UNITEDBuild a Secure Discord Server with United
Security starts with Discord permissions and role order. Automatic punishment should be the final layer, after United can read the action, identify the actor, and act on the target.
1. Establish the permission baseline
Open Permission Health in the server dashboard. United needs View Audit Log to attribute destructive server changes. Manage Messages supports spam deletion and cleanup. Moderate Members supports timeouts. Kick Members and Ban Members are required only when those outcomes are configured. Manage Roles and Manage Channels are needed for role stripping, jail or mute workflows, lockdown, and structural repair.
A permission check can be green while an action still fails because Discord role hierarchy is separate. Move United's highest role above every staff or member role it may need to manage. Administrator does not let a bot act on a member whose highest role is equal to or above the bot.
2. Choose one dependable log destination
Set Bot Logs in Dashboard → Setup → Logs or run ,logs #bot-logs. Test that United can view the channel, send messages, embed links, and attach transcript files. Do not create eight specialized log channels before confirming the default works. Split a log type only when a staff workflow genuinely needs it.
3. Enable protections in a controlled order
| Protection | Primary job | Safe first response |
|---|---|---|
| Anti-Spam | Repeated messages, fast floods, duplicate content, mass mentions | Delete or timeout |
| Link Limit | Repeated Discord invite links and warning escalation | Delete or timeout |
| Anti-Raid | Mass joins, new accounts, suspicious bots, account-age rules | Log or kick while tuning |
| Anti-Nuke | Destructive server changes attributed through audit logs | Strip dangerous permissions |
| Scam Trap | Immediate response when a normal member types in a marked decoy channel | Timeout or kick |
Use Protection Setup for the baseline, then open each module and review its thresholds, time window, ignored areas, trusted roles, and punishment. Avoid starting with permanent bans everywhere. A timeout or permission strip gives staff a safer tuning period while still stopping active abuse.
4. Treat whitelists as security credentials
A whitelisted member or trusted protection role bypasses multiple automatic systems. Use ,antinuke_whitelist @member for one person or bot. Use the trusted-role command only for a narrow team that should bypass all applicable protection checks. Never whitelist the general member role, a cosmetic role, or a staff role that is granted automatically.
Review the whitelist after staff changes. Removing someone's Discord staff role does not automatically communicate whether their separate United whitelist should remain.
5. Understand attribution before enforcement
Discord sends an event when a channel, role, webhook, ban, or member state changes. United then checks the relevant audit-log entry near that event. Audit logs can arrive slightly after the gateway event, so attribution uses a bounded lookup rather than guessing. If Discord does not provide a reliable actor, the event may be logged for review without punishing an unknown person.
6. Configure spam around normal conversation
Ignored channels and roles should represent places where high-volume behavior is expected, such as a counting channel or a trusted integration role. An ignored anti-spam channel bypasses the related caps, emoji, duplicate, and speed checks for that area. Anti-Nuke does not need ignored channels because destructive server actions are attributed to an actor, not a chat location.
For @everyone and @here, select a threshold and rolling window that catches repeated announcements without punishing one legitimate post. Server owners remain exempt. Other administrators are evaluated unless whitelisted.
7. Prepare for the incident before it happens
Keep United online, verify Bot Logs, and allow automatic server snapshots to establish a known structure. When an incident appears, read the actor, action, result, and recovery comparison before pressing a button. Lockdown limits channel messaging. Strip Roles removes dangerous actor permissions. Restore recreates missing snapshot items and repairs altered permission overwrites without deleting later unrelated additions.
Final validation checklist
- United can view the audit log and send to Bot Logs.
- United's role is above every role it may manage or punish.
- Every enabled punishment matches a Discord permission United actually has.
- Trusted members and roles are intentionally narrow.
- Ignored channels are limited to real high-volume exceptions.
- Account-age requirements fit the server's audience.
- At least two trusted staff members know where Incident Mode and logs are located.