Secure the owner account before changing anything else: add a passkey or security key when your devices support it, or use an authenticator app, and store Discord’s one-time backup codes somewhere protected. Next, reduce the damage a stolen moderator account could cause by removing unnecessary Administrator access and giving each role only the permissions its tasks require. Finally, add verification friction that fits your community and train staff to reject suspicious bot messages, “free” offers and unsolicited links.
These controls do not make a takeover impossible, but they separate a compromised login from a compromised server. The steps below follow Discord’s documented authentication, permission, verification and scam guidance.
As an Amazon Associate I earn from qualifying purchases.
1. Protect the owner account first
The server owner’s Discord account is the highest-value target. Anyone who controls it can change roles, alter settings, remove staff or lock legitimate members out. Discord supports security keys and passkeys, authenticator apps and SMS for multi-factor authentication (MFA). Its guidance recommends security keys and describes passkeys as phishing resistant. Read Discord’s current instructions in Security Keys, Passkeys, and Passwordless Login on Discord and Setting up Multi-Factor Authentication.
Choose the strongest method you can reliably recover
| Method | How it works | Security and recovery considerations | Login friction |
|---|---|---|---|
| Passkey | Uses device authentication such as a fingerprint, face scan or screen lock. It may be stored on a device or in a password manager. | Discord characterizes passkeys as phishing resistant. You still need a recovery plan for a lost device or unavailable credential. | Usually a device-unlock prompt rather than typing a code. |
| Security key | A physical USB or compatible hardware key supplies an additional login challenge. | Discord recommends security keys. Keep a second registered key or another recovery method in a separate, protected location. Compatibility depends on the key, device and operating system. | Requires having the key available when Discord asks for it. |
| Authenticator app | Generates a time-based one-time password; Discord says the code changes every 30 seconds. | Protect the enrolled phone and maintain an authenticator backup. Losing the phone without a backup or Discord backup codes can prevent login. | Requires opening the app and entering the current code. |
| SMS | Sends a login code to your phone number after an authenticator app is set up. | Discord warns that texts can be intercepted and phone numbers can be taken over through SIM swapping. Discord says it does not recommend SMS MFA. | Simple when the phone receives the message, but dependent on mobile-service access. |
Do not select a particular hardware model solely because it is advertised as a “Discord key.” Check the maker’s current support for your operating system and device. Hardware is optional: a passkey can be device-based or held by a password manager.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Set up a passkey or security key
- Open Discord and select User Settings.
- Open Account. Discord’s desktop and browser instructions may label the relevant area Password and Authentication; the passkey article also directs users to Security Keys.
- Select Add under Security Keys, then follow the device prompt to create a passkey or register the security key.
- Register more than one credential if practical. Discord’s passkey instructions say up to 16 security keys or passkeys can be registered.
- Sign out and test a new login while you still have access to the enrolled device or key.
Registering a second credential is useful only if it is stored separately and remains available during an emergency. A collection of keys kept in the same lost bag does not provide meaningful redundancy.
Set up an authenticator app when a passkey or key is unavailable
- In User Settings, open Account and the MFA or password-and-authentication section.
- Choose the authenticator-app option and scan the displayed QR code with your authenticator app, or enter the setup key manually.
- Enter the current six-digit code to confirm enrollment. Remember that these codes rotate every 30 seconds.
- Complete the setup only after you have confirmed that the app can generate a valid code.
SMS is a fallback Discord supports after an authenticator app is configured, not the preferred protection. Treat a phone number as a convenience rather than your only recovery route.
2. Make recovery part of MFA setup
Backup codes are single-use credentials. Discord advises downloading them and storing them secretly in a password manager or a safely hidden printout. Do this immediately after enabling MFA, not when you are already locked out.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Save the codes in a location separate from the device used for everyday Discord access.
- Do not paste them into a staff channel, shared document or screenshot folder.
- Confirm that you can retrieve them without being logged in to Discord.
- Use one code only when necessary. After using a code to recover and reconfigure MFA, generate a new set.
Discord’s passkey instructions warn that support cannot restore account access if the backup codes are lost. A password manager can hold passkeys and backup codes, but protect the manager itself with strong MFA and a recovery plan.
3. Limit the damage a compromised staff account can do
MFA protects a login; permissions determine what that login can change after it gets in. Discord calls Administrator its most powerful permission because it grants every permission and bypasses channel restrictions. Discord explicitly says to assign it with extreme caution in Discord Roles and Permissions.
Audit Administrator and high-impact permissions
- Open the server’s role list and identify every role that has Administrator.
- For each person holding that role, write down the specific task that supposedly requires unrestricted access.
- Remove Administrator when a narrower permission can complete the task. Examples include managing messages, moderating members or managing channels without granting every unrelated capability.
- Review who can manage roles, ban or kick members, manage webhooks, manage channels and manage the server. These powers can still cause serious damage even without Administrator.
- Remove staff access promptly when a volunteer leaves, changes duties or no longer needs it.
Discord’s role hierarchy limits which members and roles an account can affect. A person can manage roles below their own position, and only with permissions that person possesses. Place supervisory roles above the roles they administer, and keep the owner’s role structure deliberate rather than adding elevated roles for convenience.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use a least-privilege staff design
- Owner: retain the smallest number of owner accounts possible and protect each with strong MFA and recovery codes.
- Administrators: reserve for people who genuinely need broad server control; document why each account has it.
- Moderators: grant only the moderation actions they perform, such as message management or member timeout functions.
- Community or event roles: separate temporary duties from permanent staff roles, and set an end date for temporary access.
- Automation: review every bot’s requested permissions before adding it. A bot that asks for broad control can become a takeover path if its token or developer account is compromised.
This model reduces the blast radius; it does not guarantee protection. A moderator with a stolen account can still abuse every permission assigned to that role, so reassess access whenever responsibilities change.
Recommended Free Tools
4. Add verification friction without locking out your community
Discord’s verification levels control requirements users must meet before they can send text messages. They are primarily an anti-spam and anti-mass-join measure, not a replacement for owner MFA. Discord describes the levels in Verification Levels.
| Level | Requirement before sending text messages | Trade-off |
|---|---|---|
| None | Immediate participation. | Lowest onboarding friction and the least barrier to disposable accounts. |
| Low | Verified email account. | Blocks some unverified throwaway accounts while adding an email step. |
| Medium | Verified email and a minimum time since email verification. | Delays newly verified accounts, which can frustrate legitimate newcomers. |
| High | Verified email, an account older than the specified age and time spent in the server. | Stronger resistance to newly created mass-join accounts, with more waiting for genuine members. |
| Highest | Verified phone number; Discord says this supersedes the other listed requirements. | Most friction and the greatest accessibility and privacy consideration for members who cannot or will not provide a phone number. |
Discord identifies public servers and indefinitely valid invites as situations where verification can help prevent bots and spam accounts from mass-joining. The setting is server-wide, so explain the requirement in your welcome and support channels before raising it. Administrators and moderators with appropriate permissions can still send messages regardless of the level.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Find the setting in the current client
Labels vary by server type and can change as Discord updates its interface. On desktop or browser, Discord documents Server Settings > Safety Setup for Friend Servers. Community Servers use Safety Setup > DM and Spam Protection. On mobile, the documented route is through Moderation. Open the live client and confirm the label before publishing internal instructions.
Use verification together with channel-specific permissions. For example, a public announcement channel can remain readable while new members are prevented from posting until they meet the server’s requirement. This lets you raise the cost of automated abuse without making every channel inaccessible.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 115. Teach staff to spot phishing and malicious bots
Many takeovers begin with a convincing message rather than a failed password. Discord Trust & Safety says to disregard a bot direct message that offers something or asks you to click a link, and says Discord has not created bots that offer free products. Its guidance is Scam/Phishing Bots.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Rules every moderator should know
- Do not click unsolicited “verify,” prize, beta-access or free-product links in bot DMs.
- Do not add a bot because it promises free currency, subscriptions, game items or server growth.
- Do not enter a Discord password or MFA code into a page reached from an unsolicited message.
- Check the bot’s identity through a known developer channel when legitimacy is uncertain, rather than trusting a DM link.
- Report suspicious bot contact and warn other moderators without forwarding the malicious link as a clickable URL.
Practice these rules with new staff. A short written policy is more useful than assuming experienced moderators will recognize every new lure. Staff should also know that a legitimate-looking account can itself be compromised.
6. Respond quickly if an account may be compromised
- Contain the account: if the owner or a staff member can still sign in, change the password, review MFA credentials and remove unknown passkeys, security keys or authenticator access.
- Contain server access: remove suspicious staff roles, revoke unnecessary Administrator and high-impact permissions, and disable unfamiliar bots or integrations.
- Preserve evidence: record unfamiliar role changes, audit-log entries, bot names, message links and approximate times before deleting everything.
- Warn members: tell members not to click links or follow instructions posted by the compromised account, and use a known-good announcement channel.
- Recover through Discord: if the account owner cannot regain access with a valid MFA method or backup code, use Discord’s support process. Discord states that lost backup codes cannot be restored by support.
- Rebuild trust: after recovery, regenerate backup codes, re-register trusted MFA credentials, review every role and integration, and ask staff to repeat the phishing check before normal operations resume.
Do not negotiate with a suspicious bot or attacker through the compromised account. Use a separate, known-secure account for member communication while the owner account is being recovered.
7. Keep the controls current
Review the owner account and staff access on a schedule that matches turnover. A practical review checks MFA enrollment, backup-code availability, registered passkeys or keys, Administrator assignments, role hierarchy, bot permissions, verification level and inactive staff accounts. Recheck Discord’s help pages when labels differ from these paths: the MFA guidance was shown as updated August 18, 2026 in the retrieved support result, while the passkey article is dated March 10, 2025 and marked updated; Discord’s roles, verification and bot guidance are also marked updated on their respective pages.
Free tools Windows power users keep installed
One-click scans. No signup required.
No official source cited here quantifies how many Discord takeovers these settings prevent or gives a percentage risk reduction. Their value is operational: strong owner authentication makes a stolen password less useful, least privilege limits what a compromised staff login can change, verification slows automated abuse, and phishing training removes common paths to credential theft.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
