What is a configuration file?
Almost every piece of server software is controlled by configuration files: plain-text files that set how the software behaves without changing its code. A web server like Apache or Nginx is configured this way, a database like MySQL has its own configuration, and a Minecraft server is configured through a file named server.properties. Editing these files is the standard way to tune a server, and it is exactly what this page does for Minecraft.
What is server.properties?
server.properties is the main configuration file for a Minecraft Java Edition server. It is a list of key and value pairs, one per line, that control the game mode, difficulty, world generation, networking, and security. When the server starts, it reads this file to decide how to run. The Properties editor on this page lets you change these values from your browser, instead of downloading the file from the file manager, editing it by hand, and re-uploading it.
The key server.properties settings
A handful of settings do most of the work, and each one is identified by its exact key name. These are the ones you will reach for most:
| Setting | What it controls |
|---|---|
| gamemode | Survival, creative, adventure, or spectator |
| difficulty | Peaceful, easy, normal, or hard |
| max-players | How many people can be online at once |
| motd | The message shown next to your server in the list |
| pvp | Whether players can fight each other |
| spawn-protection | A radius near spawn only operators can build in |
| hardcore | Locks the world to a single life |
| view-distance | How many chunks are sent to each player (large performance impact) |
| online-mode | Verifies players against Mojang and Microsoft (keep this on) |
| white-list | Restricts joining to players you approve |
Performance settings and lag
Two settings have an outsized effect on performance: view-distance and simulation-distance. view-distance controls how many chunks are sent to each player, and simulation-distance controls how far out the server actively ticks entities and redstone. Both raise CPU and RAM use sharply as they climb, so a high value combined with many players is a common cause of lag on smaller plans. Lowering them, along with a sensible max-players cap, is the fastest way to hold more players on the same hardware without upgrading.
Security: authentication and online-mode
online-mode is the most important security setting. When it is true, the server verifies every player against Mojang and Microsoft's authentication servers, which proves each account is genuine and stops anyone from logging in as another player. Turning it off creates a "cracked" server that skips this check, which is why offline-mode servers are far more prone to impersonation, griefing, and ban evasion.
Unless you have a specific reason and a plugin to authenticate players yourself, leave online-mode on. It is the single line in this file that most directly protects your players from being impersonated.
Controlling who can join
Beyond authentication, server.properties controls access directly. white-list, when enabled, means only players you add to the list can connect, which is the simplest way to keep a private server private. enforce-whitelist goes a step further: when the whitelist is reloaded, it immediately kicks any connected player who is not on the list, so removals take effect at once instead of only on the next restart. spawn-protection reserves a radius around spawn where only operators can build. Combined with online-mode, a whitelist is the standard setup for a server that only trusted players should be able to reach.
RCON, query, and remote administration
enable-rcon turns on RCON, a protocol that lets you send server commands from outside the game. It is how monitoring dashboards, Discord bots, and automation scripts run commands such as restarting the server or broadcasting a message without a person typing them. Because RCON grants full command access, it is a security-sensitive feature: always set a strong rcon.password, and never expose the RCON port to the public internet. On a managed panel most of this is handled for you through the console, so you rarely need to enable RCON yourself.
enable-query is the read-only counterpart. It turns on the query protocol on query.port, which exposes live data such as your player count, version, and status to server-list sites, uptime monitors, and status dashboards, without granting any command access. Like RCON, its port should be considered carefully before you expose it publicly.
Editing server.properties safely
A single bad value can stop the server from booting, so a few habits help. Take a backup before a large change, so you can roll back if a setting misbehaves. Remember that most changes only take effect after a restart, because the file is read at startup. And keep the format intact: each line is key=value with no quotes and no spaces around the equals sign, since a typo in the syntax can make the server ignore the setting or fail to start.