Security
Anti-nuke off the audit log — 26 protections with limits, punishments and an undo that rebuilds what was destroyed — plus risk-scored anti-raid, Join Guard and chat protection.
On this page
Moderation watches people. Auto Moderation watches messages. Security watches the audit log — which means it watches the people with power over your server, and it is the only system in Arclo that puts back what was destroyed.
Security
Anti-nuke limits on everybody with power, raid defence, Join Guard and a threat level that tightens them all at once.
Watches the audit log, not the chat.
EnabledMembers
Mass removals and mass pings — the loudest half of a nuke.
Anti Banputs it back
3 bans in 1m → quarantine
Anti Unbanputs it back
5 unbans in 1m → quarantine
Anti Kick
5 kicks in 1m → quarantine
Anti Prune
1 prune in 5m → ban them
26 protections read the audit log · each one has a limit, a punishment and an undo
The two-minute version
Switch it on → put yourself and your legitimate bots on Full bypass → enable the destructive protections (channel delete, role delete, mass ban, mass kick) at their default limits. Everything else can wait.
The nine tabs
| Tab | What lives there |
|---|---|
| Overview | What Security has seen and done — the feed, and the current threat level |
| Anti-Nuke | The protections, grouped into six categories |
| Trust levels | Trust tiers: who is bypassed, trusted, standard or watched |
| Threat response | How the threat level tightens every limit at once |
| Anti-Raid | Risk scoring, the threshold, and what raid mode does |
| Join Guard | The door — filters that run on every arrival |
| Chat protection | Flood, copypasta, invite links and ghost pings |
| Logging & alerts | The alert channel, the roles it pings, and the Security logger |
| Commands | /security and its operations |
Anti-nuke
26 protections across six categories — channels, roles, members, the server itself, bots and webhooks, and expressions. Each one is a limit, a window, a punishment and an undo.
- Limit and window
- Three channel deletions in sixty seconds. Below that, nothing happens.
- Punishment
- What happens to whoever crossed it. Seven to choose from: Alert only, Time them out, Take the dangerous roles, Take every role, Quarantine, Kick them, Ban them.
- Undo
- Rebuild what was destroyed. Discord records a deleted object's properties on the audit entry, so Arclo can put the channels, roles and permissions back.
- Score
- How much this protection contributes to the server's threat level.
| Punishment | What it does |
|---|---|
| Alert only | Log it and ping your staff. Nothing happens to them — right for a protection you are still tuning. |
| Time them out | Discord's own timeout. They keep their roles but cannot talk, react or join voice. Filed through Moderation, so its mute DM and case settings apply. |
| Take the dangerous roles | Removes only the roles granting Administrator, Manage Server, Manage Roles and the rest. They keep their color and their access. |
| Take every role | Everything Arclo can reach. Blunt, but it leaves them in the server to answer for it. |
| Quarantine | Every role off, one deny-everything role on, and the set they had remembered — so you can hand it back with one command once they have their account again. |
| Kick them | They can come back on a new invite, with whatever Auto Roles gives them. Filed through Moderation, so its kick DM and case settings apply. |
| Ban them | The end of it. Filed through Moderation, so its ban DM, case and appeal-link settings apply like any other ban. |
The actor is stopped before anything is rebuilt
Reverting first would hand an attacker who still holds Administrator a freshly rebuilt server to delete again. Arclo punishes, then reverts — oldest change first, so channels come back roughly where they were.
Arclo never counts its own actions
Every punishment Arclo hands out appears in the audit log with Arclo as the actor. A system that counted those would ban ten raiders and then quarantine itself.
Trust tiers
Who somebody is decides how the same limit applies to them.
| Tier | Effect |
|---|---|
| Full bypass | Never counted, never punished, not even in Lockdown. Reserve it for you and for apps that legitimately restructure the server. |
| Trusted | Still watched, but with room to work — every limit is multiplied. Where your real staff belong. |
| Standard | Your limits, exactly as you wrote them. What everybody who is not on the list gets. |
| Watched closely | Tighter limits than everybody else. For a new moderator, or an account you already have doubts about. |
Watched closely is the default for bots, which are the commonest nuke vector. Everybody else is Standard until you say otherwise.
Put your own account on Full bypass first
Otherwise the first thing a newly enabled anti-nuke does is quarantine the admin who was reorganising the channel list.
Threat level
A single decaying score for the server that modulates the limits you already set rather than running a second ladder. At elevated every limit tightens to a percentage of itself; at lockdown the first occurrence acts. There is only ever one answer to “why was this person quarantined?”
A hold time stops the level flapping and re-locking the server every few seconds.
Anti-raid
Counting joins fails in both directions: a popular hour trips it, and a patient raid never does. Arclo scores each arrival instead — account age, missing avatar, how fast they arrived after the last one, machine-made names, an empty profile, and the strongest signal of all, a shared account creation day.
- Raid mode starts when the window's total score crosses your threshold, and lifts on its own.
- Retroactive handling is what makes it work: by the time a threshold is crossed, most of the raid is already inside, so Arclo goes back over the arrivals that led to it.
- Raid mode can lock the server, tighten Join Guard, and announce itself. It lives here rather than in Auto Moderation precisely because it locks channels — and two systems able to do that independently would be two answers to “what were this channel's permissions before?”
Join Guard
The door. Up to ten filters, each a set of conditions that must all match and a list of actions run in order.
- Conditions cover account age (both ends of a band), specific creation dates, missing avatar, name patterns including regular expressions and invite links, unreadable names, machine-generated name shapes, server tags, unverified bots, and a blocklist of user ids.
- Actions cover kicking, banning, quarantining, giving roles, notifying staff and DMing the arrival. A DM action always runs first, whatever order you put it in — otherwise a “kick, then DM” filter notifies nobody.
- Filters are independent and first-hit wins, so each one can carry its own reason.
- A filter with no conditions never matches, on purpose.
Arrivals belong to Security; renames belong to Auto Moderation
The rule is: at the door, Join Guard checks the name. After a rename, Auto Moderation's username filter checks it. They deliberately overlap a little so either system is useful without the other, and each page says so where it happens.
Chat protection
Not a copy of Auto Moderation's filters — these are questions about a room rather than about a message:
- Flood — N messages from M different accounts in a window.
- Copypasta — the same text from several different members.
- Invite links — every code is resolved before anything is done about it.
- Ghost pings — a mention in a message that no longer exists. Nothing else in Arclo can catch this, because the evidence is gone.
The feed
The Overview tab keeps a live record of what Security saw and did: who tripped what, how far over the limit they were, what happened to them, and whether the undo ran.
Commands
/security statusAdministratorsThreat level, what is locked, what tripped today, and anything Arclo is currently unable to do.
/security lockdown <on|off> [reason]AdministratorsCannot be undoneForces the threat level to Lockdown, or drops it back — the first thing to reach for when a server is being nuked.
/security raid <on|off> [reason]AdministratorsTurns raid mode on or off by hand, for when you can see it coming before the detector can.
/security unlockAdministratorsOpens everything Security locked and puts every channel back exactly as it was — including the ones that were already private.
/security quarantine <member> [reason]AdministratorsCannot be undoneTakes every role off a member and gives them the quarantine role, with the set they had remembered.
/security release <member>AdministratorsEnds a quarantine and gives back every role that was taken.
/security check <member>AdministratorsWhat Security would actually do about this member — their trust tier, the limits that apply to them, and anything putting them outside Arclo's reach.
/security events [member] [limit]AdministratorsThe last things Security did — what tripped, who did it, what happened to them and what was put back.
/security whitelist add <target> [tier] [note]AdministratorsPuts a member or a role on the whitelist at a trust tier — full bypass, trusted, or watched closely.
/security whitelist remove <target>AdministratorsTakes a member or a role off the whitelist.
/security whitelist listAdministratorsEverybody the whitelist covers, and at which tier.
Requirements
Without View Audit Log, Security cannot work
The entire anti-nuke half reads the audit log. If Arclo loses that permission, the protections stop seeing anything — Arclo logs the problem, but there is nothing else it can do.
Still stuck? Ask in the support server — somebody there has almost certainly configured this before.