If your Discord server just got nuked, stop the bleeding first (lock down or remove the compromised account's roles), then find out who did it from the audit log, then rebuild — channels and roles from a template if you have one, bans cleared from the ban list, and messages accepted as gone, because Discord has no undelete. This is the practical order of operations, not the theory of how anti-nuke bots detect an attack — that is covered in our anti-nuke guide. This one is what to actually do in the first hour, the first day, and afterward.
First: confirm it has actually stopped
Before touching anything else, make sure the attacker can no longer act. If an anti-nuke bot is running, check its log channel — it should show the account timed out, kicked or banned automatically. If there is no anti-nuke protection, or the attack came from an account the bot exempts (the server owner's account cannot be actioned by anti-nuke, and any account on a trusted list is skipped deliberately), do it by hand: strip the account's roles or kick it, and if it was a compromised staff account, tell that person to change their Discord password and check their authorized apps immediately — a nuke is very often the tail end of a phished token, not a random attack.
Find out what happened: the audit log
Server Settings → Audit Log records every channel deletion, role deletion, ban and kick with the account that did it and the timestamp. This is the ground truth for "who" and "how much" — read it before assuming anything, because a nuke by a compromised admin account looks identical in the moment to a nuke by a bot with too many permissions. If you run a security bot, its own log channel usually has a cleaner summary of exactly what triggered its response and when, which is faster to read than paging through Discord's native audit log entry by entry.
Rebuilding: what you can and cannot get back
- Channels and categories: gone unless you have a server template. Server Settings → Server Template lets you generate a snapshot of your channel and role structure at any time — if you made one before the attack, applying it rebuilds the skeleton in under a minute. If you never made one, you are recreating channels by hand from memory or screenshots.
- Roles and permissions: same as channels — a template restores the structure, not who was assigned to each role. Reassigning roles by hand afterward is the slow part.
- Messages: unrecoverable. Discord has no server-side undelete for message content. If any of it mattered for records rather than conversation — support history, sales, reviews — check whether it lived somewhere other than raw chat messages; Noxyr keeps invoices and ticket transcripts in its own database specifically so a nuke does not take them down with the channels.
- Bans: if the attacker mass-banned members, Server Settings → Bans lets you unban in bulk. Tedious, but fully recoverable — nothing about a ban destroys data, it only blocks rejoining.
- The server itself: a nuke, however bad, does not delete the server or remove the owner. It is always a recovery job, never a rebuild-from-nothing job.
Tell your members before they find out from an empty server
A server that suddenly has three channels and no roles looks abandoned or compromised to anyone who wasn't watching it happen. Post something in whatever channel still exists (or the first one you rebuild) explaining what happened in one or two sentences and that it is being restored — silence reads worse than an honest "we got nuked, fixing it now."
After it is stable: close the actual gap
A nuke happened because some account had more permission than it needed and either got compromised or turned malicious. Fixing the immediate mess without fixing that leaves you one incident away from a repeat:
- Audit every role with Administrator, Manage Channels, Manage Roles or Ban Members. Remove it from anyone who does not strictly need it — see our least-privilege role setup guide.
- Check every bot in the server for the same permissions. A bot with more access than its feature needs is a second attack surface with the same blast radius as a compromised admin.
- Turn on anti-nuke and anti-spam if they were off, and set the log channel so the next incident — hopefully never — leaves a clear trail from the first second.
- Make a server template now, while things are calm, so the next rebuild takes a minute instead of a day.
- Require 2FA for anyone with elevated roles, in Server Settings → Safety Setup.
Common questions
Can Discord support restore a nuked server? Discord does not restore deleted channels, roles or messages for server-level incidents — recovery is on the server owner. Contact Discord support only if the owner's own account was compromised and locked out entirely; that is an account-security issue, separate from the server damage.
How do I know if it was a compromised staff account or a malicious bot? The audit log names the executor account for every action. If it is a bot account, check what permissions that bot actually needed versus what it had; if it is a human account, that person's password and connected apps need checking regardless of whether they meant to do it.
Should I ban the account that did it? If it is clearly malicious and not a compromised friend or staff member you can talk to, yes. If it was a compromised account belonging to someone you know, kicking or timing out while they secure their account is usually enough — banning a friend's hijacked account can complicate getting them back in once it is fixed.
Will anti-nuke prevent this next time? It limits the damage — a bot correctly configured with anti-nuke turns "the whole server, gone" into "a couple of channels, one timed-out account." It cannot undo the actions that happen before the limit is crossed. See the anti-nuke guide for the limits and settings.
Is there any way to get deleted messages back? No, not through Discord. If message content needs to survive an incident, it needs to be captured somewhere outside raw chat — a pinned rules doc, exported records, or a bot that stores its own copy of what matters, like transcripts and invoices.
Prevent the next one with a security bot that watches the audit log continuously, and read the raid protection playbook for the join-side half of server defense.