Raid detection
The detector keeps a rolling list of join timestamps per server and compares it against your threshold and interval. The defaults are 10 joins inside 10 seconds; both numbers are yours to change, and the right values depend on how your server normally grows.
Separately, every joining account is checked against a minimum account age. An account below it is kicked, banned, timed out or given a role, whichever you configured - so the slow drip of week-old throwaway accounts is handled without any raid ever being declared.
When the join threshold trips, an alert goes to the channel you nominated, with the number of joins, the interval and the action taken.
What happens on a trip
- lockdown - SendMessages is removed from @everyone and restored automatically five minutes later, with a notice in both directions
- kick - everyone who joined inside the detection window is removed
- ban - the same set is banned, with the last minute of their messages deleted
- In every case the alert is posted first, so staff see the reason and not just the effect
Anti-Nuke
Anti-Nuke assumes the attacker is already inside. It caps how many times a single account can perform a destructive action in a window: channel deletion and creation, role deletion and creation, bans, kicks, webhook creation, emoji deletion and bulk role changes on members. The first seven are on by default, at three to five actions per twenty to thirty seconds.
When a cap is exceeded the offending account is punished according to your setting - roles stripped, kicked or banned - and the event is written to the log channel. Users and roles you trust can be whitelisted, and bots can be exempted.
Discord does not let a bot restrict the guild owner, so Anti-Nuke applies to everyone below that line, administrators included.
Backups as the recovery path
Anti-Nuke stops the bleeding; it does not undo what already happened. Recovery comes from the backup module, which stores snapshots of the server structure - channels, categories, roles and permissions - in your own database.
That is the argument for switching backups on before you need them rather than after. Message history is not recoverable either way; Discord does not expose it.