7 min read · Published 2026-10-03 · Updated 2026-11-01 · Perminator
Permissions drift. Every new bot, event, and staff hire adds a toggle somewhere, and nobody removes the ones that are no longer needed. A short, regular audit is the cheapest security investment a Discord community can make. This checklist takes about half an hour for a typical server and needs nothing but the Server Settings screens.
Before you start
Open Server Settings and have a notes document ready. You are looking for surprises, not fixing everything on the spot, so write findings down first and change settings afterwards. If you manage a large staff team, tell them an audit is happening to avoid confusing role changes.
Step 1 (5 minutes): review @everyone
Open Roles, select @everyone, and read every enabled permission. Anything beyond viewing, reading, posting, reacting, and voice basics deserves a question. Pay special attention to Mention Everyone, Create Invite, Embed Links, Attach Files, Use External Emoji, and Create Public Threads — all are common sources of spam and raids when left on for everyone.
Step 2 (5 minutes): find every Administrator
Go through each role and note which have Administrator enabled, then check who holds those roles. The list should be short and every name should be someone you would trust with the whole server. Remember bots count: many bots request Administrator for convenience, and almost none truly need it.
Remove Administrator from any role that was granted for a one-off task.
Replace it with the specific permissions the role needs.
Make sure no cosmetic or public role carries it.
Step 3 (5 minutes): check the other high-risk flags
Repeat the exercise for each of these permissions and list which roles hold them:
Manage Roles, Manage Channels, and Manage Server.
Manage Webhooks, because webhooks can impersonate anyone.
Ban Members and Kick Members.
Manage Messages and Manage Threads.
Mention Everyone.
Step 4 (5 minutes): audit your bots
Open Integrations and review each bot. Remove any that you no longer use. For the rest, ask whether its role is positioned correctly in the hierarchy and whether its permissions match what it does. A music bot should not manage roles, and a welcome bot should not be able to ban members. Check who in your staff is able to add bots — that ability comes with Manage Server — and keep the group small.
Step 5 (5 minutes): inspect sensitive channels
Pick your staff channels, logs, and any channel with private information. For each, open the Permissions tab and confirm View Channel is denied for @everyone and allowed only for roles that need it. Look for lingering member-specific overrides for people who have since left the team, and check whether the channel is synced to a category that has different rules than you expect.
Step 6 (5 minutes): compare roles with actual jobs
Finally, compare what each staff role can do with what it should do. Ask for each role: does everyone in it need every permission it has? Roles tend to accumulate permissions, because adding is easy and removing feels risky. Write down the minimum set each role needs and flag the difference.
Make it a habit
Put the audit on your calendar every quarter and after any major change in staff. Keep your findings so you can see whether the situation is improving. When a check fails in a way you did not expect, use the troubleshooting guide before flipping a pile of toggles. Flag-by-flag notes live in the permission reference . If the review keeps turning up the same problem — roles that need slightly more power than Discord lets you grant safely — that is a signal to adopt finer-grained controls. Perminator's permission matrix shows every role against every action in a single table, and its action log shows who actually used each permission so you can remove the ones nobody needs.
