How to Protect Your Minecraft Server from Griefers and Attacks

A Minecraft server is only fun while it is safe. One griefer with TNT, one fake op or one bad plugin can wipe out weeks of building in a few minutes.

The good news is that most protection is free. In this guide, we will cover online mode, the whitelist, ops and permissions, anti-grief plugins, safe plugin sources, backups, updates, proxy security, DDoS basics and how to share access with friends.

By the end of this guide, you will know exactly which settings to change and which plugins to install to keep your server and your world safe.

Keep online-mode Turned On

online-mode in server.properties decides whether the server checks each player's Minecraft account when they join. Leave it on:

online-mode=true

With online-mode=false (a "cracked" server), the server checks nobody. Anyone can join with any username, including yours.

That is worse than it sounds. On an offline server, a player's UUID is generated from their username, so someone who types your name gets your UUID, your inventory and your op status (source: Minecraft Wiki).

Warning: The only normal reason to turn online-mode off is a backend server behind a proxy like Velocity, where the proxy checks accounts instead. We cover how to do that safely further down.

Turn On the Whitelist for Private Servers

If your server is just for friends, the whitelist is the strongest protection you have. Only players on the list can join.

Since Minecraft 26.3, new servers start with the whitelist on, because white-list=true is now the default. A server.properties file from an older version keeps its old value, so check yours (source: Minecraft Wiki).

Manage it from the console or in game:

/whitelist on
/whitelist add Steve
/whitelist remove Steve
/whitelist list

Also set enforce-whitelist=true. With it on, a player you remove from the list is kicked when the whitelist reloads, instead of staying online. Ops can always join, even when they are not on the list.

Be Careful with Op, Use Permissions Instead

/op gives a player permission level 4 by default (op-permission-level=4), which means every command, including /stop.

• Level 1: can build inside spawn protection
• Level 2: cheat commands and command blocks
• Level 3: player management, like /kick, /ban and /op
• Level 4: everything, including server management

Only op people you would trust with the whole server. For moderators and helpers, use a permissions plugin like LuckPerms, which runs on Paper, Purpur, Spigot, Fabric, Forge, NeoForge and Velocity.

Example: a "mod" group that can kick players, with Steve added to it:

lp creategroup mod
lp group mod permission set minecraft.command.kick true
lp user Steve parent add mod

Run /lp editor to manage groups in a web editor instead of typing commands. Our whitelist, ops and permissions guide goes deeper.

Stop Griefing Before and After It Happens

CoreProtect: see who did it and roll it back

CoreProtect logs block changes, container access and more. When something gets griefed, you can see who did it and undo it.

/co inspect
/co rollback u:Griefer t:2h r:50
/co restore u:Griefer t:2h r:50

Turn on /co inspect (or /co i) and click a block to see its history. The rollback example undoes everything "Griefer" did in the last 2 hours within 50 blocks of you. Use r:#global for the whole server, and /co restore if you rolled back too much (source: CoreProtect docs).

Land claims: GriefPrevention or Lands

On public servers, let players protect their own builds. With GriefPrevention, players claim land with a golden shovel by clicking two corners. They share it with /trust (full building), /containertrust (chests, animals and other containers) or /accesstrust (buttons, levers and beds). Lands is a popular alternative that manages claims through menus.

Vanilla also has spawn-protection (16 by default), which stops non-ops from building near spawn. It only works when the server has at least one op.

Only Install Plugins and Mods from Trusted Sites

Paper's own docs put it plainly: plugins "are given full and unrestricted access to not only your server but also the machine that it runs on" (source: Paper docs). A malicious jar can delete your world, op a stranger or steal data.

Download only from:

• Hangar (PaperMC's plugin site)
• Modrinth
• SpigotMC
• BukkitDev and CurseForge
• The developer's own GitHub releases

Never use "leaked" or cracked copies of paid plugins, and skip jars shared through random Discord links or video descriptions. Those are a well-known way for backdoors to end up on servers.

Even trusted sites can have bad days. In June 2023, the fractureiser malware was found in mods and plugins uploaded to CurseForge and BukkitDev (source: fractureiser investigation). Keep backups, and follow the news from the sites you download from. Our plugin install guide shows what to check before adding anything.

Keep Backups You Can Restore

CoreProtect fixes griefing, but it cannot fix a corrupted world, a deleted folder or a plugin that wrecks your data. Backups can.

• Take automatic backups on a schedule, at least daily on an active server.
• Keep a few older copies, not only the latest one.
• Keep at least one copy somewhere other than the server.
• Take a manual backup before every update.

On EternalZero, the Backups page can create, restore and lock backups and send them to Google Drive, and the Schedules page can run backups for you. Read our backup guide for the full process.

Keep Your Server Software Updated

Updates fix security holes, not only bugs. The best-known example is the Log4j vulnerability in December 2021, which put Java Edition clients and servers at risk of being compromised. Mojang told server owners to upgrade to 1.18.1, or apply a fix if they had to stay on an older version (source: Minecraft.net).

• Update your Paper or Purpur build regularly, after taking a backup.
• Update plugins and mods, especially after a Minecraft update.
• Remove plugins that are abandoned and no longer get updates.

Lock Down Proxies with a Forwarding Secret

On a network running Velocity, players connect to the proxy and the proxy checks their accounts. The backend servers run with online-mode=false.

The risk is that someone who can reach a backend directly skips that check. Modern forwarding fixes it with a shared secret, so a backend only accepts players sent by your proxy:

# velocity.toml
player-info-forwarding-mode = "modern"

# config/paper-global.yml on every backend
proxies:
  velocity:
    enabled: true
    online-mode: true   # match online-mode in velocity.toml
    secret: "paste the contents of forwarding.secret here"

Velocity creates the forwarding.secret file for you. Keep settings.bungeecord set to false in spigot.yml when you use modern forwarding. Velocity's docs call legacy BungeeCord forwarding "fundamentally insecure", so only use it when nothing except the proxy can reach your backends (source: Velocity docs).

DDoS Basics

A DDoS attack floods your server's address with junk traffic until real players cannot connect. Plugins cannot stop it, because the flood does its damage before it ever reaches Minecraft.

Protection has to happen on the network. Hosts with DDoS protection filter attack traffic before it reaches your server, which a home internet connection cannot do.

• If you self-host, players connect to your home IP. An attack can take your whole home internet offline.
• Don't post your home IP on server lists or public Discords. Use a host, or a tunnel or proxy service that hides it.
• On a network, only the proxy address should be public. Never share the backend addresses.

DDoS protection does not stop griefers or bots that join normally. That is the job of the whitelist, permissions and anti-grief plugins.

Give Friends Sub-User Access, Not Your Password

Sharing your panel login is risky. Anyone with your password can delete files, wipe backups or change the password and lock you out.

Use sub-users instead. On EternalZero, the Sub-users page lets you add a friend with only the permissions they need, for example the console and files but not backups or settings. Remove them when they stop helping.

Quick Security Checklist

Conclusion

You don't need everything on day one. For a private server, keep online-mode on, turn on the whitelist and set up automatic backups. That already stops most problems.

When you open your server to the public, add CoreProtect, land claims and a permissions plugin, and keep everything updated. Our essential plugins guide is a good next step.