Server Guard

Server Guard watches two things. Anti-nuke counts destructive administrative actions by one person in a short window (channel deletions, role deletions, bans and kicks) and responds when the count passes your threshold. Raid defence counts joins in a short window and, when too many arrive at once, puts the server into raid mode and holds the risky accounts.

Both write an incident to the dashboard and, if you give them a channel, post an alert in Discord with a button staff can press to undo the response.

1. 01Open Server Guard in the dashboard and switch it on.
2. 02Pick an Anti-nuke level and a Raid defense level. They decide the response, not the detection.
3. 03Set an alert channel. Without one, incidents are recorded but nothing is posted in Discord, and nobody can review from there.
4. 04Add your staff roles and your trusted roles. They do different jobs, and it is worth getting them the right way round.
5. 05Leave the thresholds alone to start with. The defaults are deliberate, and the fastest way to get false positives is to tighten them before you have seen how your server behaves.

Only the server owner and Administrators can change these settings or reverse an incident from the dashboard. A Bot Manager can see the settings and incidents, lock the server down and clear a raid.

Anti-nuke level

Low alerts only. Medium removes the dangerous roles (Administrator, Manage Server, Manage Channels, Manage Roles, Manage Webhooks, Ban Members, Kick Members) from the person who tripped it. High bans them from this server only.

Raid defense level

Low alerts only. Medium holds young accounts that have both the default avatar and a numbered name. High holds every young account for at least 7 days. Nothing is ever banned by raid defense.

Anti-nuke thresholds

Channel deletions and role deletions default to 4, bans and kicks to 6 (never below 3), all counted inside a window that defaults to 15 seconds, by when Discord recorded each action.

Act on mass bans and Act on mass kicks

Off by default: a burst of bans or kicks only alerts. Turn one on to give it the anti-nuke level response.

Raid join threshold and window

10 joins within 10 seconds by default arms raid mode.

Min account age (days)

Seven days by default. During raid mode, only accounts younger than this are held.

Raid mode duration (seconds)

How long raid mode stays armed once triggered. 900 by default.

Hold duration (seconds)

How long a held member stays timed out. 3600 by default. At High it is never less than 7 days.

Staff roles

Who may reverse an incident or clear a raid from the alert in Discord. Anyone with Manage Server can always do this, with or without a role here. Unum never hands out a staff or trusted role through role menus, auto roles or any other feature.

Trusted roles and trusted user IDs

Exempt from anti-nuke detection. This is exemption only. It does not let anyone reverse an incident.

At Medium the response is to neutralise: Unum removes the roles that carry a dangerous permission and leaves the rest. At High it bans them from this server only; it never spreads to linked servers. A case is written when the action worked, and an incident appears on the dashboard either way. At Low nothing is done beyond the alert.

Reversing a High-level incident lifts the ban. Reversing a Medium-level one gives back each role Unum took; if some cannot be restored (usually because they now sit above Unum), the rest still come back and you are told which ones to add by hand.

When enough accounts join inside the window, raid mode arms, an incident is recorded and the alert goes out. While raid mode is on, each new arrival is judged on its own.

• Account age is the gate at every level. An account older than your minimum is never touched, whatever else is happening.
• At Medium, a young account is held only when it has both signals: no profile picture and a username ending in four or more digits. A trailing year such as 1987 or 2009 does not count. A new member with an avatar or an ordinary name is left alone.
• At High, every young account is held for at least 7 days.
• At Low, nothing is held.

Held members are timed out, not removed, each one gets a DM explaining why (at Medium and at High), and Unum remembers who it held for as long as the hold lasts. Clear raid / release held on the alert, or Clear raid on the dashboard, ends raid mode and lifts the timeout on everyone still held. Bots that join are never held.

Raid mode also expires on its own after the raid mode duration, so a raid that is over stops holding people without anyone pressing anything.

You do not have to wait for the threshold. Lock server now on the dashboard, or /lockdown in Discord, arms raid mode immediately holding young accounts like Medium does, or like High if your raid defense level is High. On the free plan it still holds, at Medium. /lockdown-clear ends it and releases everyone held. Both commands are limited to Manage Server by default.

This is useful when you can see a raid being organised elsewhere, or when you want new young accounts held while your team deals with something. It works on every plan.

Nothing is posted in Discord

Either no alert channel is set, or Unum cannot post there. It needs View Channel, Send Messages and Embed Links. The incident is still on the dashboard either way.

The alert says the action failed

Detection worked but the response did not. The usual cause is role hierarchy: Unum cannot ban or strip roles from someone who outranks it, and it can never touch the server owner. See Permissions and role hierarchy.

Reverse says you do not have permission

In Discord, reversing needs Manage Server or a role listed under Staff roles. On the dashboard, Reverse needs the server owner or an Administrator. Trusted roles do not count. That list only exempts people from detection.

Anti-nuke never fires

On the free plan it does not run at all. On Plus, check the feature is switched on, that the person is not on the trusted lists, and that the threshold is reachable. Four deletions in fifteen seconds is quick work by hand.

Real new members were held during a raid

Lower the minimum account age, or move raid defense from High to Medium, where a young account needs both signals before it is held. Then clear the raid to release them.

A raid got through

Check how many joined and how fast. If the burst was slower than your window, either widen the window or lower the join threshold, and use /lockdown while you adjust.