GUIDE · SECURITY
Channels were deleted, everyone was banned, or scam links are being posted in the server. Don't panic; usually the cause is a compromised staff account or an over-permissioned bot. Follow the order below.
If you're the server owner, change your password right away and turn on two-factor authentication (2FA). Log out sessions you don't recognize in User Settings › Devices, and remove apps you don't recognize from Authorized Apps. If you can't log in at all, contact Discord support.
Accounts are usually stolen with "scan this QR code", "Nitro gift" or "can you try my game" files; warn your staff about these too.
In Server Settings › Audit Log, check who made the deletions and bans. Take that person's or bot's role, and kick them from the server if needed. In Integrations, delete bots and webhooks you don't recognize; scam messages are often posted by a webhook. Turn off Administrator on suspicious roles.
The audit log shows deleted channels, roles and banned members. If Groyt's log system was on, the log channel shows in detail who did what. When lifting mass bans, Groyt's mass unban tool speeds things up.
Groyt's automatic backup keeps a complete list of the channel, category and role structure; refer to it while rebuilding. If starting from scratch is easier, you can build the skeleton in seconds with a ready template. Messages don't come back; no bot can do that.
No. Discord doesn't bring back deleted messages, and no bot can either. You can rebuild the channel and role structure by looking at a backup.
Yes. Report the compromised account and scam messages through Discord's support and report page.
Anti-nuke greatly limits the damage: it takes away the attacker's permissions after the first few actions. But if the owner account is stolen, no bot can stop the owner; that's why 2FA is a must.
