What does a Discord anti-nuke bot do?

It watches for destructive actions like mass channel and role deletes, mass bans and webhook spam, and stops the account or bot responsible before the server is wiped. Guardian also restores what was deleted.

Will Guardian punish my staff by mistake?

The server owner and trusted users are never punished by automatic protection. If Guardian acts on someone it should not have, /casework undo reverses it in one step.

Does anti-nuke need Administrator?

It needs high permissions to restore deleted channels and roles and to remove an attacker's roles. Keep Guardian's role near the top so it outranks the roles it protects.

How much does Guardian's anti-nuke cost?

It is included on every server. Premium is $1.99/month or $19.90/year and only changes the bot's name, avatar, banner and bio.

ESN Guardian › Guides

Checklist

Discord server security checklist

By ESN Systems, makers of ESN Guardian. Updated November 2, 2026.

Most Discord servers that get nuked or raided were not beaten by anything clever. A mod without 2FA got phished, a big role had a permission it never needed, or a forgotten bot still had Administrator. This checklist covers the settings that matter, in the order we would fix them.

Want a score instead? Take the 2-minute security check and get a letter grade with your fixes →

1. Accounts and 2FA

Turn on “Require 2FA for moderator actions.” Server Settings → Safety Setup. Only the server owner can change it, and no bot can do it for you. It stops a stolen password alone from being enough to ban members or delete channels.
Ask every staff member to use an authenticator app, not just SMS, and to never scan QR codes sent in DMs. QR login scams are one of the most common ways staff accounts are taken over.
Know who your owner account is. The owner account can't be limited by any bot or role, so it needs the strongest login on the server.

2. Roles and permissions

Strip dangerous permissions from @everyone. Administrator, Manage Server, Manage Roles, Manage Channels, Ban, Kick, Manage Webhooks and Mention @everyone should all be off on the @everyone role.
Check channel overrides too. A single channel where @everyone has Manage Webhooks or Mention @everyone is enough for a spam raid. Open each channel's Permissions tab and look at the @everyone row.
Keep Administrator to one to three people. Give mods the specific permissions they use (Timeout, Manage Messages) instead of Administrator.
Keep big roles harmless. Roles that lots of members hold (Members, Level 10, Booster) should never carry Ban, Kick, Manage Roles or Manage Channels.
Order your roles. Staff roles above member roles, and your security bot's role above everything it has to protect. A bot can't act on a role above its own.

3. Bots and webhooks

Review every bot's permissions. Server Settings → Integrations. Most bots don't need Administrator. If a bot's token leaks, whatever it can do, an attacker can do.
Remove bots you no longer use. Unused bots keep their permissions forever.
Delete old webhooks. Server Settings → Integrations → Webhooks. A webhook keeps working after the person who made it leaves, and anyone with its URL can post through it.
Limit who can add bots. Adding a bot needs Manage Server. Keep that permission to a small, trusted group.

4. Joins and raids

Set the verification level to Medium or higher. Server Settings → Safety Setup. New accounts then have to wait before they can type.
Turn on the explicit image filter for all members. Raids often open with shock images.
Put new members behind a gate. A captcha or verify button stops most raid bots before they can see your channels.
Plan a lockdown. Decide in advance who can pause invites and lock channels, and how. In a raid you won't have time to work it out.
Set default notifications to “Only @mentions” on bigger servers, so a spam wave doesn't ping everyone's phone.

5. Recovery

Keep a backup of your structure. Channels, roles and their permissions take hours to rebuild by hand. Refresh the backup after big changes.
Have a private log channel. Bans, kicks, deletes and bot alerts in one staff-only place, so after an incident you can see exactly who did what.
Write down the emergency steps. Pin a short plan in your staff channel: who to contact, how to lock down, how to restore. If it ever happens, read what to do when your server gets nuked.

ESN Guardian checks most of this list for you. Every protection is included on every server.

Add Guardian to Discord Grade your server first

Where ESN Guardian helps

You can do everything above by hand, and the 2FA setting can only be done by the owner. Guardian covers the parts that need watching all the time:

/audit run grades your server from A+ to F on the checks above: 2FA for mods, verification level, media filter, dangerous @everyone permissions and channel overrides, crowded dangerous roles, bots with dangerous permissions, unverified or recently added bots, and webhooks.
/audit fix applies the fixes you pick, and /audit undo reverts them.
Anti-nuke stops an account or bot that starts mass deleting, banning or creating webhooks, and /rewind puts back what was changed.
Anti-raid and verification catch join waves, quarantine them and put new members behind a captcha (/captcha, /gate).
/safemode lockdown locks the server in one command when you need it.

Once Guardian is in your server, your real grade also shows on the dashboard.

Questions

What is the most important Discord security setting?

Requiring 2FA for moderator actions. Most nukes start with a staff account that was phished, and 2FA stops a stolen password from being enough. Only the server owner can switch it on.

How many admins should a Discord server have?

As few as possible, usually one to three people you would trust with the whole server. Give moderators the specific permissions they need instead of Administrator.

Should bots have Administrator?

Only if they truly need it. A security bot needs high permissions to restore what gets deleted, but most other bots work fine with a few specific permissions. A leaked token for a bot with Administrator can wipe a server.

How can I check my server's security quickly?

Take the quick 2-minute check at guardian.esnoffical.com/grade for a letter grade and a list of fixes, or add ESN Guardian and run /audit run for a grade based on your server's real settings.

Running your own Discord bot? ESN Hosting runs Discord bots 24/7, from $0.50/mo →