Server security · Checked October 12, 2026

Recover from a nuke or a hacked staff account

Contain, clean up and recover, following the NIST incident response guide adapted to Discord.

Open in Kipp’s docs

1. 1. Prepare before it happens

   NIST’s incident response guide (SP 800-61 Rev. 3, 2025) treats preparation as part of the work: know who does what, keep backups, and have a way back in. Discord can’t restore channels or roles a malicious account or bot deletes, so your own backups matter. Take a Kipp backup now and set an owner rescue key.

   Dashboard: Access & backups › Backups · Kipp guide

2. 2. Contain: stop the account doing more

   Quarantine or remove the compromised account’s roles, and take Manage permissions off anyone you’re unsure of. Kipp quarantines anyone who goes over an action limit automatically. Pause invites if outsiders are joining.

   Kipp guide

3. 3. Secure the account itself

   The account’s owner should change their password at once (this signs out every session and resets the token), turn on 2FA and remove unknown authorised apps. Report it to Discord Trust & Safety and warn your other moderators.

   Learn more

4. 4. Find out what happened

   Check the audit log for everything the account (and any bot it added) did. Discord keeps audit log entries for 45 days, and Kipp’s audit log copy keeps a record in your own channel. Look for new bots, webhooks, invites and role changes, not just deletions.

   Dashboard: Settings › Audit log copy

5. 5. Recover

   Restore roles, channels and permissions from your latest backup, remove bots and webhooks the attacker added (Server Settings › Integrations), and give back roles to members who were affected.

   /backup · Kipp guide

6. 6. Learn from it

   NIST recommends sharing lessons as you find them, not only at the end. Write down how they got in and change something: the 2FA requirement, fewer people with dangerous permissions, tighter action limits.