Discord Server Security Checklist

Most servers are lost from the inside. One account had more permissions than it needed, and then stopped being controlled by the person it belonged to: a borrowed phone, a reused password, a moderator who installed something, an admin who left badly. The channels go, or the roles go, or everyone gets banned. Rebuilding the structure costs an evening. Telling three thousand people where you went is the part with no fix.

Four things help. Each one has a gap big enough to plan around.

Permissions

Administrator bypasses every channel overwrite you have ever set. One account with it is one account away from an empty server, and it gets granted constantly because it is faster than reading the permission list.

Grant the specific permissions instead, then go and audit which roles can manage channels, manage roles, and ban. Those three do nearly all the damage, and they collect on roles created years ago for something unrelated. Restoring a nuked server covers the cleanup order when this has already happened.

2FA for moderator actions

Server Settings has a switch that requires two-factor authentication for moderator actions. Turn it on. Only the owner can, and the owner has to have 2FA on their own account first, which is the actual reason most servers do not have it.

With it on, anyone using Kick, Ban, Manage Channels or Manage Server needs 2FA on their account before Discord will let the action through. It does not remove their role or punish them. The action just fails until they set it up.

The gap is bots. Discord checks the 2FA status of the account that owns the bot, not of whoever gave the bot the order, so a moderator without 2FA can still ban people through a bot that is already in the server. Discord has been asked about this and treats it as intended. Adding a bot in the first place does need Manage Server from an account that has 2FA, so the requirement covers the loud version of this and not the quiet one.

Nothing here helps against a moderator who was never compromised and simply decided to do it. 2FA proves the person at the keyboard is the person you gave the role to.

Ownership moves only when the owner moves it, so the owner account is the one nobody can replace. Secure that one first.

More than one restore point

A backup is worth having. Several are worth much more, because the state you want back is rarely the most recent one. It is usually the one from before a restructure nobody noticed going wrong, or before the permission change three weeks ago that quietly locked half the server out of a category.

If you keep a single rolling snapshot, the backup you take after noticing something is wrong overwrites the last good state you had.

/backup interval on 24h

Free keeps one rolling snapshot per server and Premium up to eight, each overwriting the last. Manual backups sit on a separate and much larger allowance, 15 on the free plan and up to 250, so taking one by hand before any big change costs you nothing. What comes back is channels, roles, permissions, settings and message history on Premium. What does not come back is the people.

Somewhere to be found off Discord

Almost nobody has this, and it is the only one of the four that helps with losing the people rather than the server.

If the server is gone, a new invite link is trivial to create and impossible to distribute: every announcement channel and every DM thread you would have posted it in went with the server. So you want a single address that outlives it and that your members have already seen. A website, an X or Bluesky account, a subreddit, a mailing list, a second small Discord that exists for nothing else. Which one you pick barely matters. Whether people have already seen it does, because a recovery page nobody has ever visited is not reachable either.

A vanity URL is not this. It needs Level 3, which is fourteen boosts, and it lapses when the boosts do, so it is a convenience rather than an anchor.

Watch who holds it. If the domain, the social account and the server all sit with the same person, the single point of failure has moved rather than gone.

Where member recovery fits

There are services that re-add members after a server is lost, by asking every member to pass an OAuth2 screen when they join and replaying those authorizations later. It works, with limits: it reaches only people who authorized before the incident, Discord refuses the join for anyone currently banned, and the standing permission lives with a third party afterwards. Most of them also run on a Discord application registered in your name rather than the vendor’s.

Xenon does not do it. The full trade is set out against RestoreCord and VaultCord.

Add Xenon and run /backup interval on 24h, then go and write the recovery address somewhere your members will see it while nothing is wrong. More on what backups cover.