Discord raid recovery: the first hour afterwards

The hour after a raid is a triage problem, not a security problem. Stop the inflow, stop the damage, preserve the record, then decide what to restore and in what order. The two mistakes that cost the most are made in the first ten minutes: banning by heuristic, and deleting the evidence you are about to need.

Almost everything published about raids is about stopping one. This is about the part after that.

Which kind of raid is this?

The answer changes every subsequent step, and it is usually obvious within thirty seconds.

Kind	What you see	The immediate risk	First action
Join flood	Dozens of new accounts in seconds, then message spam	Channel content, member perception	Close the door, then quiet the room
Message spam	Existing or new accounts flooding one or more channels	Readability, mass pings	Lock the channels
Nuke	Channels or roles being deleted, mass bans, renames	Structure — the part that is hard to undo	Remove the actor’s permissions
Impersonation	Accounts copying staff names and avatars, DMing members	Members getting scammed, and your credibility	Warn the server publicly

The third one is the only genuine emergency. A join flood is loud and recoverable. A nuke is quiet, fast, and the damage compounds every second an account keeps its permissions.

The tell that distinguishes them: a nuke is coming from an account you trusted. If channels are disappearing, stop reading this and go remove roles.

The first ten minutes

In this order. The order is the whole method, and it is not the order instinct suggests.

1. Close the door. Raise Discord’s verification level, and — if the flood is still arriving — pause invites. This costs you legitimate joins for an hour, which is a price worth paying, because every account that arrives during triage becomes work.

2. Contain, do not clean. /lock the affected channels and /slowmode the rest. Locking stops the inflow of new content without removing what is already there. Cleaning first is the classic error: you destroy the record while the incident is still in progress and while you still do not know what happened.

3. Remove permissions before removing people. For a nuke, the priority is not banning the account — it is stripping what the account can do. /rar removes every removable role from a member in one command. That is faster than a ban in practice, it does not require outranking them in every respect, and it is reversible if you are wrong.

4. Take one screenshot of the audit log. Ninety seconds, and it is the single highest-value action in the whole sequence. Discord’s audit log holds entries for 45 days and there is no way to extend that. Whatever you will want in six weeks — for an appeal, for a report to Discord, for a staff conversation — has to be captured now or reconstructed from memory later.

5. Say something in public. Two sentences in a channel members can see. Not an explanation, not an apology, and definitely not silence. Silence during a visible incident is read as absence, and it does more damage to trust than the raid does.

Only now do you start cleaning up.

Before you ban anyone

Mass bans are the most tempting and the most expensive action available, because the false-positive cost is asymmetric. Banning fifty raid accounts costs nothing. Banning three real members inside those fifty costs you three members and a story that circulates for months.

Three rules that keep the error rate down:

Ban on behaviour, not on shape. A new account with a default avatar is not evidence. A new account that posted the same link in six channels is. The heuristics are for flagging; the ban should follow an action.

Prefer reversible actions during the incident. A timeout stops the behaviour and can be undone without the member ever knowing. A ban is visible, final in effect, and generates an appeal. During triage, reach for the reversible one and convert to bans afterwards, when you can read the log calmly.

Keep the list. Whatever you ban in bulk, record the IDs somewhere outside Discord before you do it. This is what makes the mistake recoverable — and /unban-all exists for exactly the case where the sweep was wrong, though it is an Administrator-level command that undoes every ban in the server, so it is a reset rather than a correction.

Vetox’s Moderation Tools page is the surface that makes selective correction possible afterwards: it lists the punishments currently in force — active bans, active text and voice mutes, unexpired temporary roles — and lets any staff member lift or shorten one. Free on every tier. Without something like it, “who did we ban on Tuesday” is unanswerable, because a banned user cannot be mentioned or searched in Discord.

Restoring: what comes back and what does not

Sort the damage into three piles, because they have three different recovery paths and only one of them is automatic.

Discord structure — channels, roles, permissions, emojis. No bot can recreate a deleted channel’s messages, and no bot can restore a role’s exact position and overrides unless it captured them. This is the pile that hurts, and it is the argument for having a backup plan before you need one.

Bot configuration — thresholds, panels, log destinations, automation. Recoverable if you snapshot it. Vetox’s Server Backup takes an encrypted point-in-time snapshot of everything Vetox stores about the server — 54 collections of configuration and records — restorable into the same server or a different one. It requires Max ($7.99/month) and it is scoped precisely: it captures Vetox’s data about your server, not the Discord server itself. A restore points the configuration at whatever channels and roles exist at that moment; it cannot recreate a deleted one.

Two design details in it are specifically about this scenario. A protected copy is only replaced by a current snapshot that has survived 24 hours — so an attacker who wrecks the configuration and immediately presses Backup Now overwrites the recent copy but cannot dislodge the vaulted one, because elapsed time is the one thing they cannot manufacture. And a pre-restore snapshot is taken automatically before any restore runs, so a recovery that turns out to be the wrong recovery is itself reversible.

Membership and mood. Not restorable by any mechanism. Members who left during the incident mostly do not come back, and the ones who stayed are recalibrating. This pile is handled by what you say afterwards, not by what you configure.

What the platform gives you back

Less than people expect, and it is worth knowing before you need it rather than during.

Deleted channels and their messages are gone. Deleted roles are gone, including every permission override that referenced them. Members removed by a mass kick are gone and must rejoin, which most will not do without an invite reaching them somewhere else.

What survives is the audit log — for 45 days — which will tell you who did what, and that is genuinely valuable. Its message coverage is limited to deletions, bulk deletions, pins and unpins; there is no edit event and no reaction event, so a raid that took the form of edited messages leaves no platform trace at all. Your own event log is the only record that persists past the window, which is why the servers that recover cleanly are the ones that turned logging on months earlier for unrelated reasons.

The debrief, within 48 hours

Not a post-mortem document. Four questions, half an hour, written down somewhere the staff team can find them next time.

How did they get in? Open invite, a leaked permanent link, a compromised account, or a member who went bad. These have four different fixes and only the first two are about invites.

How long between the first sign and the first response? This is the number to improve, and it is almost always dominated by nobody being awake rather than by anyone being slow.

What did we lose that we could have kept? Sorted into the three piles above. The middle pile is the one you can fix with configuration this week.

What did we do that we should not have? Every incident produces at least one over-reaction. Naming it in the debrief is what stops it becoming standard practice.

What actually prevents the next one

Prevention belongs at the end of a recovery article because that is when anyone will act on it.

A door that screens automatically. Vetox’s Anti-Raid is two independent defences on one configuration and requires Basic ($4.99/month). Raid detection counts how many accounts younger than a set age joined inside a rolling window of 1 to 300 seconds, and when the count reaches a threshold of between 2 and 100 it posts an alert to a channel and applies one action — mute, kick or ban. Join Guard screens every join individually against up to 10 named conditions, each combining up to 5 rules with AND/OR logic: account age, default avatar, no banner, username keyword lists, and six named generated-name patterns covering the usual name12345 shapes.

The action worth configuring above all the others is open_case. Instead of acting, it posts an amber embed naming the member, their account age, the rules that matched and the condition that fired — with four buttons: Kick, Ban, Timeout, Ignore. The bot does the triage; a human makes one decision, in one click, from their phone. That is the correct division of labour for a defence that has to run at 3am, and it is far safer than an automatic ban rule that will eventually be wrong about somebody real.

A ceiling on trusted accounts. Anti-Raid handles the door; Protection handles the people already inside. It reads Discord’s audit log, attributes each destructive administrative action to its executor, counts it against a per-rule threshold, and punishes or reverses when the threshold is crossed — across 20 rule types covering channel and role deletion, mass bans and kicks, dangerous role grants, server renames, bot additions and webhook changes. It is free on every tier, and the server owner is always exempt, which is what keeps it from becoming an outage of its own.

If you configure exactly two rules today, make them antiChannelDelete and antiRoleDelete. Those two cover the damage that no backup, on any platform, can fully undo.

And the boring one: audit who holds Administrator. Most nukes are not sophisticated. They are an account that had more permission than it needed, held by someone who reused a password, and the recovery cost is measured in weeks while the prevention cost was one afternoon of permission tidying.