What to do during a raid or a nuke

Raids are fast and stressful. Pin this page for your mod team, or copy the commands into a staff channel now.

A raid: lots of new accounts spamming

1. Stop new joins: /security lockdown-joins with action kick (or ban). Everyone who joins is removed until you lift it.
2. Stop the spam: /security lockdown-server locks every channel so regular members can't send messages. For one channel only, use /security lockdown-channel.
3. Clean up: /mod purge with an amount and, if the raiders share a role or text, the user, role or contains filters.
4. Ban the accounts with /mod ban add. Use purge_days to remove their recent messages.
5. Reopen: /security unlock-server, then /security unlock-joins.

A nuke: an admin account is deleting channels or banning people

Usually a moderator's account was compromised. Speed matters more than anything else.

1. /security lockdown-roles (panic mode). Hana strips dangerous permissions from every role below her, which stops the compromised account from doing more damage.
2. Remove the compromised member's roles, or ban them if needed.
3. Check the server logs (/logging setup if you hadn't) to see what was changed.
4. When the account is secured, /security unlock-roles restores the permissions panic mode removed.

Heads up: Panic mode only reaches roles below Hana. Roles above her, and the server owner, are not affected, so keep the number of roles above Hana small.

One suspicious member

/security quarantine-add isolates someone immediately without banning them. Review, then /security quarantine-remove or ban. /security quarantine-list shows who's in quarantine.

Prevent the next one

• Turn on the account-age gate.
• Give as few people as possible Administrator.
• Ask your staff to turn on two-factor authentication.