A 10 minute security checklist for a new Discord server

A new server is at its most exposed in its first weeks. The roles were made in a hurry, a few friends were given Administrator, and nobody is watching the audit log. This checklist fixes that in one sitting. The times are rough, and you can stop after any step and still be better off.

Before you add anything: 2 minutes

Start in Discord's own settings. No bot can fix a server where everyone is an admin.

1. Check @everyone. Open Server Settings, then Roles, then @everyone. It shouldn't have Administrator, Manage Server, Manage Roles, Manage Channels, Manage Webhooks, Kick Members, Ban Members or Mention @everyone.
2. Count your admins. Administrator is every permission at once. Give it to people you'd trust with the whole server, and nobody else. Moderators can do their job with far less.
3. Look at your bots. Remove any you don't use. Each one is another account that can be taken over.

Add Bastion and move its role: 2 minutes

Press Add to Discord, pick your server and approve. Leave the permissions ticked. Bastion asks for 14 named permissions and doesn't ask for Administrator. The permissions page says what each one is for.

Then do the step people skip. In Server Settings, Roles, drag the Bastion role above every other role, including your admin roles and other bots.

Run /setup: 1 minute

Type /setup in any channel. Bastion creates a Quarantined role that can see nothing, and a private channel called bastion-logs. Then it checks its own role position and permissions and tells you if anything needs fixing.

It never deletes or renames anything you already have, so it's safe to run again later.

Pick a level: 1 minute

Open the dashboard and press Finish setup. The wizard asks one real question: how strict should Bastion be?

• Relaxed suits busy, chatty servers where a false alarm would annoy everyone.
• Balanced suits almost everyone. Pick this if you aren't sure.
• Strict suits servers that are being attacked right now.

That one choice sets the limits for Anti-Nuke, Automod, the Join Gate and Anti-Raid. All four are on from this point. You can change any single setting afterwards.

Make sure someone sees the alerts: 1 minute

At first only Bastion and administrators can see bastion-logs. Open the channel's permissions and let your moderator role view it. An alert nobody reads isn't much use.

On the Logs page you can also pick an alert role. Those people are pinged when something serious happens, such as a nuke attempt.

Turn on verification: 2 minutes

Verification is the one protection that's off until you set it up, because it needs a channel and a member role from you. Run /verification setup in the channel new members should see first.

New members press a Verify button, pass a quick check and get your member role. It all happens inside your server. Bastion never sends a DM, a link or a QR code, and it's worth telling your members so. Anything that does is a scam.

Run /status: 1 minute

/status shows your security score out of 100 and a list of anything still to fix. A fresh Balanced setup with the role at the top and a log channel set scores 95. Verification is the last 5.

If the score is lower, the list tells you why. It's nearly always the role position or a missing permission.

What you've covered

Worth doing this week

• Leave the trusted list alone. The owner is always trusted. Most servers should add nobody else, or one person at most. See trusted people.
• Decide on appeals. They're off by default. If you want banned people to be able to ask to come back, switch them on under Moderation. See appeals.
• Give helpers less power. Staff tiers let a role use only the Bastion commands you tick, so a new helper can warn and time out without being able to ban.
• Think about recovery. Everything above stops an attack early. Backups, which are part of Pro, bring back roles and channels that were deleted before it was stopped.