9 min read · Published 2026-11-01 · Updated 2026-11-01 · Perminator
Treat a compromised moderator account as a permissions incident, not as a mystery. Your job in the first hour is to shrink what that account can do, find what it already did, and remove credentials it created. Discord will not roll the server back for you. The audit log is a record, not an undo button, and it keeps entries for 45 days. This checklist assumes you can still sign in as the owner or as an admin whose role is above the affected moderator.
The first ten minutes
Remove every role from the affected account, starting with anything that can ban, manage channels, manage roles, or manage webhooks. If your highest role is above theirs, you can do this. If it is not, stop and use the owner account. Kicking or banning the account comes next, after the roles are off, so a session that is still connected loses the powers immediately.
Ban rather than kick if you believe someone else is operating the account. A kick lets the same account rejoin through any open invite. A ban holds until you lift it. You can unban after the real owner of the account has recovered it and enabled two-factor authentication.
Do not announce a long theory in the public chat while the account can still read the staff channel. Remove access first. Explain after.
What to read in the audit log
Filter the audit log on the affected user. You are looking for actions that outlive the ban. Work the list below from the top. If the log is empty, either they did nothing or the actions were taken by a bot or webhook they created, which will appear under a different actor. Check bot and webhook creation specifically.
Log entry
Why it still matters after the ban
What to do
Bot added
The bot is still in the server, with its own role
Remove the bot unless you recognize it and invited it yourself
Webhook created or updated
The URL keeps working from outside Discord
Delete the webhook in Integrations
Role created or permissions edited
The role still has those permissions
Delete unknown roles. Restore permissions you remember, using your written ladder if you have one
Channel deleted
Discord will not reliably restore it
Recreate the channel and its overrides from your notes. Assume the messages are gone
Member banned
Those bans were the attacker's, or a panicking moderator's
Review each ban before you unban in bulk. Some of them may have been correct
Invite created
The link still joins the server
Revoke invites you do not recognize
Bots and webhooks
Open Server Settings → Integrations. Remove bots you do not recognize. For bots you do recognize, open their role and compare it with what you meant to grant . An attacker who held Manage Server for a few minutes may have invited a second bot with Administrator and a harmless name.
Delete unexpected webhooks even if you are unsure. A legitimate feed can be recreated. A leftover URL cannot be recalled once it has been copied out of the server. If a webhook posted as you or as another moderator, delete those messages after you have noted the timestamp for the people affected.
Invites
Revoke invites created by the affected account. If you cannot tell invites apart, revoke all of them and issue one new invite from the owner. Vanity URLs and discovery listings are separate. Check that the vanity URL still points at a server you control, and that widget or discovery settings were not changed. Those live under Manage Server, which many "moderator" roles have been given by mistake.
Turn on 2FA for moderator actions
In Safety Setup, enable Require 2FA for moderator actions. Every human who keeps a powerful permission must have two-factor authentication on their Discord account or those actions will fail for them. Warn staff before you flip it, so your remaining moderators are not locked out of kicking a spammer in the same hour.
The setting does not add a prompt to bots. A bot token with Ban Members still bans. After the incident, that is an argument for fewer bot permissions, not against the setting.
What you cannot undo
Deleted messages, deleted channels, and deleted roles do not come back because you banned the account that deleted them. The audit log tells you the name of the channel and who deleted it. It does not contain the channel's history. If the conversation mattered, your only copies are exports or screenshots someone already had.
A mass ban can be reversed one unban at a time, which is slow and worth doing carefully. A mass delete of messages cannot. This is the practical reason Administrator and Manage Channels should not have been on a moderator role. The staff ladder is the structure to put back, not the structure you had if a single moderator could delete categories.
After the account is contained
Ask the person to recover their Discord account, enable two-factor authentication, and sign out other sessions from their own settings. Unban only when they have done that. Give them back the lowest role that matches the job they actually do, not the set of permissions they had accumulated.
Tell the staff what happened in concrete terms: which account, what you removed, what members might have been banned in error, and who is handling appeals. Vague posts produce rumors, and rumors produce a second incident.
Then run the audit checklist while the log is fresh. The goal of the week after is a server that would have limited this account to timeouts and message deletes, so the same compromise next time is an afternoon of cleanup rather than a rebuilt community.
