Protection overview
Understand the four systems that defend a server, what each one watches, and the order to set them up in.
Righteous defends a server with four separate systems. They don't overlap, and each one answers a different worry. Anti-nuke watches privileged actions. Anti-raid watches joins. The message filters watch what people post. The trap channel catches automated spam that walks into a channel nobody should be posting in.
You don't need all four. You do need to know which one covers the thing you're worried about, because arming the wrong one leaves the gap exactly where it was.
Audit it before you need it
The single most useful command in this section
,antinuke check tells you whether protection
will actually fire — before anything gets nuked. It reads your live configuration and reports
every reason a rule would do nothing. Run it after every change you make on this page.
A server can look fully configured and still be completely inert. A missing permission, a role sitting above the bot, a log channel that quietly stopped accepting messages, a punishment that removes nothing. The check names each one. It takes no arguments, changes nothing, and is covered in full in the Anti-nuke guide.
Run it early. A clean report is the only evidence that any of this is working.
Pick the system that matches the worry
| System | Watches | Who can configure it | Guide |
|---|---|---|---|
| Anti-nuke | Channel, role and emote deletions, bot invites, permission grants, bans and kicks, webhooks, vanity URL changes | Server Owner | Anti-nuke |
| Anti-raid | Members joining — burst joins, young accounts, default avatars | Administrator | Anti-raid |
| Message filters | Message content — words, links, invites, music files, mass mentions | Manage Messages | Message filters |
| Trap channel | Anyone who posts in a channel you designate | Manage Server | Trap channel |
Anti-nuke is the one with the highest permission bar, and that's deliberate. Its settings are gated on being the actual server owner rather than on Administrator, because Administrator can be handed out — including by Righteous' own fake permissions system.
Give the bot what it needs before you arm anything
Protection that's configured but can't act is worse than protection that's off, because it reads as covered. Four things have to be true.
View Audit Log. Anti-nuke detects nothing without it. Every rule you arm stays inert until the bot holds that permission at the server level.
A role above the people it may need to punish. Righteous can't ban, kick or strip anyone whose highest role sits at or above its own. A tie is as unpunishable as being outranked.
The permission each punishment needs. Ban Members for ban, Kick Members for kick, Moderate
Members for timeout, Manage Roles for stripstaff, mute and jail.
Somewhere to report. Set a protection log with
,antinuke log <channel>. Without one, anti-nuke and
anti-raid incidents fall back to the general log channel from
,config logchannel. The server owner is also
DMed, but those are rate-limited on purpose, so a large incident produces one DM rather than
hundreds. Filter actions and trap catches use the general log channel rather than the protection log.
Set them up in this order
Set the protection log
,antinuke log #protection-logs. Do this
first so every later change has somewhere to report from.
Whitelist your own staff
,antinuke whitelist add <user|role>.
An empty whitelist means nobody is exempt, including the people who legitimately delete
channels.
Arm anti-nuke rules as warn first
A warn rule posts the incident and does nothing to the member. Watch what it catches for a
day, then change the punishment.
Run the audit
,antinuke check. Fix every fail before
you trust anything.
Add anti-raid, filters and the trap as you need them
These three are independent of anti-nuke and of each other. Add whichever one matches a problem you actually have.
Know which punishments each system offers
The four systems don't share one punishment list. Check the one you're configuring before you type a value.
| System | Punishments |
|---|---|
| Anti-nuke | warn, timeout, stripstaff, kick, ban |
| Anti-raid | warn, timeout, mute, jail, kick, softban, ban |
| Message filters | warn, mute, jail, stripstaff, kick, ban, or delete-only if you name none |
| Trap channel | softban (the default), ban, kick, timeout, mute, jail |
Three are worth explaining. stripstaff removes the roles on your
,staff list rather than removing the member, which is the
right answer when a moderator account is the problem. softban bans with a message purge and then
immediately unbans, so the spam goes and the account isn't permanently blocked. timeout is
Discord's own, needs no roles set up, and is trivial to undo.
mute and jail need their role configured first with
,config muterole and
,config jailrole.
Use warn as a dry run
Every system above accepts warn. On an automated protection path it does nothing to the member.
No DM, no role change, no timeout. Only the incident embed posts.
That makes it the safe way to try a rule you're unsure about. Arm it as warn, watch your
protection log for a few days, and only then give it a punishment that acts. A rule you turned off
because it surprised you once is worth less than one you tuned.