What does a Discord anti-nuke bot do?

It watches for destructive actions like mass channel and role deletes, mass bans and webhook spam, and stops the account or bot responsible before the server is wiped. Guardian also restores what was deleted.

Will Guardian punish my staff by mistake?

The server owner and trusted users are never punished by automatic protection. If Guardian acts on someone it should not have, /casework undo reverses it in one step.

Does anti-nuke need Administrator?

It needs high permissions to restore deleted channels and roles and to remove an attacker's roles. Keep Guardian's role near the top so it outranks the roles it protects.

How much does Guardian's anti-nuke cost?

It is included on every server. Premium is $1.99/month or $19.90/year and only changes the bot's name, avatar, banner and bio.

ESN Guardian › Guides

Recovery

Discord server got nuked? What to do right now

By ESN Systems, makers of ESN Guardian. Updated November 2, 2026.

Channels gone, roles deleted, members banned. It feels like the server is over, but most of it can be stopped and a lot of it can be rebuilt. Work through these steps in order. The first ten minutes matter most. Want it on paper? Jump to the printable checklist.

1. Stop the attacker (first 2 minutes)

Find who is doing it. Server Settings → Audit Log shows who deleted channels, banned members or created webhooks.
Remove their roles or ban them. If it's a person, take every role away from them. If it's a bot, kick it or remove its role.
Can't touch them? You can only act on members below your highest role. If the attacker outranks everyone, only the server owner can stop them.
Delete new webhooks. Server Settings → Integrations → Webhooks. Spam webhooks keep posting even after the attacker is gone.

2. Lock things down

Pause invites so the mess doesn't spread to people joining.
Lock public channels (deny Send Messages for @everyone) while you clean up.
Check @everyone's permissions. Attackers often give @everyone Administrator or Mention @everyone on the way out. Turn them off.

3. Secure the accounts

If a staff account did it, it was probably phished. Tell them to change their password, log out of all devices and turn on 2FA with an authenticator app.
If a bot did it, its token may have leaked. Tell the bot's owner to reset the token, and don't add it back until they have.
Turn on “Require 2FA for moderator actions” (Server Settings → Safety Setup, owner only) before you give anyone their roles back.

4. Rebuild

Unban members who were mass-banned. The audit log and the bans list show who was banned and when.
Recreate channels and roles from a backup if you have one. Without one, start with the channels people need most and rebuild permissions carefully, so you don't recreate the hole that let the attacker in.
Tell your members what happened, briefly, and warn them about any scam links that were posted.

5. Report it

Report the attacking accounts to Discord through their support site (dis.gd/report) with message links and screenshots. Keep your audit log screenshots. They show exactly what was done and by whom.

6. Make sure it can't happen again

Go through the Discord server security checklist, or take the 2-minute security check for a grade and a list of fixes. The usual causes are a mod without 2FA, too many Administrators, a widely held role with dangerous permissions, and bots with more power than they need.

Printable raid & nuke response checklist

Print this and pin it in your staff channel, or keep it open during an incident. Tick each line as you go.

First 2 minutes: stop it

Open Server Settings → Audit Log and note who is deleting, banning or creating webhooks.
Remove every role from the attacker, or kick the bot doing it.
If the attacker outranks everyone, get the server owner online now.
Delete new webhooks (Server Settings → Integrations → Webhooks).

Next 5 minutes: lock down

Pause invites.
Deny Send Messages for @everyone in public channels.
Remove Administrator, Mention @everyone and other dangerous permissions from @everyone.
Warn members not to click links posted during the attack.

Secure accounts

Compromised staff: change password, log out of all devices, turn on 2FA.
Compromised bot: owner resets the token before it is added back.
Owner turns on “Require 2FA for moderator actions” (Safety Setup).

Rebuild

Unban members who were mass-banned (check the bans list and audit log).
Restore channels and roles from a backup, or rebuild the most-used ones first.
Re-check permissions on every rebuilt role before giving it out.
Post a short note to members about what happened.

Afterwards

Report the attacker at dis.gd/report with message links and screenshots.
Keep screenshots of the audit log.
Take the security check at guardian.esnoffical.com/grade and fix the top items.
Add an anti-nuke bot with backups so next time it is stopped and undone automatically.

From guardian.esnoffical.com/guardian/discord-server-nuked · ESN Guardian

Next time, let a bot stop it in seconds and put everything back.

Add Guardian to Discord Grade your server first

How ESN Guardian handles a nuke

Stops it automatically. Anti-nuke tracks deletes, bans, kicks, webhook creation and bot adds per account. When an account crosses a limit, Guardian strips its dangerous roles and logs who did what.
Puts things back. Guardian keeps snapshots of your server's structure, so /rewind recreates deleted channels and roles with their permissions.
Catches hijacked bots. Sentry steps in when a trusted bot suddenly floods channels or mass-pings, even if it's on your trust list.
Locks down in one command. /safemode lockdown, or a panic PIN for trusted staff when the owner is offline.

Guardian can't undo a nuke that happened before it was in your server, because it needs a snapshot from before the attack. Add it now so the next one is covered.

Questions

Can a nuked Discord server be restored?

Partly by hand, and fully if you had a backup or snapshot from before the attack. Bans can be reversed from the bans list, and channels and roles can be recreated. A security bot with snapshots, like ESN Guardian, can recreate them automatically.

Who can stop a nuker who has a higher role than me?

Only someone above them in the role list, or the server owner. That is why a security bot's role should sit at the top: it can then act on any role below it.

How do servers get nuked?

Usually from the inside: a staff account that was phished, a mod who turned, or a bot whose token leaked. Requiring 2FA for moderators and keeping Administrator to very few people prevents most of it.

Can ESN Guardian undo a nuke that already happened?

Only if Guardian was already in the server and had a snapshot from before the attack. It can't restore what it never saw.

Running your own Discord bot? ESN Hosting runs Discord bots 24/7, from $0.50/mo →