Once your server is public, some people will try to break things: grief builds, cheat, steal staff accounts or knock the server offline. You can't stop every attempt, but a few habits make your server a much harder target and let you undo damage quickly.
Accounts and access
- Keep
online-mode=trueinserver.propertiesunless the server runs behind a properly set up proxy. Offline mode lets anyone join with any name, including yours. - Use a whitelist for private servers and during setup. See how to whitelist a server.
- Protect staff accounts: two-factor authentication on Minecraft and Discord accounts, and never share passwords for the host panel.
Permissions instead of op
Operator status gives full control of the server. Give op only to yourself and staff you trust completely. For everyone else, including moderators, use a permissions plugin such as LuckPerms: create groups like default, helper and moderator, and give each group only the commands it really needs. Review the permissions when someone leaves the team.
Griefing: claims, logs and rollbacks
- Land claims let players protect their own builds, which stops most griefing before it happens.
- A logging plugin such as CoreProtect records who placed, broke or took what. Staff can inspect a block to see who changed it and roll back a griefer's changes in a set area and time.
- Backups cover everything else. See how to back up a server.
Cheaters
An anti-cheat plugin detects things like flying, speed hacks and kill aura. No anti-cheat catches everything, and some cause false alarms, so test it and let staff check alerts before banning. Hiding ores from x-ray clients is also possible; Paper has a built-in option for it. A visible /report command and active staff help just as much as plugins.
DDoS attacks
A DDoS attack floods your server with traffic until it goes offline. You can't defend against a large attack on your own connection, so:
- Choose hosting with DDoS protection that covers game traffic. See how to choose hosting.
- Don't expose your home IP. Hosting a public server at home makes your whole internet connection a target.
- Large networks often put a protected proxy in front of their servers, so the real IP of the machines is never public.
- Don't leak the real IP through old DNS records, plugin messages or other services running on the same machine.
Keep everything updated
Update your server software and plugins regularly; updates often fix exploits that let players crash servers or duplicate items. Download plugins only from trusted sites, never cracked versions, which often contain backdoors. Our server status checker is a quick way to see whether your server is reachable from outside after an attack or an update.