Where is the 2FA requirement setting?

Server Settings > Safety Setup (owner only). The owner's account must have 2FA enabled to turn it on.

Should moderators have Administrator?

No. Give them only the moderation permissions they use.

Does this apply only to crypto servers?

No, but crypto servers are attacked most, so do it on day one.

How do I lock down Discord admin permissions so the server can't be hijacked?

Updated November 12, 2026 · Crypto & web3

Turn on the server's 2FA requirement for moderation actions, give Administrator to nobody but the owner, restrict Manage Webhooks, Manage Roles and Mention @everyone to one or two admins, and never give bots Administrator. With the 2FA requirement on, staff accounts without 2FA can't use permissions like Manage Roles, Manage Webhooks or Manage Threads.

High-risk permissions and who should have them
Permission	Risk if abused	Give to
Administrator	Bypasses every channel override	Owner only
Manage Webhooks	Post fake 'official' messages	1 to 2 admins
Manage Roles	Promote attacker accounts	Admins
Mention @everyone, @here	Push scam links to every member	Admins (announcements only)
Ban / Kick Members	Mass removal	Moderators, with an anti-nuke bot
Manage Server	Change vanity URL, settings	Admins

Monthly security check

Server Settings > Roles: check who has the six permissions above.
Server Settings > Integrations: remove unused bots and webhooks.
Audit Log: look for role changes and new webhooks you don't recognize.
Confirm every staff member still uses 2FA.

If a staff account is compromised

Remove the account's roles (or kick it) from an admin account.
Delete any new webhooks and messages it posted.
Post in #announcements: 'Ignore messages from X between times; we never DM.'
Review the audit log and rotate any bot tokens your team controls.
Report the account to Discord.

Quick answers

Where is the 2FA requirement setting?: Server Settings > Safety Setup (owner only). The owner's account must have 2FA enabled to turn it on.
Should moderators have Administrator?: No. Give them only the moderation permissions they use.
Does this apply only to crypto servers?: No, but crypto servers are attacked most, so do it on day one.

What to do next

The Crypto Project template sets these permissions on every role and includes the security checklist. $49 one-time.

Get the Crypto template Take the 6-question planner

Related guides

Sources

Checked: November 12, 2026. Discord changes features and menus often; if something looks different, the official help center is the source of truth. Discord Template Hub is not affiliated with Discord.