Security Settings

What RestoreCord asks Discord for, extra verification checks, logging and who can use the bot's commands. See How Verification Works for how these fit into the verify flow.

Go to Security

How the tab is laid outCopy Anchor Link

• User Grants: IP Logging and the three Discord permissions (scopes) members are asked for.
• Verification Hardening: Captcha and Minimum Account Age.
• Discovery & Listing: Private Server and NSFW Server.
• Logging: Discord Webhook Logs and Custom Webhook.
• Manage Permissions: who can use the bot's commands.

Switches and fields are saved with the tab's Save button. Custom log designs and Manage Permissions are the exception: they save as soon as you change them.

IP LoggingCopy Anchor Link

Records the member's IP address when they verify. On by default.

When it is on, each member record stores the IP plus the details looked up from it: ISP, ASN, state, city, country and whether it is a VPN. That is what you see in member details and what the IP and location fields in webhook logs and the ip field in custom webhook events are built from.

When it is off:

• None of the above is saved for new verifications, and webhook logs and custom webhook events carry no IP. The Client IP field in webhook logs and firewall logs reads IP Logging off.
• The verify page shows a green globe badge next to your server name with the tooltip “Your IP address will NOT be logged or saved.”

Access EmailCopy Anchor Link

Requires Business or higher.

Adds the email scope to the Discord authorization, so each verified member's email address is saved with their member record (up to 191 characters).

• Members see the extra permission on Discord's authorization screen.
• With this on, returning members can no longer skip Discord's authorization screen.
• In webhook logs, members get Email, Email Verified and Discord 2FA fields.
• If you are below Business, the switch can be turned off but not back on.

The email scope is also requested whenever you have an active firewall rule that checks email domains, even with this switch off.

View Server MembershipsCopy Anchor Link

Requires Business or higher.

Adds the guilds scope to the Discord authorization, so RestoreCord can read the list of Discord servers each member is in when they verify.

• Members see the extra permission on Discord's authorization screen, and returning members can no longer skip that screen.
• Webhook logs get a Servers field with the member's server count, linking to the member in your dashboard.
• On plans below Business the setting is switched off when you save.

The guilds scope is also requested whenever you have an active firewall rule that checks server membership, even with this switch off.

Join Servers For UserCopy Anchor Link

Adds the guilds.join scope to the Discord authorization, which lets your bot add members to servers. On by default.

• Turning it off also switches off Add verified members in the form.
• You cannot save it off while Multi-server pulling has servers configured. Remove them first.

CaptchaCopy Anchor Link

Adds an hCaptcha challenge to verification to stop bots. Off by default, and available on every plan.

1. The member authorizes with Discord as usual.
2. If they have not solved a captcha recently, they are sent back to the verify page with the message “Verification requires solving a captcha on this server. Please complete the captcha to proceed.”
3. Once they solve it, they are sent on to Discord again and verification continues.

• A solved captcha counts for 12 hours.
• Members who have already verified in this server skip it, and so do members who have been given a bypass.
• It adds a step, so verification takes a little longer.

Minimum Account AgeCopy Anchor Link

Requires Enterprise or higher.

Blocks Discord accounts younger than the number of days you set, which catches freshly created alts. The age comes from the account's creation date in its Discord ID.

• Set it with the slider from 0 to 365 days, in steps of 1. 0 turns the check off, and is the default.
• Blocked members see error 990035: “Your account is too new. You can try again in…” followed by how long they have to wait.
• Blocked attempts appear as Blocked Account Age in webhook logs and as a member.denied event with reason account_age on your custom webhook.
• Members who have been given a bypass skip the check.

Private ServerCopy Anchor Link

Requires Premium or higher.

Locks down your public pages:

• The verify page no longer shows the Verify button, and its Discord server and bot IDs are hidden.
• The verify page, public server page and review page ask search engines not to index them.

Members cannot verify through the verify page while this is on, so only use it when you do not want new verifications there.

Your Discovery listing has its own switch. Turn Discovery off as well if the server is listed.

On Free the switch can be flipped, but it is turned off again when you save.

NSFW ServerCopy Anchor Link

Requires Premium or higher.

Marks the server as 18+. Off by default.

• Before showing the server icon, background or description, the verify page asks “This server is marked as NSFW. Are you 18 years of age or older?”
• Yes shows the page and is remembered on that device for 7 days. No leaves the page.
• To request the verified badge you must confirm your server is family-friendly, so NSFW servers do not qualify.

On Free the switch can be flipped, but it is turned off again when you save.

Discord Webhook LogsCopy Anchor Link

Posts a message to a Discord channel when a member verifies, is blocked, triggers a firewall rule or is given a bypass. Available on every plan. See Webhook Logs for what each message contains.

Turning the switch on reveals the settings below. Turning it off clears the webhook URL when you save.

Member logs include the member's ID, account age, device and the details allowed by the settings below. On Business and Enterprise they can also include connection type, VPN status and a bot score.

Discord WebhookCopy Anchor Link

Found inside Discord Webhook Logs.

The Discord webhook URL logs are sent to. Create one in Discord under Channel Settings → Integrations → Webhooks and paste its URL.

• It must be a Discord webhook URL like https://discord.com/api/webhooks/<id>/<token>. discordapp.com, canary. and ptb. URLs are accepted too.

Show Information in Webhook LogsCopy Anchor Link

Found inside Discord Webhook Logs.

Shows the member's IP address, location and email in webhook logs. On by default. The IP is posted behind a spoiler.

When it is off, those values appear as Hidden. The ISP is still shown. IP and location are only available when IP Logging is on, and email only when Access Email is on.

Display Account BadgesCopy Anchor Link

Found inside Discord Webhook Logs.

Requires Premium or higher.

Adds a Discord Badges field to webhook logs with the member's profile badges. If they have none, Nitro and avatar decoration are listed instead. Off by default.

The switch is disabled while Discord Webhook Logs is off. If you are below Premium, it can be turned off but not back on.

Custom log designsCopy Anchor Link

Found inside Discord Webhook Logs.

Replaces the built-in log messages with your own Message Studio designs. Each log type has its own slot:

• Click a slot to open it in Message Studio. Slots with a design show a Custom badge.
• Default message goes back to the built-in version.
• Assignments save straight away, separately from the Save button.
• If a custom design fails to render, the built-in message is sent instead.

Custom WebhookCopy Anchor Link

Requires Enterprise or higher.

Sends structured JSON events to your own HTTPS endpoint so you can connect your own systems. See Webhooks for the payload format.

• The URL must start with https://.
• Each request is a POST with the headers X-Webhook-Event (the event name) and X-Signature-256 (sha256= plus an HMAC-SHA256 of the body, signed with your Webhook Secret).
• Events include member.verified, member.denied, member.deauthorized, firewall.allow, firewall.block, firewall.password and snapshot.create.
• Requests time out after 5 seconds and are not retried.
• Turning the switch off clears the URL and its secret when you save.

Webhook SecretCopy Anchor Link

Found inside Custom Webhook.

Requires Enterprise or higher.

The secret your endpoint uses to check that requests really come from RestoreCord. A new 32-character secret is generated whenever you save a new webhook URL.

Regenerate Secret creates a new secret, and the old one stops working at once. It needs a saved webhook URL.

Manage PermissionsCopy Anchor Link

Who can use the bot's commands in your Discord server. With no entries, only the server owner can. See Bot Commands.

Click Add Permission, choose a type, then tick at least one permission:

• User: enter a Discord user ID, 17 to 19 digits.
• Role: pick a role from your server. Bot-managed roles are not listed. If roles cannot be loaded, you can enter a role ID by hand.

• Entries save straight away, separately from the Save button.
• Saving an entry for a user or role that already has one replaces its permissions.
• Deleting an entry asks for confirmation and removes all of that user's or role's permissions.