Yes, you can be doxxed through Discord, though rarely by Discord itself: the company says it never shares your IP address with other users. Creators get exposed through what their profile and connected accounts reveal, links that record your IP address when you click them, open DMs from strangers, screen shares that flash personal details, and moderators holding more access than they need. Lock down your own account first, then the server.
How exposure actually happens on Discord
Discord's page of tips against spam and hacking states that it never shares your IP address with other users and warns that bad actors send malicious links, such as IP grabbers, to get it. That shifts the risk to things you and your community control. The usual routes are:
- Connected accounts shown on your profile. Discord's connections FAQ says visibility is on by default for most connections, except ones that tend to carry real names, such as Facebook and Spotify.
- Mutual servers and mutual friends, which stay visible even when your profile is private and can tie a creator account to a personal one.
- Activity sharing, which in most regions lets friends and people in your servers see what you are playing or listening to unless you limit it.
- Screen shares and streams where an email address, a note or an invite link appears on screen for a second.
- Links and files sent by members, including IP grabbers and downloads carrying malware.
- Direct messages, which anyone in a shared server can send you by default.
- A moderator account that gets phished, handing a stranger your member list, logs and private channels.
Discord's doxxing policy explainer bans sharing someone's personally identifiable information without permission and with intent to harm, and asks users to report and leave servers built around it. The rules help after the fact; the settings below cut the routes in advance.
Your own account: privacy checklist
Menu names move. Discord's current blocking and privacy settings article places DM and friend request controls under Content & Social, while its older safety library still refers to a Data & Privacy section, so if a path below does not match your app, search Settings for the setting's name.
- Turn off direct messages from server members, and when Discord asks whether to apply it to existing servers, say yes; otherwise you must change each older server's privacy settings one by one.
- Leave the DM spam filter on and keep sensitive media blocked for messages from people who are not your friends.
- Under Friend Requests, untick Everyone and allow only Friends of Friends, Server Members, or neither.
- Set your profile privacy to Friends Only, or to Friends & Small Servers Only, which Discord defines as servers with 200 or fewer members.
- Limit activity sharing to match, and switch it off per server for your community.
- In Connections, turn off “display on profile” for anything linked to your personal life, or remove the connection entirely.
- Turn on Streamer Mode with automatic enabling, so it switches on when streaming software runs and hides personal information and invite links while you are live.
- Add two-factor authentication to your account, which you need anyway to require it of your moderators.
- Keep your personal Discord account out of your creator server altogether, so the two never appear as mutual servers.
Server safety settings checklist
These settings live mostly under Server Settings, in Safety Setup and AutoMod. Some AutoMod spam rules require the Community feature to be switched on.
| Setting | Suggested choice for a creator server | What it protects against |
|---|---|---|
| Verification level | High, so new members wait 10 minutes before chatting, or Highest, which needs a verified phone, per Discord's verification levels page | Throwaway accounts joining to post your details and leave; note a verified phone number lets members skip the other requirements |
| Explicit media content filter | Medium or High, the levels Discord's raid guide recommends | Raiders posting shock images to drive members away |
| AutoMod custom keyword rule for your own details | Block message and send alert, with your legal name, street, suburb and phone number as terms | Your details appearing in a channel before a moderator can delete them |
| AutoMod mention spam rule | A low limit on unique mentions per message, with timeout as one of the responses | Mass pings used to spread a message across the whole server |
| Raid protection and CAPTCHA | Alerts sent to a private moderators' channel | Coordinated join raids, which Discord can answer with CAPTCHA for new joiners |
| Security Actions | Know where to find pause invites and pause DMs before you need them | An incident spreading while you investigate who is involved |
| Two-factor requirement for moderation | Switched on | A stolen moderator password being used to delete channels or ban members |
| Invite links | Expiring invites for public posts, with permanent links kept private | An old never-expiring invite circulating in places you do not control |
The keyword rule needs care. Discord's AutoMod FAQ says a rule matches exact terms by default and catches variations only when you add the * wildcard, so enter each spelling you expect, and avoid very short fragments that ordinary messages would trip. Its auto moderation guide notes that people with the Manage Server or Administrator permission set these filters up, which means they can also read your list. Keep those permissions to yourself, or enter partial details such as your street name without the number. The raid protection guide and the Security Actions page explain how to pause invites and DMs between non-friends during an incident.
Moderator role and permissions template
One account that can do too much is enough to expose a whole server. Give each role the least it needs, and review the list whenever someone leaves the team.
| Role | Who holds it | Permissions to grant | Permissions to withhold |
|---|---|---|---|
| Owner | You, on an account with two-factor authentication and a password nobody else knows | Everything, which ownership grants automatically | The login itself, from managers, assistants and partners |
| Admin (optional) | At most one long-standing, trusted person | Manage Channels, Manage Roles, View Audit Log, and Manage Server only if they run AutoMod | Administrator, which Discord says bypasses every channel permission |
| Moderator | Trusted regulars or paid team members who have read your rules | Manage Messages, Timeout Members, Kick Members, View Audit Log | Manage Roles, Manage Webhooks, Manage Server and mass mentions |
| Trial moderator | New helpers during a probation period you set | Manage Messages and Timeout Members in public channels only | Ban Members and access to paid or private channels |
| Bots | Only bots you have researched, from developers you trust | The specific permissions each feature needs, nothing broader | Administrator, which a compromised bot could use to wipe channels and roles |
| New members | Everyone until they reach a verified or regular role | View channels, send messages, add reactions | Embed Links and Attach Files, which keeps strangers' links and downloads out of chat |
Discord's guide to permissions on Discord explains why this matters. The Administrator permission grants every permission and bypasses channel-specific ones, so Discord suggests a role with the other permissions enabled instead; and when the server requires two-factor authentication for moderators, sensitive permissions such as Manage Server, Manage Roles, Manage Messages, Kick Members and Ban Members stop working for anyone without it. The same guide warns that when one member holds two roles with conflicting channel overrides, Discord resolves the conflict by allowing the permission, so test a muted role before relying on it. If you sell access to channels, our guide to Discord server subscriptions covers paid tiers, and our Patreon and Discord setup guide covers member roles synced from Patreon.
Links, files and IP grabbers
An IP address is not a street address, but it helps narrow down where someone is, which is why Discord keeps it from other users and why IP grabbers exist. Discord's safety advice is not to click unfamiliar or unexpected links, to run unfamiliar links through a site checker first, to expand shortened links so you can see where they go, and never to download files from people you do not know. Treat a link from a member who insists you open it right away, especially one promising a leak, a giveaway or proof of something about you, as likely bait.
For the server, Discord's announcement of its anti-spam and raid tools describes a suspicious link filter that runs in the background on Community servers and blocks links verified as harmful, such as phishing links. Because it relies on links already verified as harmful, a freshly made logging link can slip through, which is why the new-member role above withholds Embed Links and Attach Files until people have earned trust. If you stream with Discord open, our streamer safety tips cover stream delay and on-screen privacy.
If someone posts your details in your server
- Capture the message link, the poster's user ID and a screenshot before anyone deletes it.
- Delete the message, ban the account, and check whether it posted in other channels or threads.
- Use Security Actions to pause invites and DMs between non-friends if several accounts are involved.
- Report the account and message to Discord under its doxxing policy, and ask moderators not to repost or discuss the details.
- Add the exposed terms to your AutoMod keyword rule so repeat attempts are blocked.
- Work through our doxxing response plan for everything outside Discord, and our threat triage guide if the post came with threats.
The eSafety Commissioner's guide entry for Discord collects its reporting and safety links in one place. For marketing and community-building on the platform, rather than safety, see our Discord community guide, and for the public records that matter more than any app setting, our exposure audit.
Limitations of these settings
These steps reflect Discord's help and safety pages as we read them on 1 October 2026, and Discord renames menus and changes defaults often, sometimes by region. No setting stops a member from screenshotting your server, repeating what they saw somewhere else, or using details they learned outside Discord. AutoMod misses misspellings, images and coded references, and a verified phone number is not proof that an account is safe. Treat this as general safety information rather than legal advice; if someone threatens you or turns up at your home, contact police on 000 in Australia or your local emergency number.