Security
Anti-nuke off the audit log (26 protections with limits and punishments, most of them with an undo that rebuilds what was destroyed) plus risk-scored anti-raid, Join Guard and chat protection.
On this page
Moderation watches people. Auto Moderation watches messages. Security watches the audit log: which means it watches the people with power over your server, and it is the only system in Arclo that puts back what was destroyed.
Security
Auto Moderation defends your server from its members. This defends it from the people and apps that have power over it. Your administrators, your moderators, your bots, and whoever ends up holding one of their accounts.
Members
Mass removals and mass pings. The loudest half of a nuke.
Roles
The quiet half. A role handed the wrong permission is how somebody gets the power to do everything else.
Channels
Deleted, replaced, or quietly opened up to everybody.
Apps & webhooks
The vector nobody watches. A webhook needs no account, survives a ban, and can post ten thousand times a minute.
Server
The identity itself. The vanity URL, the icon, the settings.
Emojis & stickers
Rarely fatal, always noticed. Cheap to watch and cheap to put back.
The two-minute version
Switch it on → on Trust levels, put the apps that legitimately restructure your server on Full bypass and your real staff on Trusted (the server owner already bypasses everything) → check the destructive protections (channel delete, role delete, mass ban, mass kick), which ship switched on at their default limits, as 21 of the 26 do. Everything else can wait.
The nine tabs
| Tab | What lives there |
|---|---|
| Overview | What Security has seen and done: the threat score, who is quarantined, and the feed |
| Anti-Nuke | The protections, grouped into six categories, and which permissions count as dangerous |
| Trust levels | Who is bypassed, trusted, standard or watched, and the quarantine role |
| Threat response | How the threat level tightens every limit at once |
| Anti-Raid | Risk scoring, the threshold, and what raid mode does |
| Join Guard | The door: filters that run on every arrival |
| Chat protection | Floods, copypasta waves, one member posting too fast, invite links and ghost pings |
| Logging & alerts | The alert channel, the roles it pings, and the Security logger |
| Commands | /security and its operations |
Anti-nuke
26 protections across six categories: Members, Roles, Channels, Apps & webhooks, Server and Emojis & stickers. Each one is a limit, a window and a punishment, and most of them also undo what was destroyed.
- Limit and window
- Two deleted channels in 60 seconds, Anti Channel Delete's default. Below the limit nothing happens to anybody, though each occurrence still adds to the threat score.
- Punishment
- What happens to whoever crossed it. Seven to choose from: Alert only, Time them out, Take the dangerous roles, Take every role, Quarantine, Kick them, Ban them.
- Put it back
- Rebuild what was destroyed. Discord records a deleted object's properties on the audit entry, so Arclo can put the channels, roles, permissions and names back. A protection with nothing to undo (a kick, a prune) has no switch.
- Threat score
- How much one occurrence adds to the server's threat level.
| Punishment | What it does |
|---|---|
| Alert only | Log it and ping your staff. Nothing happens to them. Right for a protection you are still tuning. |
| Time them out | Discord's own timeout. They keep their roles but cannot talk, react or join voice. Filed through Moderation, so its mute DM and case settings apply. |
| Take the dangerous roles | Removes only the roles granting Administrator, Manage Server, Manage Roles and the rest. They keep their color and their access. |
| Take every role | Everything Arclo can reach. Blunt, but it leaves them in the server to answer for it. |
| Quarantine | Every role off, one deny-everything role on, and the set they had remembered, so you can hand it back with one command once they have their account again. |
| Kick them | They can come back on a new invite, with whatever Auto Roles gives them. Filed through Moderation, so its kick DM and case settings apply. |
| Ban them | The end of it. Filed through Moderation, so its ban DM, case and appeal-link settings apply like any other ban. |
Two switches cover the whole tab, both on by default: Watch administrators too, because an administrator nothing is counted against is the account that can do the most damage, and Put things back even when Arclo could not punish the actor.
The actor is stopped before anything is rebuilt
Reverting first would hand an attacker who still holds Administrator a freshly rebuilt server to delete again. Arclo punishes, then reverts. Oldest change first, so channels come back roughly where they were.
Arclo never counts its own actions
Every punishment Arclo hands out appears in the audit log with Arclo as the actor. A system that counted those would ban ten raiders and then quarantine itself. What Arclo does on a member's command is that member's, though: bans, unbans and kicks through Arclo's commands, roles given with /role, and emoji added or removed with /emoji count against whoever ran them, exactly as if they had done it by hand. Locks and lockdowns don't count.
Trust levels
Who somebody is decides how the same limit applies to them.
| Tier | Effect |
|---|---|
| Full bypass | Never counted, never punished, not even in Lockdown. Reserve it for you and for apps that legitimately restructure the server. |
| Trusted | Still watched, but with room to work. Every limit is multiplied. Where your real staff belong. |
| Standard | Your limits, exactly as you wrote them. What everybody who is not on the list gets. |
| Watched closely | Tighter limits than everybody else. For a new moderator, or an account you already have doubts about. |
Watched closely is the default for apps, which are the commonest nuke vector. Everybody else is Standard until you say otherwise, and the server owner bypasses everything unless you switch that off. Trusted limits are multiplied by 3 and watched ones cut to 50%, both adjustable. The list takes members and roles, up to 250 entries.
Put your admins on a level first
The owner is bypassed by default, but nobody else is. Otherwise the first thing a newly enabled anti-nuke does is quarantine the admin who was reorganizing the channel list. Trusted gives real staff room to work and still catches a stolen account.
Quarantine is set up on the same tab: every role off, one deny-everything role on, and the roles they had remembered. Arclo makes the role the first time it needs one. Release somebody from the Overview tab or with /security release, and their roles come back; a quarantine can also lift itself after a while, and the member is DMed why it happened.
Threat level
A single decaying score for the server that modulates the limits you already set rather than running a second ladder. Every occurrence adds its protection's threat score, and the score sheds 5 points for every quiet minute. At Elevated (30 points by default) every limit tightens to 50% of itself and your staff are pinged; at Lockdown (70) the first occurrence acts, every protection's punishment becomes Quarantine, and the server can be locked, Discord's verification level raised and invites paused. There is only ever one answer to “why was this person quarantined?”
A level holds for 10 minutes after the score falls back, so the server does not flap in and out of lockdown mid-attack. /security lockdown forces Lockdown by hand, and drops it again.
Anti-raid
Counting joins fails in both directions: a popular hour trips it, and a patient raid never does. Arclo scores each arrival instead. Account age, missing avatar, how fast they arrived after the last one, machine-made names, an empty profile, and the strongest signal of all, a shared account creation day.
- Raid mode starts when the arrivals in the window (5 minutes by default) add up past your threshold (120), and turns itself off after 15 quiet minutes.
/security raidswitches it by hand. - Retroactive handling is what makes it work: by the time a threshold is crossed, most of the raid is already inside, so Arclo goes back over the arrivals that led to it.
- Raiders get decides what happens to them (Kick them by default), but an arrival scoring under 12 is left alone even mid-raid, and accounts with Discord badges and verified apps are let through.
- Raid mode can lock the server and raise Discord's verification level (both on by default), pause invites, ping your staff, and DM the arrivals why. It lives here rather than in Auto Moderation precisely because it locks channels, and two systems able to do that independently would be two answers to “what were this channel's permissions before?”
Join Guard
The door, off until you switch on Enable Join Guard. Up to ten filters, each a set of conditions that must all match and a list of actions.
- Conditions: account age, account creation date, default avatar, generated name, name matches, has guild tag, unverified app, is an app, no profile badges, on your blocklist and raid risk score. Account age takes both ends of a band, and a name can be matched on words, regular expressions, invite links and unreadable characters.
- Actions: add a role, send them a DM, post in a channel, report to moderators, rename them, warn them, mute them, kick them, ban them and quarantine them. A DM action always runs first, whatever order you put it in: otherwise a “kick, then DM” filter notifies nobody.
- Filters run top to bottom and every one that matches acts, each with its own reason. Stop after this filter is on for a new filter, so by default the first match is the last; switch it off and one arrival can get a role from one filter and a ban from a stricter one below. Nothing runs after a member has been removed.
- A filter with no conditions never matches, on purpose.
Arrivals belong to Security; renames belong to Auto Moderation
The rule is: at the door, Join Guard checks the name. After a rename, Auto Moderation's username filter checks it. They deliberately overlap a little so either system is useful without the other, and each page says so where it happens.
Chat protection
Not a copy of Auto Moderation's filters. These are mostly questions about a room rather than about a message:
- Channel flood (on by default): 30 messages in 10 seconds from at least 5 different accounts. Arclo slows the channel down, deletes the flood and times out who took part; it can lock the channel too.
- Copypasta wave (on): the same text from 4 different members within 30 seconds.
- One member, too fast (off): the one per-member limit, here so Security still works with Auto Moderation switched off.
- Invite links (off): every code is resolved before anything is done about it, and invites to your own server are fine.
- Ghost pings (off): a mention in a message deleted, or edited away, within a minute. Nothing else in Arclo can catch this, because the evidence is gone; Arclo can post the recovered mention back in the channel.
Every hit also adds to the threat level.
The feed
The Overview tab keeps a live record of what Security saw and did, 30 days back: who tripped what, how far over the limit they were, what happened to them, and whether the undo ran. /security events shows the same from Discord.
Commands
/security statusAdministratorsThreat level, what is locked, what tripped today, and anything Arclo is currently unable to do.
/security lockdown <on|off> [reason]AdministratorsCannot be undoneForces the threat level to Lockdown, or drops it back. The first thing to reach for when a server is being nuked.
/security raid <on|off> [reason]AdministratorsTurns raid mode on or off by hand, for when you can see it coming before the detector can.
/security unlockAdministratorsOpens everything Security locked and puts every channel back exactly as it was, including the ones that were already private.
/security quarantine <member> [reason]AdministratorsCannot be undoneTakes every role off a member and gives them the quarantine role, with the set they had remembered.
/security release <member>AdministratorsEnds a quarantine and gives back every role that was taken.
/security check <member>AdministratorsWhat Security would actually do about this member. Their trust tier, the limits that apply to them, and anything putting them outside Arclo's reach.
/security events [member] [limit]AdministratorsThe last things Security did. What tripped, who did it, what happened to them and what was put back.
/security whitelist add <target> [tier] [note]AdministratorsPuts a member or a role on the whitelist at a trust tier. Full bypass, trusted, or watched closely.
/security whitelist remove <target>AdministratorsTakes a member or a role off the whitelist.
/security whitelist listAdministratorsEverybody the whitelist covers, and at which tier.
Requirements
Without View Audit Log, Security cannot work
The entire anti-nuke half reads the audit log. Without that permission Discord sends Arclo nothing to read, and the protections stop seeing anything. The Security page warns you when it is missing, and so does /security status.
To act, Arclo also needs Manage Roles, Ban Members, Kick Members, Timeout Members and Manage Channels, and its role has to sit above anybody it should be able to stop.
Still stuck? Ask in the support server: somebody there has almost certainly configured this before.