Connection flood guard
Checks each new connection before Minecraft reads a byte.
- Limits per address
- Only known players during a flood
- No proxy needed
Run your Minecraft server on Ashlar
A free Minecraft server built on Paper. Java 1.8 to 26.x and Bedrock players join the same world, while bots, connection floods and plugin backdoors are stopped at the door.
Java 1.8 to 26.x
Old and new clients join on one port. ViaVersion, ViaBackwards and ViaRewind are built in and set themselves up on the first start.
Bedrock players too
Phone and console players join the same worlds on port 19132. Ashlar downloads Geyser and Floodgate and keeps them up to date.
Why Ashlar
Protection that runs inside the server
Connection floods, bots, exploit packets and backdoored plugins are stopped by the server itself. No proxy in front, no paid plugins on top.
All of it in one free jarAlle ansehen
Ashlar in one minute
What it stops, who can join and what it does while nobody plays.
Plays from YouTube. Watch on YouTube
Made for people who run-Server
We run CraftRank, a Minecraft server list, and kept seeing the same problems: bot floods, leaked plugins with backdoors, players stuck on old versions. Ashlar puts the fixes into the server itself. It is built from public source by GitHub Actions, and every release has its checksum next to it.
CRThe CraftRank teamSource on GitHub
What sets it apart
Other forks make the server faster. Ashlar also keeps it standing: a flood is dropped before Minecraft does any work, a leaked plugin can't give itself operator, and while nobody plays it backs up the worlds and generates chunks ahead. You read all of it in plain words in the console or the web panel.
- 1.8–26.xJava versions on one port
- 19132Bedrock port, set up for you
- 0extra plugins needed
Everything in one jar
Each of these is on by default and can be switched off in ashlar.yml or from the web panel.
Bedrock-Spieler
Phones and consoles join the same worlds.
- Port 19132
- Geyser and Floodgate set up for you
- Same worlds and plugins
Java 1.8 to 26.x
Old and new clients on one port.
- ViaVersion built in
- ViaBackwards and ViaRewind too
- Paper plugins work as they are
Plugin guard
Reads every plugin jar before it loads.
- Finds webhooks hidden in Base64
- Blocks plugins that op players
- Never changes your files
Web panel
Console, players and switches in a browser tab.
- 127.0.0.1:8180
- Sign in with a token
- Backups from the page
Lowers lag by itself
Ticks a smaller area when a tick passes 45 ms.
- View distance stays the same
- Goes back up when it is calm
- /ashlar shows every world
Bot and spam limits
Pauses joins and slows spammers on its own.
- 6 new players a second
- 4 messages a second
- Repeat offenders banned
Backups
Zipped on a schedule, old ones cleared.
- Every 6 hours
- Keeps the last 8
- /ashlar backup any time
Chunk pre-generation
Generates the world while nobody plays.
- 1,000 blocks around spawn
- Pauses when players join
- Per world
Everything that is built in
- Players on Java Edition 1.8 to 26.x can join (ViaVersion, ViaBackwards and ViaRewind built in)
- Dynamic simulation distance that follows the tick time
- /ashlar status: TPS, tick time, players, memory, chunks and entities per world
- /ashlar lag report: busiest chunks and most common entities
- Presets for survival, SMP, skyblock and minigames with automatic backups
- Anti-bot: new-player limit per second with a pause that known players skip
- Join limit per IP address and a check for invalid player names
- Chat and command spam limit with warnings and kicks
- Hidden /plugins, /version and /about for normal players, also in tab complete
- Built-in Votifier v2 vote receiver with reward commands and a broadcast
- Vote rewards wait for offline players and are given when they join
- One settings file, ashlar.yml; every feature has its own on/off switch
- Bedrock players can join through Geyser and Floodgate, downloaded and kept up to date by Ashlar
- /register and /login for offline-mode servers, passwords stored as PBKDF2 hashes and never logged
- Plugin backdoor guard: plugins cannot make players operators or hand out every permission on their own
- Plugin jars are checked on start for code that runs programs, downloads code or hides web addresses
- Connection flood protection before Minecraft does any work: per-address limits, silent and oversized connections closed
- During a connection flood only players who joined before can get in
- Exploit guard: oversized books and signs, tab-complete spam, entity and TNT caps per chunk
- Addresses that keep getting blocked are banned for a while; bans are kept across restarts
- Optional VPN and proxy check through proxycheck.io (off by default)
- Chunk pre-generation around spawn while the server is empty
- Automatic world backups every few hours, oldest ones removed
- Web panel with console, players, worlds, backups and feature switches
- Update check against the GitHub releases, verified with SHA-256 and installed on restart
- Runs Paper, Spigot and Bukkit plugins (LuckPerms tested)
- Free and open source under GPL-3.0
Tuned settings in one command
Pick what you run. /ashlar preset writes tested values to four config files and keeps a copy of the old ones.
/ashlar preset smp| View distance | 8 |
|---|---|
| Simulation distance | 5 |
| Monsters per player | 40 |
| Animals per player | 8 |
| Spawner mobs without AI | Nein |
Same in every preset: faster redstone (Alternate Current), lighter explosions, items and XP merge from further away, mobs far from players tick less, armor stands don't tick, fewer arrows and XP orbs saved per chunk.
server.properties4 settingsbukkit.yml10spigot.yml12paper-world-defaults.yml18
The old files go to
ashlar-backup/ first. Restart the server to use the new ones.Ashlar herunterladenStill paying extra for protection?
On a plain Paper server each of these is another plugin to find, often pay for, keep updated and trust with your server. Ashlar has all of it in one free jar.
Ashlar stops floods at the server’s door, before Minecraft does any work. An attack big enough to fill your network line never reaches the server, so that part still needs your host’s network protection.
| Schutz | On plain Paper | Ashlar |
|---|---|---|
| Bot attack protection | Separate plugin, often paid | Built in |
| Connection flood filter | Separate plugin or a proxy in front | Built in |
| Exploit fixes for books, signs and entity floods | Separate plugin, often paid | Built in |
| Backdoor check for plugins | Separate scanner you run by hand | Built in |
| Login for offline-mode-Server | Separate plugin | Built in |
| Automatic IP bans and VPN check | Separate plugin | Built in |
| Hidden plugin list | Separate plugin | Built in |
| Automatic world backups | Separate plugin or a host feature | Built in |
| Web panel with the console | Hosting panel or separate plugin | Built in |
| Vote receiver | NuVotifier | Built in |
| Bedrock-Spieler | Geyser and Floodgate, set up by hand | Built in |
| Players on 1.8 to 26.x | ViaVersion, ViaBackwards and ViaRewind | Built in |
| What you end up with | Up to a dozen plugins | One free jar |
Running in three steps
Install Java 25
Ashlar needs Java 25, the same as Paper for Minecraft 26.x.
the jar herunterladen
Download
ashlar-26.2.jarfrom GitHub, put it in an empty folder, or swap it for your Paper jar. Worlds and plugins stay as they are.Start it
java -Xmx4G -jar ashlar-26.2.jar --nogui, then seteula=truein eula.txt and start again.
ashlar-26.2.jar is built from the source by GitHub Actions and downloads from the newest GitHub release, where its SHA-256 checksum file sits next to it.
Befehle
All of them need the ashlar.admin permission. Players with ashlar.seeplugins can still use /plugins, and ashlar.bypass.spam skips the spam limit. Operators have both.
/ashlarTPS, tick time, players, memory, chunks and mobs per world, and the state of every Ashlar feature
TPS 20.0 / 20.0 / 19.9 MSPT 1.7 Players 12 Memory 1080 / 2048 MB
/ashlar lagThe busiest chunks and the most common mobs
Busiest chunks: world 112, -40 418 entities
/ashlar preset <name>Writes tuned settings: survival, smp, skyblock or minigames (restart to use them)
Preset smp saved. Restart the server to use it.
/ashlar reloadReloads ashlar.yml
/ashlar unlockEnds an anti-bot pause early
/ashlar pregen [pause|resume|reset]Chunk pre-generation progress and control
Pregen: world 1,840 / 4,096 chunks (44%)
/ashlar backup [list]Backs up the worlds now, or lists the backups
Backup saved: backups/ashlar-2026-11-08_04-00-00.zip (412 MB, 38.4s)
/ashlar bansBanned addresses; /ashlar ban-ip <ip> [minutes] and /ashlar unban-ip <ip> change them
185.220.101.7 connection flood 45.141.215.62 too much data before joining
/ashlar unregister <player>Removes a login account so the player can register again
/ashlar updateChecks GitHub for a newer build now
/ashlar pluginsWhat the plugin guard found: risky code in jars, blocked actions and the addresses plugins connect to
/ashlar tokenShows the vote token and port (console only)
/ashlar panelShows the web panel address and token (console only)
Ashlar FAQ
- What is Ashlar?
- Ashlar is free Minecraft: Java Edition server software made by CraftRank. It is built on Paper, so it runs Paper and Bukkit plugins, and adds multi-version and Bedrock support, anti-bot protection, a login system for offline servers, exploit protection, automatic backups, a web panel, a built-in vote receiver, automatic lag control and one-command presets.
- Do Paper plugins work on Ashlar?
- Ja. Ashlar is Paper with additions, so Paper, Spigot and Bukkit plugins load as usual. LuckPerms ran without changes in our tests.
- Which Minecraft versions can join an Ashlar server?
- The server runs Minecraft 26.2, and players on Java Edition 1.8 up to 26.x can join. We joined with 1.8.9, 1.12.2, 1.16.5, 1.19.4, 1.20.4, 1.21.4, 1.21.11 and 26.1 clients at the same time. This works through ViaVersion, ViaBackwards and ViaRewind, which ship inside Ashlar.
- Can Bedrock players join?
- Ja. On the first start Ashlar downloads Geyser and Floodgate from GeyserMC, checks their SHA-256 and keeps them up to date. Bedrock players join on port 19132 and do not need to log in. Set bedrock.enabled: false in ashlar.yml to turn it off.
- Does Ashlar have a login system for cracked servers?
- Ja. When online-mode is false, players choose a password with /register and sign in with /login. Until they do, they cannot move, chat or use commands. Passwords are stored as PBKDF2 hashes and are shown as **** in the server log. If you already use AuthMe or a similar plugin, Ashlar leaves login to it.
- Does Ashlar update itself?
- It checks the GitHub releases twice a day for a newer build of the same Minecraft version, checks the download against its SHA-256 and swaps the jar when the server stops. Set updates.download: false to only get a message, or updates.check: false to turn it off.
- Does Ashlar protect against DDoS attacks?
- It protects the server itself. Every new connection is checked before Minecraft does any work for it: banned addresses are dropped, each address has a limit on new and open connections, silent connections are closed after 5 seconds and connections that send too much before joining are cut. When the whole server gets too many new connections, only players who joined before can get in for a few minutes. In our test, 16,000 connections in 12 seconds were all dropped while a known player joined. An attack big enough to fill your network line never reaches the server, so that part still needs your host’s network protection.
- Can Ashlar stop backdoors in plugins?
- Most backdoors in leaked plugins work by making someone an operator or giving them every permission. On Ashlar a plugin cannot do that unless you allow it in ashlar.yml; the attempt is blocked and shown to staff. On start Ashlar also checks every plugin jar for code that runs programs, downloads code or hides web addresses, and the console shows which outside addresses each plugin connects to.
- How does the anti-bot protection work?
- Ashlar counts new players per second and joins per address per minute. Above the limit, new players are paused for a few minutes (5 by default) while players who have joined before can still get in. /ashlar unlock ends the pause early.
- Do I still need NuVotifier?
- Nein. Turn on votes in ashlar.yml and give the vote site your server address, the port (8192 by default) and the token from /ashlar token. If you already run NuVotifier, leave the Ashlar receiver off.
- Ist Ashlar kostenlos?
- Ja. Ashlar is free and open source under the GPL-3.0 license. The code is on GitHub.
- What do I need to run Ashlar?
- Java 25 and at least 2 GB of memory for the server; 4 GB or more is better for a public server. Ashlar runs on Windows, Linux and macOS.
- How do I move from Paper to Ashlar?
- Stop the server, replace the Paper jar with ashlar-26.2.jar and start it again. Worlds, plugins and settings stay as they are. Ashlar adds ashlar.yml on the first start.
Level up your server.