3. Remove unknown bots and webhooks
In Server Settings under Integrations, check which bots and webhooks exist. Remove every bot that nobody on the team invited on purpose, and delete webhooks that were created during the attack. Webhooks can keep posting spam even without a bot.
From the moment it is turned on, Rewind can handle this itself. With Remove bots with dangerous permissions right away, Lizbot kicks a bot with dangerous permissions that an account not on the allowlist adds, and acts against that account. With Remove dangerous permissions from the incident right away, Lizbot reverts permissions that were added during the incident.
How to spot compromised webhooks and restrict the permission for them is shown in the guide Discord webhook abused.
4. Lock the server down
While you clean up, no new accounts should come in and nobody should keep spamming the channels:
- In Server Settings under Invites, delete suspicious or all active links. If you want, Rewind automatically pauses all invites during an incident, Lizbot needs the "Manage Server" permission for that.
/channel lockdown start temporarily raises the verification level to High, for 15 minutes by default, and with the minutes option for up to 24 hours. Lizbot needs "Manage Server" for this too, /channel lockdown end ends the lockdown early./channel lockall locks all text channels for regular members after a confirmation. /channel unlockall reverses it.
How to deal with join waves from outside is covered in detail in the guide on raid protection.
5. Secure the hijacked account
As long as the attacker is inside the team member's account, they can come back as soon as someone gives the roles back. So the affected person should, ideally on a clean device:
- change their password, if necessary via "Forgot your password?" on the login page
- log out all unknown sessions under Devices in User Settings
- turn on or set up Two-Factor Authentication again
- remove anything they don't recognise under Authorized Apps
- check how it happened: a supposed game test, a QR code to "verify", a downloaded program
If the person can no longer get into their account, only Discord support can help. All the steps are in the guide on what to do when a Discord account gets hacked. Only give the person their staff roles back once they are safely in control of the account again.
6. Assess the damage
Now that nobody is destroying anything anymore, get an overview. Note down from the audit log what was deleted or changed: channels, roles, permissions, bans, kicks, emojis. Discord only keeps audit log entries for 45 days, so take screenshots right away after a big incident.
Lizbot helps you take stock in two places:
- Rewind incidents: In the dashboard under Moderation on the Rewind tab, every incident is listed with a summary, such as "8 channels deleted, 3 roles deleted, 14 bans". Every incident contains a snapshot of what the account deleted or changed.
- Logging: If logging was active, you'll find deleted and changed channels and roles, role changes on members, bans, kicks and bulk message deletions in your log channels. On the Free plan the logs stay in the dashboard for 14 days, on Pro for 90 days, on Studio for 365 days.
Also check Lizbot's Audit log in the dashboard. It lists every change to Lizbot settings, including when the attacker, for example, turned off AutoMod or switched a log channel.
7. Undo the incident with Rewind (Pro)
Rewind is the fastest way back if it was turned on before the attack. Below the alert in Discord and on every incident in the dashboard you'll find Undo. Lizbot then recreates exactly the deleted channels and roles, with their permissions and as close as possible to their old position, reverts the permission changes and gives back removed roles. If you want, Lizbot also deletes channels, roles and webhooks that were created during the incident.
Lizbot only lifts bans if you explicitly want it to: in Discord with Undo and unban, in the dashboard with the option Unban banned users. If an incident is missing a detail, Lizbot fills the gap from the last backup or, from Pro, from the Structure snapshots Lizbot takes daily on Pro and every 6 hours on Studio.
What even Rewind can't do: messages of deleted channels are gone on Discord's side and only come back if a backup saved them. Kicked members have to join again themselves. Deleted webhooks get new URLs, so you need to set up connected services again. Lizbot does not give roles with staff permissions back automatically.
Detection, countermeasure, alert and invite pause are included in all plans. Exact undo is available from Pro.
8. Restore from a backup
Without Pro or without Rewind turned on, a backup helps. In the dashboard open Backups, pick the last backup from before the attack and click Restore. In Discord you use /server backup restore.
Choose the Missing only mode (in Discord missing). It recreates deleted roles and channels and leaves everything that still exists untouched. Full resets the whole server to the state of the backup and is meant for a complete rebuild, not for repairs after a nuke.
Before you start, drag the Lizbot role as high as possible in the role list. Lizbot can neither create nor change roles above its highest role. On the Free plan you can store 2 backups, on Pro 10 and on Studio 50. From Pro, Lizbot backs up automatically, and on Studio it can also save messages. All the details are in the guide Back up your Discord server.
If there's no backup at all, you're left rebuilding by hand. A server template can give you a ready-made basic structure to adapt.
If you have no backup, the guide Recover a deleted channel or role explains what can still be saved.
9. Check and lift bans
A nuke often deliberately targets active members and the team. In Server Settings open the Bans list and compare it with the audit log. Lift everything the attacker banned.
For many bans, use Lizbot's Mass action: in the dashboard under Cases choose Unban as the action, paste up to 200 user IDs, one per line or separated by commas, enter a reason such as "Nuke on 24 Oct" and confirm with the word "UNBAN". To copy user IDs, turn on Developer Mode in Discord under Advanced in your settings, explained step by step in the guide on copying Discord IDs.
The other way round, the mass action with Ban works for accounts that joined during the attack and helped spam. Every entry is saved as its own case with a reason. Unbanning brings nobody back automatically, because a bot can't invite anyone. Send the affected people a new invite link afterwards.
How to find banned users in the ban list and unban them, on mobile too, is shown in the guide How to unban someone on Discord.
Silence makes people uneasy. As soon as the server is back up, post a short, factual message in an announcement channel:
- what happened, without details that would guide copycats
- that the server is safe again and what you have restored
- that nobody should click links from the time of the attack, if scam messages were sent
- that banned members have been unbanned and how they can come back
If the attacker sent DMs with scam links to members from the hijacked account, this warning is especially important. Report any remaining scam messages to Discord.
Lessons from the incident
A hack is annoying, but it shows you exactly where your server was open. These points close most of the gaps:
- Hand out permissions sparingly: Administrator for one or two people only. Moderators need Ban Members, Kick Members and Timeout Members, but not Manage Roles or Manage Server. The guide Set up Discord roles shows what a safe structure looks like.
- Require 2FA for moderation: Discord can require everyone with moderation permissions to have 2FA enabled. How to turn on the 2FA requirement for moderation has its own guide.
- Turn on Rewind: It is off by default. Pick a Sensitivity (Strict, Normal or Relaxed), a Countermeasure against the account and an Alert channel. Turn on Alert for the server owner too, in case your own account is ever taken over. How the protection works in detail is shown in the guide on anti-nuke protection.
- Regular backups: At the very least, create a backup before every rebuild, automatically from Pro.
- Check your bots: Give bots only the permissions they need, and add bots that clean up regularly under Allowlisted user IDs so Rewind doesn't mistake them for attackers.
- Train your team: Anyone who knows what fake game tests, QR code logins and Nitro gifts look like is less likely to click them. Tips for your team are in the guide on the moderation team.
Checklist
- responsible account found and stripped of permissions
- unknown bots and webhooks removed
- invites deleted or paused, server in lockdown if needed
- hijacked account with new password, 2FA and logged-out devices
- damage noted from the audit log, incidents and logging
- channels and roles back via Rewind or backup
- unjustified bans lifted
- members informed
- Rewind turned on, backup up to date
Common mistakes
- Rebuilding right away: As long as the attacker has permissions, they delete everything again. Stop first, then clean up.
- Giving roles back too early: If a team member gets their roles back before the account is secured, the attack starts all over.
- Full instead of Missing only: Full mode deletes channels and roles first. After a nuke, Missing only is almost always enough.
- Lizbot role too low: Then Lizbot can neither step in nor restore roles. The role belongs near the top.
- Overlooking unknown bots: A bot left behind with the Administrator permission makes the server vulnerable again immediately.
- Creating a backup only after the attack: It then only saves the destroyed state.
