How to Protect Your Discord Server from Raids and Nukes

A raid is a wave of accounts or bots joining at once to disrupt a server. A nuke is an attack by an account with powerful permissions that deletes channels and roles, bans members or floods the server. This checklist follows Discord help center guidance as of October 2026. Menu names can change.

12 steps to prevent it

  1. Turn on 2FA, then require it for moderation. Enable two-factor authentication on your own account first. Then open Server Settings, Safety Setup, Moderation and switch on Require 2FA for moderation, so a stolen staff password cannot be used for admin actions.
  2. Set a sensible verification level. Discord suggests Low, which needs a verified email, as a baseline for public servers. Raise it temporarily while you are under attack.
  3. Enable Raid Protection and CAPTCHA. In Safety Setup, turn on Raid Protection alerts and the CAPTCHA options so Discord can warn you about suspicious waves of joins.
  4. Hand out dangerous permissions sparingly. Administrator, Manage Server, Manage Roles, Manage Channels and Manage Webhooks can all be used to damage a server. Keep them to a few trusted roles and people.
  5. Fix the role hierarchy. Staff roles belong above member roles, and a bot can only act on members below its own top role. Use View Server as Role to check what each role can really see and do.
  6. Give bots the least privilege. Avoid Administrator for bots. Grant only the permissions a bot documents, remove bots you no longer use, and review the list every month.
  7. Clean up invites. Review the invite links in Server Settings and delete the ones you no longer need.
  8. Use AutoMod. Turn on AutoMod rules to block spam, mention floods and unwanted keywords. If your server uses Community features, add a rules-screening step for new members.
  9. Keep a mod-log channel. Logs of joins, deletions and role changes make an attack traceable. Check the audit log regularly.
  10. Review webhooks. Webhooks can post into channels without being a member. Delete any you do not recognize and limit who has Manage Webhooks.
  11. Add an automated anti-raid and anti-nuke layer. A security bot reacts in seconds when many accounts join at once or an account starts deleting channels and roles. PixelMint uses GlassFrame Protocol for this.
  12. Audit every month. Review role permissions, staff lists, bots and invites once a month, and again after any staff change.

For the automated layer, see PixelMint anti-raid and anti-nuke protection.

What to do during a raid

  1. Pause invites. Use Server Settings, Invites, Pause Invites, or Security Actions to pause invites and DMs between non-friend members for a set time.
  2. Raise the verification level. Make it harder for fresh accounts to talk while you clean up.
  3. Remove the raiders and spam. Ban or kick the accounts involved and delete their messages. A security bot can do this in bulk.
  4. Check the audit log. Look for new bots, new webhooks, role changes and channel deletions that happened during the attack.
  5. Report the raid to Discord. Open the server menu and choose Report Raid.
  6. Reset what may be compromised. Remove unknown bots and webhooks, reset permissions, and reset the token of any bot that may have been exposed.

Sources and further reading