Discord server got nuked? What to do right now

#discord #security #tutorial #community

Originally published at guardian.esnoffical.com/guardian/discord-server-nuked.

By ESN Systems, makers of ESN Guardian. Updated November 2, 2026.

Channels gone, roles deleted, members banned. It feels like the server is over, but most of it can be stopped and a lot of it can be rebuilt. Work through these steps in order. The first ten minutes matter most.

1. Stop the attacker (first 2 minutes)

Find who is doing it. Server Settings → Audit Log shows who deleted channels, banned members or created webhooks.
Remove their roles or ban them. If it's a person, take every role away from them. If it's a bot, kick it or remove its role.
Can't touch them? You can only act on members below your highest role. If the attacker outranks everyone, only the server owner can stop them.
Delete new webhooks. Server Settings → Integrations → Webhooks. Spam webhooks keep posting even after the attacker is gone.

2. Lock things down

Pause invites so the mess doesn't spread to people joining.
Lock public channels (deny Send Messages for @everyone) while you clean up.
Check @everyone's permissions. Attackers often give @everyone Administrator or Mention @everyone on the way out. Turn them off.

3. Secure the accounts

If a staff account did it, it was probably phished. Tell them to change their password, log out of all devices and turn on 2FA with an authenticator app.
If a bot did it, its token may have leaked. Tell the bot's owner to reset the token, and don't add it back until they have.
Turn on “Require 2FA for moderator actions” (Server Settings → Safety Setup, owner only) before you give anyone their roles back.

4. Rebuild

Unban members who were mass-banned. The audit log and the bans list show who was banned and when.
Recreate channels and roles from a backup if you have one. Without one, start with the channels people need most and rebuild permissions carefully, so you don't recreate the hole that let the attacker in.
Tell your members what happened, briefly, and warn them about any scam links that were posted.

5. Report it

Report the attacking accounts to Discord through their support site (dis.gd/report) with message links and screenshots. Keep your audit log screenshots. They show exactly what was done and by whom.

6. Make sure it can't happen again

Go through the Discord server security checklist, or take the 2-minute security check for a grade and a list of fixes. The usual causes are a mod without 2FA, too many Administrators, a widely held role with dangerous permissions, and bots with more power than they need.

Next time, let a bot stop it in seconds and put everything back.

Add Guardian to Discord Grade your server first

How ESN Guardian handles a nuke

Stops it automatically. Anti-nuke tracks deletes, bans, kicks, webhook creation and bot adds per account. When an account crosses a limit, Guardian strips its dangerous roles and logs who did what.
Puts things back. Guardian keeps snapshots of your server's structure, so /rewind recreates deleted channels and roles with their permissions.
Catches hijacked bots. Sentry steps in when a trusted bot suddenly floods channels or mass-pings, even if it's on your trust list.
Locks down in one command. /safemode lockdown, or a panic PIN for trusted staff when the owner is offline.

Guardian can't undo a nuke that happened before it was in your server, because it needs a snapshot from before the attack. Add it now so the next one is covered.

Questions

Can a nuked Discord server be restored?
Partly by hand, and fully if you had a backup or snapshot from before the attack. Bans can be reversed from the bans list, and channels and roles can be recreated. A security bot with snapshots, like ESN Guardian, can recreate them automatically.

Who can stop a nuker who has a higher role than me?
Only someone above them in the role list, or the server owner. That is why a security bot's role should sit at the top: it can then act on any role below it.

How do servers get nuked?
Usually from the inside: a staff account that was phished, a mod who turned, or a bot whose token leaked. Requiring 2FA for moderators and keeping Administrator to very few people prevents most of it.

Can ESN Guardian undo a nuke that already happened?
Only if Guardian was already in the server and had a snapshot from before the attack. It can't restore what it never saw.

Running your own Discord bot? ESN Hosting runs Discord bots 24/7, from $0.50/mo →

DEV Community