Scan your Discord server: a 10-minute security checklist

2 min readUpdated Nov 4, 2026

Go through 25 quick checks to find the gaps raiders, hacked admins and scam links use. Tick the boxes as you go, then let ESN Guardian watch the server for you.

How to use this page #

This is a self-check you do yourself in Discord, in about 10 minutes. Tick each box when it's true for your server. Nothing is sent anywhere, and the boxes reset when you leave the page. For an automatic grade of your settings, use the ESN Guardian server grade.

1. Owner and staff accounts #

The owner account has two-factor authentication (2FA) on.
Server Settings → Safety Setup → Require 2FA for moderator actions is on.
Only people you really trust have Administrator.
Staff roles have only the permissions they need (no Administrator "just in case").
You know which staff to call if the owner is offline.

2. Roles and permissions #

@everyone can't mention @everyone/@here or manage anything.
@everyone has no "Manage Webhooks", "Manage Roles" or "Manage Channels".
Bot roles sit below your staff roles, so a hacked bot can't touch staff.
Dangerous permissions (Ban, Kick, Manage Roles) are only on staff roles.
Old staff who left have had their roles removed.

3. Joins and raids #

Verification Level is at least Medium (account older than 5 minutes).
New members verify before they can see the whole server (a rules screen or a verify button).
You have a plan to pause joins fast during a raid.
Invite links in public places have an expiry or a use limit where possible.

4. Bots and webhooks #

Every bot in the server is one you know and still use. Remove the rest.
No bot has Administrator unless it truly needs it.
You checked Server Settings → Integrations → Webhooks and deleted ones you don't recognise.
Webhook URLs were never posted in public channels or screenshots.

5. Scams and links #

AutoMod (Server Settings → Safety Setup → AutoMod) blocks spam and mention spam.
Members are told staff never ask for passwords, codes or QR scans.
You have a way to stop fake "free Nitro" and steam-gift links.
A log channel records deletes, bans and role changes.

6. If something goes wrong #

You have a recent copy of your channels and roles, or a bot that can restore them.
Staff know how to report a hacked account to Discord.
You know how to lock the server to read-only in one step.

Let ESN Guardian watch it for you #

A checklist is a snapshot. ESN Guardian is a Discord security bot that watches all the time: anti-nuke limits with /rewind to put back deleted channels and roles, anti-raid join-wave detection, captcha verification, one-tap /safemode lockdowns and scam-image blocking. Every feature is included on every server.

Add ESN Guardian to Discord →

Then run the server grade and read Guardian's full security checklist.

FAQ #

Is this a real scanner? #

No. This page is a checklist you go through yourself. For an automatic check of your server settings, use the ESN Guardian server grade.

What is a nuke? #

A nuke is when a hacked admin or rogue bot deletes channels, roles or bans members in a burst. Anti-nuke limits stop the account mid-attack.

Does ESN Guardian cost money? #

No. Every protection feature is included on every server at no cost. Guardian Premium is optional and only changes the bot's name, avatar, banner and bio in your server.

What permissions does Guardian ask for? #

The permissions it needs to protect a server, such as managing roles and channels, banning and viewing the audit log. You can see the full list on the Discord invite screen before you add it.

Still stuck? Use the live chat on the panel or ask in the ESN Systems Discord. Last updated November 4, 2026.