Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Protect the owner account first: add a passkey or security key where your devices support it, or use an authenticator app, and store Discord’s one-time backup codes somewhere safe. Then limit the damage a compromised moderator account could cause by removing unnecessary Administrator access, using narrower role permissions, applying verification friction that fits your community, and teaching staff to reject suspicious bot messages and links.
These controls do not guarantee that a server cannot be taken over. They make the owner account harder to phish, reduce the number of accounts that can change critical settings, and add friction to automated abuse.
Secure the owner account before changing server settings
A server’s strongest protection is the account that owns it. If an attacker captures that login, server-level moderation settings and roles may be changed regardless of how carefully channels are configured. Discord supports security keys and passkeys, authenticator apps, and SMS-based multi-factor authentication (MFA). Discord characterizes passkeys as phishing resistant and recommends security keys; it does not recommend SMS MFA because text messages can be intercepted, including through SIM-swapping attacks. See Discord’s MFA guidance and its security-key and passkey instructions.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Choose the MFA method that fits your recovery plan
| Method | Phishing resistance | Access and recovery considerations | Login friction |
|---|---|---|---|
| Passkey | Discord describes passkeys as phishing resistant. | Protected by a device method such as a fingerprint, face scan, or screen lock. A passkey may be stored in a password manager, allowing another authorized device to use it. | Usually a device-unlock prompt rather than a typed code. |
| Security key | Discord recommends security keys as a strong protection against phishing. | A physical key must be available when Discord asks for the additional challenge. Discord’s passkey article says an account can register up to 16 security keys or passkeys. | Insert, tap, or otherwise approve the key when prompted; exact behavior depends on the key and device. |
| Authenticator app | Stronger than password-only login, but a code can still be entered into a convincing fake site. | The app generates a new time-based code every 30 seconds. Losing the phone without an authenticator backup or Discord backup codes can block access. | Type the current six-digit code during sign-in. |
| SMS | Weaker against phone-number takeover and interception. | Discord supports SMS only after an authenticator app is set up and warns about SIM swaps and intercepted texts. Discord says it does not recommend SMS MFA. | Receive and enter a text message when challenged. |
Use more than one recovery route when possible. For example, register a passkey or security key and keep an authenticator app available, then protect the backup codes separately. Do not assume that a second factor is useful if every recovery method is stored on the same lost or compromised device.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Add a passkey or security key
- Open Discord and select User Settings.
- Open Account. Discord’s desktop and browser instructions may label the relevant area Password and Authentication.
- Choose Security Keys, then Add.
- Follow the operating system’s prompt to register a passkey or connect and approve a security key. A passkey may use your fingerprint, face scan, or screen lock.
- Register a second key or passkey on an independently available device if your recovery plan allows it. Discord documents a maximum of 16 registered security keys or passkeys.
Hardware is optional: a USB security key is one possible MFA device, but compatibility depends on the key, browser, operating system, and device. Confirm those requirements before buying; Discord’s documentation establishes the security-key category, not compatibility for a particular model.
Set up an authenticator app when needed
- In User Settings, open Account and the Password and Authentication section.
- Select the option to enable an authenticator app and scan Discord’s QR code with the app.
- Enter the current time-based code to confirm enrollment. Codes change every 30 seconds.
- Complete the setup by downloading Discord’s backup codes before closing the page.
Keep the authenticator app’s own backup or transfer facility enabled if it provides one. Discord warns that losing the phone without an authenticator backup or Discord backup codes can prevent login.
Protect and test backup codes
Discord backup codes are single-use. Download them and keep them secret in a password manager or in a safely hidden printed copy. Do not leave them in a public server channel, an unencrypted note, or an email account that uses the same password as Discord. Discord states that support cannot restore owner access when the backup codes are lost. If you use a code to recover the account and then reconfigure MFA, generate a new set of codes and secure it again.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Reduce the blast radius of a compromised staff account
MFA protects individual logins; permissions determine what a stolen moderator login can do. Discord calls Administrator its most powerful permission: it grants every permission and bypasses channel restrictions. Discord advises assigning it with extreme caution. Review the staff list rather than assuming that a trusted person still needs the access they were given months ago.
Inventory roles and remove unnecessary Administrator access
- List every account with Administrator, Manage Server, Manage Roles, Manage Channels, or other high-impact permissions.
- For each account, write down the specific task it performs, such as handling reports, managing channels, or configuring integrations.
- Remove Administrator when a narrower permission can complete that task. Keep the owner account protected by strong MFA even if no other account has Administrator.
- Remove staff access promptly when a person leaves the team or changes responsibilities.
This review is a practical application of Discord’s permission model, not a guarantee that one role layout prevents takeover. It ensures that one stolen moderator session is less likely to control the entire server.
Use role hierarchy deliberately
Discord’s role hierarchy limits which members and roles an account can affect. A role can modify roles below its own position, and only within the permissions that the account itself possesses. Place powerful staff roles above ordinary moderation roles, keep bot roles at the lowest position that still permits their documented tasks, and avoid giving a bot permission to manage roles unless that function is essential.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check both the role’s server-wide permissions and any channel-specific overrides. Administrator bypasses channel restrictions, so channel settings are not a substitute for removing an unnecessary Administrator grant.
Separate duties instead of creating one “everything” role
- Give a support role access to the channels and moderation tools needed to answer reports, but not to Manage Roles.
- Give an event-management role access to event channels without server-wide administrative control.
- Give a technical role only the integration or channel permissions required for its maintenance work.
- Keep ownership and billing-related decisions with the smallest possible group of people.
Document who can perform each sensitive action and review the list after staffing changes. A role that has accumulated permissions over time is a common place to find access that is no longer justified.
Use verification levels to add proportional friction
Discord verification levels control requirements users must meet before they can send text messages. They are primarily an anti-spam and anti-mass-joining control, not a replacement for owner MFA. Discord identifies public servers and indefinitely valid invites as situations where verification may help deter bots and spam accounts that join in large numbers. Higher levels create more onboarding friction, and Discord says a phone-verified account supersedes the other listed requirements.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How the five levels differ
| Level | Requirement before messaging | Practical trade-off |
|---|---|---|
| None | Immediate participation. | Lowest barrier for legitimate members and the least friction for automated joins. |
| Low | Verified email. | Adds an email-confirmation step while retaining relatively easy onboarding. |
| Medium | Additional elapsed-time requirement after email verification. | Newly created or newly verified accounts may have to wait before participating. |
| High | Account age plus time spent in the server, in addition to the earlier checks. | Reduces immediate participation by very new accounts but delays genuine newcomers. |
| Highest | Verified phone number; Discord says this supersedes the other listed requirements. | Strongest identity friction in this control, with the greatest accessibility and privacy impact for members who cannot or will not provide a phone number. |
Discord’s documentation describes the progression but does not quantify how much each level reduces account takeovers. Choose the least restrictive level that addresses your abuse pattern, explain the requirement in your welcome materials, and reassess it when the community’s size or exposure changes.
Find the verification setting
Labels vary by server type and client, so confirm the current wording in your Discord app. Discord currently lists these routes:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Friend Servers on desktop or browser: Server Settings > Safety Setup.
- Community Servers on desktop or browser: Safety Setup > DM and Spam Protection.
- Mobile: use the server’s Moderation path.
Verification is a server-wide level. Channel-specific permissions can add another layer for sensitive areas, while administrators and moderators with appropriate permissions can still send messages regardless of the verification level. See Discord’s Verification Levels documentation for the current requirements.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Train staff to recognize phishing and bot scams
Account takeovers often begin with a convincing message rather than a technical attack on Discord itself. Discord Trust & Safety says: “If you receive a Direct Message from a bot offering you something, or asking you to click on a link, disregard it!” The team says Discord has not created bots that offer free products, warns that adding such a bot can compromise a server, and advises reporting suspicious bot contact. Read the Scam/Phishing Bots guidance.
Rules every moderator should follow
- Do not follow an unsolicited “verify,” “claim a prize,” or “unlock a product” link from a bot or unfamiliar account.
- Do not add a bot because a direct message promises free products, members, moderation, or rewards.
- Do not paste a token, password, backup code, or MFA code into a form reached from a message.
- Check a bot’s legitimacy through its developer or established documentation rather than through the link in the message.
- Report suspicious bot contact and alert the owner or security lead before taking further action.
Use the same policy for owner, administrator, moderator, and community-manager accounts. A single exception for a senior staff member can provide the path an attacker needs.
Respond quickly when an account or bot looks compromised
If the owner account may be compromised
- Stop using links or instructions supplied by the suspected attacker.
- Sign in through Discord’s normal application or website, change the password, and review active sessions and security settings.
- Use a backup code or another enrolled MFA method if required, then regenerate backup codes after access is restored.
- Review server ownership-related settings, roles, integrations, webhooks, invites, and recently changed moderation settings for unauthorized changes.
- Remove unfamiliar applications, bots, webhooks, or role grants and tell trusted staff not to act on suspicious messages.
- If you cannot regain access, follow Discord’s support process. Discord states that it cannot restore access when backup codes are lost, so preserving those codes is critical.
If a moderator or bot account is compromised
- Temporarily remove the account’s sensitive roles or disable the integration while you investigate.
- Check audit logs and recent changes for role edits, new bots, webhooks, invite changes, and altered channel permissions.
- Ask the account holder to secure their Discord account through the official client and to contact Discord support if they remain locked out.
- Restore only the minimum role permissions needed after the account is secured.
- Tell members which messages or links were malicious so they do not repeat the same action.
Do not treat deleting one suspicious message as a complete response. The important question is what credentials, roles, integrations, or links the account could access before it was contained.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteA maintenance schedule that keeps controls effective
- At every staffing change: remove departed staff, review role membership, and check whether any replacement role inherited Administrator.
- Regularly: review the owner’s registered passkeys or security keys, authenticator recovery, and the physical or digital location of backup codes.
- After a phishing incident: audit roles, bots, webhooks, invites, integrations, and channel overrides rather than changing only the password.
- When spam increases: raise verification friction temporarily or permanently, explain the change to members, and monitor whether legitimate onboarding suffers.
- When the server expands: document who can perform each sensitive action and separate moderation, technical, and administrative duties.
What these measures can and cannot establish
Discord’s official guidance supports passkeys and security keys as phishing-resistant options, recommends protecting backup codes, warns against SMS interception and SIM swapping, identifies Administrator as a bypass permission, and explains verification-level requirements. It does not provide a statistic for the number of Discord takeovers or a measured percentage reduction in risk for any setting. Treat the controls as layers that reduce opportunities and limit impact, not as a quantified guarantee.
Interface labels and navigation can change between desktop, browser, and mobile clients. Before instructing staff, open the live client and verify the route shown for your server type. For security keys, verify the current browser, operating-system, and device requirements for the model you intend to use; Discord’s documentation does not certify every key for every device.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
