How to secure a Discord server

The four ways a Discord server gets damaged

It helps to separate the threats, because they call for different answers. A raid is a mass, coordinated arrival of accounts meant to flood your channels. A scam is a link or DM aimed at your members, not your server. A takeover comes from a compromised staff account or a permission granted too widely. A leak comes from a private channel whose permissions are not what you think they are.

The last three are far more common than the first, and far less spectacular. Which is exactly why they get neglected.

1. Close the door: verification and invites

Discord offers a verification level (Server Settings → Moderation) that gates the right to post. “Medium” requires the account to be at least five minutes old; “High” requires ten minutes of server membership. Those ten minutes are enough to make a raid expensive.

Invites are the other door. A permanent invite posted on a forum once keeps working years later, and you will never know where arrivals come from.

• Remove Create Invite from @everyone: only trusted roles should be able to invite.
• Prefer invites limited in time and uses, and keep a single permanent invite for your website.
• Turn on two-factor requirement for moderation actions (Server Settings → Safety Setup): a stolen moderator account then cannot ban.
• Review the bots present and remove those you no longer use — an abandoned bot is a live permission with nobody watching it.

2. Limit what a compromised account can do

Assume a staff account will eventually be compromised. The question is not preventing it — that is outside your control — but limiting the damage.

The Administrator permission is the single point of failure on most servers. It bypasses every channel restriction and lets someone grant themselves any right. A well-set server has one or two administrator accounts, and no bot that does not genuinely need it.

Manage Roles deserves the same suspicion: it allows escalation. Whoever gets it can give themselves the rest.

1. Open each role and note who carries Administrator, Manage Roles, Manage Channels and Manage Server.
2. For each, ask what would break if you removed it. If the answer is “nothing”, remove it.
3. Check that staff roles sit ABOVE member roles in the list, and bot roles above whatever they must manage.
4. Audit channel-by-channel permission overrides: that is where leaks hide, because they are invisible from the roles page.

3. Protect your members from scams

The classic Discord scam does not target your server: it uses it as a directory. An account joins, DMs fifty members with a “free Nitro” or “game test” link, and leaves. Your members lose their accounts, and it is your server they will hold responsible.

Two settings cut this risk sharply, and both are free. Discord’s explicit media filter, and above all blocking shortened links in AutoMod: a scam almost always goes through a URL shortener, because the real address would be recognised.

• Block URL shorteners and file-sharing domains in AutoMod.
• Deny invites to other servers for @everyone: it is the main recruitment channel for scams.
• Pin a message reminding people that neither you nor Discord will ever ask for a password or a one-time code.
• Give people an easy way to report a suspicious DM — without one, nobody will tell you and the scam will run for weeks.

4. Prepare the crisis mode BEFORE the crisis

A raid lasts ten minutes. If your plan is to think while it happens, you have already lost. The plan must exist beforehand, be written down, and be executable by whichever moderator happens to be online.

In practice: a “verified” role that legitimate members already hold, and a switch that removes posting rights from @everyone in public channels. Regulars keep talking, disposable accounts can do nothing, and you clean up afterwards at your own pace.

Test the switch once, outside a crisis. A plan never rehearsed always fails on its first real run — usually because one channel had a permission override everyone had forgotten.

How Kuratos helps

Kuratos’ Auto-moderation module picks up where the native AutoMod stops: repeated-message spam detection, mention caps, link filtering by domain, and automatic graduated sanctions rather than a bare message deletion.

The Welcome module can require a captcha on arrival: an automated account does not get past it, and your public channels stay closed to newcomers until it is cleared. It is the single most effective anti-raid measure, because it acts before the first message.

The Reports module gives members a button to escalate a suspicious DM, with a record for the team — turning a rumour into something you can act on.