# How to set up Security Radar Pro

Step by step: verify your server, buy Security Radar Pro, install the CraftRank Guard plugin and move your players to a protected address that filters bot and connection floods.

Updated 2026-11-13, 8 minute read. HTML version: https://craftrank.org/guides/how-to-set-up-security-radar-pro

[Security Radar Pro](https://craftrank.org/security-radar/) protects a Minecraft server in two places: **CraftRank Guard**, a plugin on your server (login, wrong-password bans, join limits, bot waves), and a **protected address** on our edge server that filters connection floods and hides your real address. It costs **$9.99 per server for 30 days**. Setup takes about 15 minutes. You need a server listed on CraftRank and a CraftRank account.

## 1. Prove the server is yours

1. Log in and open [Security Radar](https://craftrank.org/security-radar/protection), then **Verification**.
2. Pick a method. The quickest is the **MOTD code**: copy the code (it starts with `crv-`) into your server's MOTD in `server.properties` or your MOTD plugin, and reload the server.
3. Press **Check**. You can remove the code afterwards. The proof is tied to the address players use and lasts 90 days.

![The verification step in Security Radar: a code to add to the MOTD, then Check](https://craftrank.org/assets/img/radar/verify-code.webp)

## 2. Buy Security Radar Pro

1. Open **Protection** and pick your server.
2. Press **Get Pro · $9.99** and pay by card through Creem.
3. You come back to the Protection page with Pro active for 30 days. Nothing renews by itself; press **Add 30 days** before the end to continue.

## 3. Install CraftRank Guard

Guard runs on Paper, Spigot and their forks from 1.17, with Java 17 or newer.

1. On the Protection page, download `CraftRankGuard.jar` and put it in your server's `plugins` folder. Restart the server once.
2. Press **Create Guard key**. Copy the `key-id` and `secret` into `plugins/CraftRankGuard/config.yml`. The secret is shown only once; you can always rotate the key.
3. In the console run `/cguard reload`, then `/cguard`. You should see **Limits: on** and the end date of your plan.

On an offline-mode server without another login plugin, players are now asked to `/register` on their first join and `/login` after that. If you already use AuthMe, nLogin or LibreLogin, Guard leaves logins to them and only adds the limits.

## 4. Set up the protected address

1. On the Protection page, under **Protected address**, choose a name, for example `emerald`. Players will join `emerald.radar.craftrank.org`.
2. Enter your **real server** address (host or IP, with `:port` if it isn't 25565) and press **Save**.
3. If the real address is not the one you verified in step 1, add the `crp-` code shown on the page to that server's MOTD and press **Check the real server**.

## 5. Turn on the PROXY protocol

With the PROXY protocol your server sees every player's real address instead of ours, so bans, Guard and your own plugins keep working. Turn it on, then restart:

- **Paper** (and Ashlar, Purpur, Pufferfish): in `config/paper-global.yml` set `proxies:` → `proxy-protocol: true`.
- **Velocity**: in `velocity.toml` set `haproxy-protocol = true`.
- **BungeeCord / Waterfall**: in `config.yml` under the listener set `proxy_protocol: true`.

Spigot can't read the PROXY protocol: untick **Send each player's real address** on the Protection page instead. Guard then leaves per-address limits to our edge.

**After this, only the protected address works.** A player who joins your real address directly can't get in, because their connection has no PROXY header.

## 6. Move your players

1. Wait about a minute: the Protection page shows **Live**. Join `emerald.radar.craftrank.org` yourself to check.
2. Change the address of your [CraftRank listing](https://craftrank.org/panel/), your website and your Discord to the protected address. Changing the listing ends the old verification: verify once more in step 1; Pro and the protected address keep working meanwhile.
3. Want your own domain? Add a DNS record `play.yourdomain.com` → **CNAME** → `emerald.radar.craftrank.org`, enter it on the Protection page and press **Check my own address**.

## 7. Close the real address

Attackers who already know your real address can still flood it directly. Allow your Minecraft port only from our edge server, `149.56.214.81`, and block it for everyone else. On Linux with ufw:

```
sudo ufw allow from 149.56.214.81 to any port 25565 proto tcp
sudo ufw deny 25565/tcp
```

On shared hosting, ask your host to allow only that address, or use their firewall page. If your host gives you a new IP address, that one has never been public.

## 8. Check that it works

- `/cguard` shows the plan, the login and the limits.
- The Protection page counts joins blocked, wrong passwords, bans, bot waves and pings answered from the cache.
- Something wrong? Press **Switch off** under the protected address and set `proxy-protocol: false` again: players can join your real address as before.

## What it can and can't stop

Our edge sits on OVHcloud's network, whose anti-DDoS filters network-layer attacks first; our packet filter and proxy then stop connection floods, bot waves and ping floods, and Guard stops password guessing on your server. No setup makes a server impossible to attack, and attacks that fill a whole network line are left to OVHcloud's network protection. Read more on the [Security Radar page](https://craftrank.org/security-radar/#strength) and in [how to protect a Minecraft server from griefing and DDoS](https://craftrank.org/guides/how-to-protect-a-minecraft-server-from-griefing-and-ddos).