Security tips

User Settings, My Account, then Enable Two-Factor Auth. Use an authenticator app rather than SMS, and keep the backup codes somewhere other than your computer.

A server can also require two-factor authentication for its moderators: Server Settings, Safety Setup.

If your Discord password is used elsewhere, a single leak is enough. A password manager creates a long, unique one for every site.

"Scan this code to verify your account" or "to get your Nitro": scanning a login QR code with the Discord app logs the other person into your account. Discord will never ask you to do that.

Free Nitro, a fake message from the Discord team, "your account will be banned, click here": always check the address before logging in. The only login domain is discord.com. When in doubt, Protector's /scan command checks a link without opening it.

"Try my game", "install this software for the stream": these programs steal your session token, which bypasses two-factor authentication. No .exe, .scr, .bat file or script should come from a stranger.

If someone asks you to open the developer tools (Ctrl+Shift+I) and paste some text into them, it is an attempt to steal your account, without exception.

User Settings, Authorized Apps: remove the ones you no longer use or do not recognize. An authorized app can act on your behalf within the permissions you granted.

User Settings, Devices: log out any device you do not know, and use "Log out all known devices" at the slightest doubt.

Whoever controls your mailbox can reset your Discord password. Turn on two-factor authentication on your email account as well.

For a large server, an account dedicated to ownership, rarely used and on a single device, greatly reduces the risk of theft.

Discord never lets a role act on a role above it. If an attacker has a role higher than Protector, the bot can neither sanction them nor restore what they destroy. Run /diagnostic to check.

Administrator bypasses every other permission. Give precise roles instead (Kick Members, Manage Messages…) and keep Administrator for yourself.

Anti-raid, anti-nuke and anti-spam are reserved to the owner. If you want to delegate, choose a security role in /config, General, and only give it to people you trust completely: Protector removes that role from anyone who receives it from someone other than you.

A bot added by a compromised administrator can destroy everything in seconds. With quarantine, every new bot joins with no permissions until you approve it in a private message.

A captcha or a verification button stops most raids run with automated accounts. /autoconfig creates it for you, /verification-setup sets it up by hand.

@everyone should never be able to mention everyone, manage webhooks, create invites in every channel or use external apps without a reason.

Server Settings, Integrations: delete unknown or abandoned webhooks. A webhook whose address leaked lets anyone post anything in the server's name.

Without a log, there is no way to know who changed a permission or deleted a channel. At least enable the Roles, Channels, Server and Webhooks categories in /config.

Server Settings, Safety Setup: members without two-factor authentication can no longer use moderation actions, even if their role allows it.

/backup create captures roles, channels, permissions and recent messages. After a mistake or an attack, /restore puts everything back.

An attacker who removes the vanity link can claim it for another server. Protector warns the owner at once: act fast to get it back.

Do not give a moderation role to a new account or someone who just joined. Protector's staff guard blocks these risky promotions and alerts you.