Discord server security checklist (2026)

Most Discord servers get compromised the same way every time: a scraped invite link, a compromised bot token, or an admin clicking a fake Steam trade link. None of it requires a sophisticated attacker — just a server that skipped basic hardening.

Run through this checklist once, and revisit it every time you add a new bot or grow past a few hundred members.

Access & permissions

• Admin role limited to people who actually need it — not everyone who helped set up the server
• 2FA requirement enabled at the server level for moderation actions
• Bot roles placed correctly in the role hierarchy — a compromised bot shouldn't outrank your moderators
• Channel-level permission overrides audited — check for accidental "@everyone can manage messages" leftovers

Bot audit

• Every bot in the server reviewed — remove anything nobody remembers adding
• Bot permissions scoped to what they actually need — a music bot doesn't need "Manage Roles"
• Bot tokens rotated if any developer with token access has left the project
• Webhook URLs audited — leaked webhooks let outsiders post as your server without a bot at all

Verification & onboarding

• New member verification gate in place (reaction role, captcha, or timed delay) before full server access
• Account age / avatar filtering to catch obvious throwaway accounts used in raids
• DM scam warning pinned or shown at first join — most scams start in DMs, not public channels

Scam & link detection

This is where most 2022-era moderation bots fall behind. Modern scam patterns that a basic word-filter bot will miss entirely:

• Fake Discord Nepotism/Nitro gift links using lookalike domains (dlscord.gift, discorcl.com)
• OCR-evading crypto scam images — text baked into an image instead of typed, to dodge word filters
• Compromised member accounts suddenly DMing links to friends ("token grabbers")
• Fake Steam trade / marketplace links impersonating known platforms

Catching these requires image-text scanning and real-time domain reputation checking — not a static banned-word list.

Incident response

• A documented process for what to do if a bot token leaks (regenerate immediately, audit recent bot actions)
• A designated raid response plan — lockdown slow mode, temporary invite pause, verification level bump
• Audit log review scheduled at least weekly, not just after something goes wrong

The bottom line

Discord security isn't about one big fix — it's a handful of small habits that compound. Permission hygiene, a real bot audit, and modern scam detection catch the overwhelming majority of what actually hits servers in 2026.