Permissions and roles
- Count how many people and bots have Administrator. Every one is a potential nuke.
- Give each staff member the smallest role that does their job; make a second, narrower role for trial moderators.
- Move Lyx’s role above every role it has to manage, and remove permissions it does not need.
- Check @everyone: no Manage Server, no Manage Roles, no Administrator, no Mention Everyone.
- Open one private channel as a normal member and confirm it is actually private.
- Remove Manage Webhooks from roles that do not need it — a webhook can post as the server.
Staff accounts
- Require 2FA for moderators in Server Settings → Moderation.
- Check the audit log for permission changes you do not recognise.
- Remove staff roles from anyone who has left the team, not just from the server.
- Make sure at least two trusted people can recover the server if the owner’s account is lost.
Bots
- List every bot and what it can do. Remove the ones nobody uses.
- Bots that only post embeds do not need Administrator or Manage Messages.
- Regenerate tokens for any bot whose token was ever pasted into a channel.
- Check that the bot’s own role cannot be edited by lower roles.
Raids and spam
- Turn on anti-raid with a threshold above your normal join peaks:
/security antiraid. - Set up a honeypot channel:
/honeypot setup. - Turn on the scam filter and invite blocking:
/automod toggle enabled:true. - Limit mentions per message:
/automod mentions. - Add slowmode to your busiest channel.
- Keep one invite that staff can revoke, and rotate any invite that was posted publicly.
Channels and content
- Lock announcements and rules to staff-only posting.
- Pin one message explaining how to report a problem.
- Make sure reports go somewhere staff see, such as a ticket or a private reports channel.
- Check that deleted channels are recoverable from a backup, not from memory.
Backups and recovery
- Take a backup of roles, channels and settings:
/backup create. - Keep the backup list somewhere other than the server it backs up.
- Write down who can restore it, and how.
- Test a restore on a spare server once, so the first time is not during an incident.
Monthly review
- Read the audit log for anything unexplained.
- Review the staff list and remove roles from inactive moderators.
- Check the join graph for sudden spikes and confirm they were events, not raids.
- Re-read your rules and the enforcement ladder; update both if a moderator had to improvise.
Common questions
How often should I run this?
Once now, then every three months, and after any incident. Most of it takes under an hour.
Is Administrator ever okay for a bot?
Rarely. Give the specific permissions it needs instead; a compromised bot with Administrator can delete everything.
Do backups include messages?
Lyx backups cover roles, channels and settings, not message history. Discord does not offer message backups to bots.