Recover a Nuked Discord Server

Is this your situation?

Do this first

Which situation is yours?

• Server fully deleted: a deleted server cannot be restored.
• Channels deleted by a hacked admin: you want to secure the account.
• Channels deleted by a compromised bot: you want the bot's access gone.
• Server owner missing and server was nuked: you want ownership recovered.
• Nuking still in progress: pause Invites or DMs while investigating unusual behavior.
• Unsure what caused it: an Activity Alert is a banner warning of unusual activity.

How Discord handles this

• Deleting a server cannot be undone once completed.
• A deleted server cannot be recovered.
• The member list and messages from a deleted server cannot be recovered or restored.
• Security Actions can be used to secure a server in the event of an incident, including pausing invites or DMs while investigating.
• An Activity Alert warns of possible unusual or heightened activity in a server, appearing as a banner if you are online.

Which recovery path is yours?

1. Is the whole server gone, not channels alone? The server has been deleted and cannot be recovered; a deleted server cannot be restored.
2. Are channels gone but the server itself still exists? Check the channel list and permissions for what remains of the deleted channels.
3. Is nuking still happening? Use Security Actions to pause invites or DMs while investigating unusual behavior.
4. Was an admin account compromised to cause this? You want to secure the account before taking any other step.
5. Do you see an Activity Alert about unusual activity? An Activity Alert appears as a banner to warn of possible unusual or heightened activity in the server.

What not to do

• Assuming a deleted server can be restored A deleted server cannot be recovered.Why it happens: Readers expect an undo option that does not exist for server deletion.
• Leaving a compromised admin account active You want to secure the account before taking other steps.Why it happens: Users focus on the lost channels and overlook the access that caused the loss.
• Not using Security Actions while a nuke is ongoing A user can use Security Actions to pause Invites or DMs while investigating.Why it happens: Readers do not know the feature exists until after the damage is done.
• Ignoring an Activity Alert banner You dismiss the banner without reading what it says.Why it happens: The banner catches your eye for only a moment before you move on.Already happened: If this already happened, check the alerts channel for a record of the alert.

What to have ready

• Does the server still exist at all? Check whether the server name and icon still appear in your server list.
• Which channels are missing? Check the channel list against what you remember existing.
• Is an admin account compromised? Check recent sign-in activity on admin accounts.
• Is a bot involved? Check the bot's recent actions in the audit log.
• Is nuking still active? Check whether new deletions are happening.
• Do you see an Activity Alert? Check for a banner warning of unusual activity.
• Who else has admin access? Check the Members tab for current role holders.
• Is two-factor authentication enabled on key accounts? Check Password and Authentication settings on each account.

Stop this happening again

Quick reference

Keeping track of who has access