning off Send Messages outright. This usually works with logic like “how many messages per second are expected for this channel?”
Sometimes you enable raid mode manually instead — a command for the whole server or for specific channels/categories — where the bot only informs staff, who then decide whether to enable it.
Preventing / stopping raids
Section titled “Preventing / stopping raids”The one effective method of pausing a raid in progress is to pause all invites. This stops new users from joining while your staff handle things. You can also spend that time revoking users’ ability to create invites and revoking the existing invites the raiders used. Pausing will, of course, also stop legitimate members from joining.
As long as you want the server to stay open and accessible, there’s not much you can do to fully prevent raids. Beyond that, there are some passive measures:
-
Enable Discord Raid Protection. A native Discord feature, and an easy first line of defence. It requires suspicious users to complete a CAPTCHA, and during what Discord detects as a raid, all users must complete one.
Enable Activity Alerts. Another native Discord feature. It alerts you about activity Discord detects, including DM activity among your members — something not even bots can see. See Activity Alerts.
Increase the verification level. A native Discord feature. Members who join can’t send messages or DM members unless they meet the configured level. Medium is generally recommended; High is acceptable for some. See Verification Level.
-
Apply to join. If you want a hybrid of open-but-gated, this native Discord feature lets users request to join by filling out a form. Applications are highlighted in the server, staff can even start an “interview” with the user, and staff can accept or deny.
-
Use a join-gating bot. Join-gating mostly stops bot accounts rather than real raiders, who have no trouble completing a challenge. Typically a user completes a challenge (via DM or a dedicated channel) to get a role added or removed that “unlocks” the rest of the server, enforced through role and channel permissions.
Further raid mitigations
Section titled “Further raid mitigations”Enable Show Members in Channel List. Handy for moderators and admins — it pins the moderator member list to the top of your channel list, where you can browse recently joined and flagged members and act on them. See Members in Channel List.
Enable sensitive content filters. A native Discord feature that scans image-based media for content you normally don’t want posted (gore, nudity, and so on). Filtering messages from all members is recommended. See Content Sensitivity Filter.
-
Enable and configure Discord Auto-Mod. Discord has built-in Auto-Mod with some pre-configured tools. Enabling these is recommended, and you can add custom filters for words and phrases you want to block.
Suggested Auto-Mod configuration
Section titled “Suggested Auto-Mod configuration”For each of the rules below, set the same exceptions: add your announcement channel, rules channel, and internal staff channels/categories, plus your staff roles or other highly trusted roles.
- Block Mention Spam — a reasonable starting point is 10 unique mentions per message; block the message, and set an alert channel. See AutoMod: Mass Mention.
- Block Suspected Spam Content — block the message, and set an alert channel. See AutoMod: Suspected Spam Content.
- Block Commonly Flagged Words — this rule covers a lot of common words, so you may need to tune it over time or disable categories depending on your community. Severe Profanity in particular catches many common words. Block the message, and set an alert channel. See AutoMod: Block Commonly Flagged Words.