How to protect your Discord server from raids

What a raid is and why it matters

A raid is a coordinated attack on a server. The most common kind is dozens of freshly created accounts joining at once to flood the channels with spam, insults or scam links. There's a more serious variant, the nuke: someone with permissions (a careless admin, a stolen account or a malicious bot) starts deleting channels and roles and banning members.

Both have something in common: they happen very fast and almost always when your staff isn't looking. That's why protection has to be automatic and ready before the attack, not after.

This guide follows the logical order: prepare beforehand, set up the defences, know what to do during an attack and how to recover afterwards.

Before the attack: the basics nobody checks

Before touching any bot, check three things in Discord itself:

• Verification level of the server set to "Medium" or higher, so accounts need a verified email and a few minutes on Discord before they can type.
• Two-factor authentication required for moderators. If an admin account without 2FA is stolen, the attacker has the keys.
• Dangerous permissions handed out carefully. Administrator, Manage Server, Manage Roles and Ban Members should belong to very few people.

UltimateBot helps with the last one: in the dashboard, the Permission audit section scans your roles and flags in red the ones with too many permissions, including @everyone. With one click you see the risk and how to fix it.

The most important step of this phase is to create your first backup. Type /backup create in any channel. If something goes wrong later, that backup is your way back.

Set up the automatic defences

Open the web dashboard and go to Server protection. All the defences live there; if you don't want to think too much, use the recommended values and adjust later.

1. Anti-raid: detects many joins within a few seconds. A good starting point is 10 joins in 10 seconds. You can also turn it on from Discord with /config anti_raid.
2. Anti-spam: automatically times out anyone repeating messages. With 5 messages in 5 seconds and a 10-minute timeout you'll stop almost all spam without bothering normal members.
3. Anti-links: blocks links in the channels you choose, with a whitelist for trusted domains like YouTube or your website.
4. Verification: asks new members for a simple captcha before giving them access. It stops raid bots almost completely.
5. Anti-nuke: watches series of deletions and bans. If someone goes over the threshold, they get the punishment you set with /config punishment. Add your trusted team with /antinuke_whitelist_add.

With Premium you get two more layers: the Account age filter, which times out accounts only a few days old, and Advanced automod, which catches scam links and disguised insults.

During the attack: what to do

If you see the server filling up with spam or channels disappearing, don't try to delete messages one by one. Follow this order:

1. Lock the server with /lockdown. Every channel becomes read-only for regular members and the attack loses its megaphone. UltimateBot saves a safety backup first.
2. Find the source. In the logs section of the dashboard, or with /auditlog, you'll see who did what in the last few minutes.
3. Punish the responsible accounts with /ban or, if there are many, with /massban (Premium), which also makes a backup first.
4. Warn your community in an announcements channel so nobody clicks the attack's links.

If anti-nuke was already on, the attacker has probably already been punished and you'll get a report in the logs channel.

Afterwards: recover what was lost

Once the attack is over, it's time to get back to normal:

• Compare the server with your latest backup using /backup diff. You'll see which channels and roles are missing and which permissions changed.
• Restore only what you need with /backup restore_partial (Premium): only roles, only channels or a single channel, without touching what's fine.
• If you have Premium and automatic recovery turned on in Backup protection, the bot will already have recreated the channels and roles deleted during the attack. You can also force it with /backup recover.
• Lift the lockdown with /unlock once everything is in order.

Finally, look at how the attack got in. If it was a stolen staff account, change its permissions and ask that person to turn on two-factor authentication.

Checklist

Go through this list once a month and you'll be better protected than most servers:

• There's at least one recent backup (less than 7 days old) and scheduled backups are on.
• Anti-raid, anti-spam and verification are on.
• Anti-nuke is on and the whitelist only includes trusted people.
• Nobody has Administrator without needing it and @everyone has no dangerous permissions.
• Moderators have two-factor authentication turned on.
• The bot's role is above the roles it needs to manage.
• The logs channel is set up and someone reads it.

The dashboard's Health Score does most of this check for you and tells you what to fix first.