Whitelist, Ops and Permissions: Who Can Do What on Your Server

Most server disasters start with access. Someone joins who shouldn't, or a friend gets op "just to help" and, one wrong command later, half the spawn is gone.

Minecraft gives you three layers of control: the whitelist decides who can join, ops decide who gets admin commands, and a permissions plugin lets you hand out exactly the commands each person needs. In this guide, we will cover the whitelist commands and settings, what each op level allows, why you shouldn't op everyone, a starter LuckPerms setup and how to give staff panel access without sharing your password.

By the end of this guide, you will know how to set up access so your friends and staff can do their job and nothing more.

The Whitelist: Who Can Join

The whitelist is a list of players allowed to join. Anyone not on it is turned away with "You are not white-listed on this server!".

It is controlled by white-list in server.properties. Since Minecraft 26.3, a newly created server.properties has it set to true, so new servers start with the whitelist on (source). Older servers keep whatever value is already in their file.

Whitelist commands

Type these in the console without the slash, or in game with a slash. They need op level 3.

whitelist add Steve
whitelist remove Steve
whitelist list
whitelist on
whitelist off
whitelist reload

• With online-mode=true, use the player's real Java account name.
• You can add or remove players while they are offline.
• The list is saved in whitelist.json. If you edit that file by hand while the server runs, use whitelist reload.
• Ops can always join, even when they are not on the list.

Source: Minecraft Wiki: /whitelist.

white-list vs enforce-whitelist

For a private server, turn both on. Then removing someone from the list actually removes them.

Tip: Bedrock players joining through Geyser and Floodgate are added with fwhitelist add Name instead. See How to Let Bedrock Players Join Your Java Server.

Ops: The Built-In Admin System

An operator (op) is a player with access to admin commands. You give and remove it with:

op Steve
deop Steve

Ops are not all equal. Each op has a permission level from 1 to 4, and /op gives the level set in op-permission-level in server.properties. The default is 4, the highest.

Sources: Minecraft Wiki: permission level, Minecraft Wiki: commands. Regular players are level 0 and can use commands like /list, /msg and /me.

ops.json

Ops are stored in ops.json. Each entry has the player's UUID, name, level and bypassesPlayerLimit, which lets them join a full server (source).

[
  {
    "uuid": "123e4567-e89b-12d3-a456-426614174000",
    "name": "Steve",
    "level": 2,
    "bypassesPlayerLimit": false
  }
]

To give a builder level 2 instead of 4, op them, stop the server, change level in ops.json, and start it again. Edit the file only while the server is stopped.

Why you shouldn't op everyone

• A level 3 op can kick, ban and op other players. A level 4 op can stop your server.
• On Paper and Spigot, a plugin permission with no default set goes to ops (source), and most plugins give their admin commands to ops this way. Op usually means "every plugin's admin commands" too.
• Ops ignore the whitelist and spawn protection.
• Every op account is a way in. If one gets stolen, the thief has the same power.

A good rule: op yourself and maybe one co-owner you fully trust. Everyone else gets exactly what they need through a permissions plugin.

Permissions Plugins: Fine Control with LuckPerms

On Paper and Spigot, every command has a permission node, a string like minecraft.command.ban or essentials.home. A permissions plugin decides who has which node. LuckPerms is the standard choice and also runs on Fabric, Forge, NeoForge and Velocity (Modrinth).

Three ideas cover most of it:

• Groups: bundles of permissions, like "mod" or "admin".
• Inheritance: a group can have a parent and gets all of its permissions. Admin inherits mod, mod inherits default.
• The default group: every player is in it automatically. Give it what all players should have.

A starter setup

The essentials and coreprotect nodes only matter if you use EssentialsX and CoreProtect. Here is how to build it from the console:

lp user YourName permission set luckperms.* true
lp creategroup mod
lp creategroup admin
lp group mod parent add default
lp group admin parent add mod
lp group default permission set essentials.home true
lp group mod permission set minecraft.command.kick true
lp group admin permission set minecraft.command.ban true
lp user Steve parent add mod

The first line gives you full access to LuckPerms itself, since nobody has it after installing. In game, put a slash in front of each command. Source: LuckPerms usage guide.

• Prefer clicking to typing? Run lp editor and open the link to edit everything in your browser.
• Don't know a plugin's node? Run lp verbose record Steve, have Steve try the command, then lp verbose paste to see which permissions were checked.
• Set group weights with gaps, like lp group admin setweight 300 and lp group mod setweight 200, so higher groups win when settings conflict.

New to plugins? Read How to Install Plugins on a Minecraft Server and our list of Essential Plugins for a New Minecraft Server.

Staff Access to the Panel: Use Sub-users

In-game permissions are only half of it. Staff who help run the server may also need the console, the files or restarts.

Never share your account password for that. On EternalZero, open Sub-users, invite your helper by email and pick which servers and which permissions they get. For example, a moderator might get the console, sending commands and power controls, but not deleting files or restoring backups. You can change their permissions or remove them at any time, and your own login stays yours.

Wrapping Up

Keep it simple at the start: whitelist on with enforce-whitelist=true for a private server, op only yourself, and use LuckPerms groups for everyone else. Give each person the lowest access that lets them do their job, and take it back when they step down.

To keep the rest of your server safe, read How to Protect Your Minecraft Server from Griefers and Attacks and set up regular backups.