Start here
Security score
In short
The security score is a mark out of 100 for how well protected your server is. The list under it tells you exactly what to fix. Start with the items worth the most.
Where to see it
The score is at the top of the dashboard overview. You can also run /status in Discord. Both use the same sums, so they always agree.
How the 100 points are made up
There are ten checks. Each one is either passed or not. There are no half points.
| Check | Points | How to pass it |
|---|---|---|
| Bastion's role is at the top | 20 | In Server Settings, Roles, drag the Bastion role above every other role. |
| Anti-Nuke is on | 20 | Switch on Anti-Nuke. |
| Bastion has the permissions it needs | 10 | Give the Bastion role anything listed as missing. See permissions. |
| Only trusted people can add bots | 10 | Switch on Bots added without permission in the Join Gate. |
| Automod is on | 10 | Switch on Automod. |
| Anti-Raid is on | 10 | Switch on Anti-Raid. |
| Dangerous permission changes are blocked | 5 | Switch on Block dangerous permissions in Anti-Nuke. |
| A log channel is set | 5 | Run /setup, or pick a channel under Security alerts on the Logs page. |
| Few trusted people | 5 | Keep the trusted list to two people or fewer. |
| New members are verified | 5 | Switch on Verification and choose its channel and role. |
What to fix first
Role position
It's worth 20 points and takes ten seconds. Without it, Bastion can't touch anyone ranked above it. See the setup guide.
Permissions
Run
/status. If a permission is missing, Bastion names it. Tick it on the Bastion role.A log channel
Run
/setupand Bastion makes a private one for you. You then get a record every time Bastion acts.Verification
Optional, but it's the last 5 points and it keeps automated accounts out.
TipThe role and permission checks are measured by the bot inside your server. If you've fixed them and the score hasn't moved, run /status so Bastion checks again.
What the score doesn't measure
The score checks that protections are switched on. It doesn't judge how you tuned them. A Relaxed server and a Strict server can both score 100.
It also can't see things outside Bastion, such as whether your admins use two-factor login, or how many people hold Administrator. A score of 100 means Bastion is set up well. It doesn't mean nothing can go wrong.
Pro features such as backups and panic mode aren't part of the score. A free server can reach 100.
My score went down and I changed nothing.
Someone probably moved a role above Bastion, or removed one of its permissions. Run /status to see which check failed.
Why does having trusted people lower my score?
Trusted people skip every check. If one of their accounts is hacked, Bastion won't stop it. Three or more is a risk, so the check fails.
Do I need 100?
No. The two big ones are role position and Anti-Nuke. Get those and you're well covered.
The permissions check says to run /status.
Bastion hasn't checked your server yet. Run /status once and the check fills in.
Last updated