Guide · November 6, 2026 · 4 min read
Your Discord server is under attack: what to do right now
This guide is meant to be read during the attack. It starts with the first five minutes, then explains how to tell a raid from a nuke, find the source and restore the server.
Contents
The first five minutes
Do these in order, without trying to understand yet:
- Stop new joins. Server Settings, Invites: pause invites.
- Remove the Administrator permission from every role but yours if channels or roles are disappearing.
- Remove the culprit. If an account or bot is destroying things, kick it or take away its roles.
- Raise the verification level to High, under Moderation.
- Stop @everyone from writing in public channels.
- Do not answer the attackers, and keep the staff focused.
Raid or nuke: what is happening to you?
A Discord raid is the coordinated arrival of many accounts that flood a server from outside. A nuke is its destruction from within, by an account or bot that already has rights. The first gets cleaned up, the second gets rebuilt.
| What you see | Most likely | Priority |
|---|---|---|
| Dozens of new accounts, identical messages | Raid | Stop joins, bulk ban |
| Channels or roles deleted, mass bans | Nuke | Strip the culprit's rights |
| A known member posts links everywhere | Hacked account | Remove their roles, warn them elsewhere |
| A bot posts @everyone or changes permissions | Compromised bot | Kick the bot, then clear its integration role |
| A webhook posting non-stop | Stolen webhook | Delete the webhook under Integrations |
Find the source in the audit log
Open Server Settings, then Audit Log. Filter by action: channel deletion, ban, bot added, role update. The first event in the series shows the real author. Also check who received a role just before, and which bot has just been added.
For an outside attack, look for the invite used under Invites, then delete it if it leaked.
If a staff account is compromised
- Warn the member through another channel: their Discord account can no longer be trusted.
- They change their password, which invalidates their sessions, then re-enable 2FA.
- They remove unknown apps under Authorized Apps.
- If the server owner is affected, contact Discord support without delay.
Restore the server
- Bans. Lift those of your real members. The audit log gives you the list.
- Raiders. Sort the member list by join date to ban the wave in one go.
- Channels and roles. Discord has no native way to restore the structure: without a backup, you rebuild by hand.
- Permissions. Go through each role, especially those recreated after the attack.
- Webhooks and bots. Delete whatever you do not recognize.
If OriusBot was already there, its server map rebuilds channels and roles after a nuke, and
/dashboard/carte lets you do it manually. It only works if the bot had mapped the server before
the attack: on an already destroyed server, it has nothing to restore.
Report it to Discord
Use the official form with account IDs, times and screenshots. Collect them before banning: a deleted account becomes hard to trace.
Prevent the next attack
- Fewer administrators. Replace the Administrator permission with only the rights needed.
- Require 2FA for moderators, under Moderation.
- Review every bot: each one is a way in if its token leaks.
- Install automatic detection: see our anti-raid bot comparison.
- Work through the full checklist once things are calm.
Frequently asked questions
What is a raid on Discord?
A raid is the coordinated arrival of many accounts, often automated, that flood a server with messages, mentions or shocking content. The aim is to make it unusable or to drive its members away.
What does nuked mean on Discord?
A nuke is the rapid destruction of a server: channels and roles deleted, mass bans. It comes from an account or bot that already has high permissions, often after a stolen account or token.
Can Discord restore a nuked server?
Do not count on it. Discord can act against the accounts involved, but it offers no button to restore the structure. Only a backup made before the attack, or a bot that had mapped the server, allows a fast recovery.
How do I turn off Discord's raid protection?
If Discord paused joins, open the server's security actions from the member list or settings, then lift the pause. Only do it once the attack is over.
My bot did nothing during the raid: why?
The usual causes are a bot role placed too low, a missing permission or protection that was turned off. Without audit log access, no anti-nuke can identify the author. Our bot not responding guide lists the checks.
Read next : Protecting your server from raids, Anti-nuke: protecting your server, Security checklist.