Player authentication
Can anyone join with any name?
- Online-mode
- Login plugins such as AuthMe, nLogin, LibreLogin
- Login on the proxy
Find the gaps before the bots do
Security Radar is a free security check for your Minecraft server. It looks at logins, password limits, anti-bot and proxy settings with your permission, and tells you what it found, with the evidence and the fix.
Only with your OK
Nothing happens until you prove the server is yours and switch the review on. You can switch it off, pause it or delete everything at any time.
Evidence, not guesses
Every finding says what was checked, what supports it and what is still unknown. If something can't be seen, it says "not confirmed", not "missing".
Why a radar
A security check that never touches your server
An offline-mode server without a login lets anyone join with any name, an operator's included. The radar tells you before someone else finds out, without logging in, testing or attacking anything.
Six checks, one pageSee them
Made by people who list servers
We run a Minecraft server list and check listed servers every few minutes, from the outside, like any player would. We wanted to help owners close the obvious gaps, without ever doing to a server what an attacker would do. So the radar only works with what you show it, and only you see the result.
CRThe CraftRank teamPrivacy and disclosure policy
- 0logins, bots or test traffic
- Only yousee your findings
- 1 a dayat most, per channel
What it checks
Each check ends in a clear state: fine, a finding with a severity, or "not confirmed" when there isn't enough evidence yet.
Wrong-password limits
Are password guesses slowed down?
- Max tries before a kick
- Temporary bans
- Only checked when a login exists
Anti-bot controls
What stops join floods from bots?
- Anti-bot plugins
- Ashlar Guard and connection guard
- Protection on the proxy
Proxy forwarding
Can someone skip your proxy?
- BungeeCord or Velocity forwarding
- Whether a forwarding secret is set
- BungeeGuard
Network DDoS protection
Only what you tell us.
- Never measured or tested
- Your answer about your host
- Low at most, never alarming
Ashlar fit
Would Ashlar help here, honestly?
- What it would add for this server
- What to check first
- Always next to other ways to fix it
Running in three steps
Prove it's yours
Add a short code to your MOTD, a DNS TXT record, a file on your website or the plugin config. The proof is tied to the address players use.
Answer a few questions
Online-mode, login, proxy, anti-bot: about ten multiple-choice questions. "Not sure" is a fine answer.
Read your findings
Each one with its evidence and fix. Add the diagnostic plugin to have the settings checked for you instead of taken on trust.
Every server listed on CraftRank can use it. Open the dashboard or add your server first.
What it will never do
A security check that behaves like an attacker is just another attacker. These are hard rules in the code, not settings, and they hold even if you ask.
The only inputs are your answers, the reports of the plugin you install, and the public status the CraftRank server list already shows.
| Action | Why | Radar |
|---|---|---|
| Log in to your server | Joining a server you don't own is an attack, even "just to test". | Never |
| Guess passwords or pose as a player | No staff names, no test accounts, no password lists. | Never |
| Send bots, floods or stress tests | Nothing is load-tested, ever. Not even with your OK. | Never |
| Run commands or change files | The plugin only reads a few settings and sends them. | Never |
| List your plugins on its own | Only a short public list of security plugins, through your plugin. | Never |
| Read players, IPs, passwords or chat | None of it is collected, so none of it can leak. | Never |
| Publish weak servers | There is no public list, score or ranking of findings. | Never |
| Message owners who did not sign up | Alerts go only to verified owners who turned them on. | Never |
| What it works from | Your answers and your plugin | That's all |
The diagnostic plugin
Optional, read-only and open about what it does. It turns your answers into checked facts, so a finding can say "verified" instead of "you told us".
It sends
- Server software, Minecraft and Java version
- Online-mode
- Whether proxy forwarding is on and a secret is set
- Which listed login, anti-bot and proxy-guard plugins are installed
- Two or three of their switches
- Three things you declare
It never sends
- Player names or IP addresses
- Passwords, hashes or tokens
- Your forwarding secret
- Your full plugin list
- Any configuration file
Paper, Spigot and forks from 1.17, Java 17 or newer. Reports are signed with your server's own key and refused when they are old or sent twice. It changes nothing on the server.
CraftRankRadar.jarYour key is in the dashboard under Integrations.
/craftrankradarShows whether reports are on and the last result.
CraftRank Security Radar 1.0.0: reports on, last result: report accepted.
/craftrankradar previewPrints exactly what the plugin would send, field by field.
This is exactly what the plugin sends (schema 1): "online_mode": false, "auth_plugins": ["AuthMe"], …
/craftrankradar sendSends a report now instead of waiting for the daily one.
Security radar: report accepted. Authentication: AGENT VERIFIED; Login rate limiting: CONFIGURED
/craftrankradar reloadReads config.yml again, for example after you paste the key.
Reloaded. Reports: on
How findings are graded
Two labels on every finding: how sure the radar is, and how much it matters. A missing signal is never counted against you.
Evidence
- Unknown
- Not enough to say anything. Shown as "not confirmed".
- Owner reported
- Your answer, before the address is verified.
- Owner verified
- Your answer, from the verified owner.
- Agent verified
- Read from your server by the diagnostic plugin in the last 7 days.
- Manually reviewed
- Confirmed by a person on the CraftRank security team.
Severity
- Critical
- Offline mode with no login at all, confirmed by the plugin. Your answers alone are never enough for this.
- High
- The same gap without plugin proof, or proxy forwarding anyone can skip.
- Moderate
- No limit on wrong passwords, or nothing against bot floods on an offline server.
- Low
- Worth knowing, such as no anti-bot on an online-mode server.
- Unverified
- Could be fine, could be a gap. Answer or add the plugin to find out.
Where Ashlar fits
Ashlar is CraftRank's free, open-source server software, with a built-in login, anti-bot and connection guard. When it would help, the radar says so, but only next to what to check first, its limits and other ways to fix the same thing.
Your AuthMe, nLogin or proxy login is a perfectly good answer. The radar does not prefer one fix over another; it only wants the gap closed.
Security Radar FAQ
- What is Security Radar?
- Security Radar is a free security check for Minecraft: Java Edition servers listed on CraftRank. After you prove the server is yours and agree to it, it looks at how players sign in, whether password guesses are limited, what stops bot floods and whether your proxy forwarding is secured, and tells you what it found and how to fix it.
- Does Security Radar scan or attack my server?
- No. It never logs in, never sends bots, floods or stress tests, never runs commands and never changes a file. It works only from your answers and from the optional diagnostic plugin you install yourself, which reads a few settings and sends them.
- Is it free?
- Yes. The review, the alerts and the diagnostic plugin are free for every server owner on CraftRank.
- How do I prove the server is mine?
- Put a short code from the dashboard in your server's MOTD, in a DNS TXT record, in a file on your website, or in the diagnostic plugin's config. The proof is tied to the address players use and lasts 90 days; if the address or the owner of the listing changes, it ends.
- What does the diagnostic plugin send?
- Server software and version, Minecraft and Java version, online-mode, whether BungeeCord or Velocity forwarding is on and whether a secret is set (never the secret), which plugins from a short public list of login, anti-bot and proxy-guard plugins are installed, two or three of their switches, and three things you declare in its config. Never player names, IP addresses, passwords, your full plugin list or config files. /craftrankradar preview shows it before anything is sent.
- Who can see my findings?
- Only you, the verified owner. CraftRank never publishes a list of servers, scores or findings. Critical alerts are checked by a person on the CraftRank team before they are emailed.
- Why does it say "not confirmed" instead of "missing"?
- Because a missing signal is not proof of a weakness. If the radar cannot see something, for example a login system it does not know, it says so and asks you, instead of warning you about something that may be fine.
- Do I have to switch to Ashlar?
- No. Ashlar, CraftRank's free server software, is mentioned only where it would actually help, together with what to check first, its limits and other ways to fix the same thing: online-mode, a login plugin such as AuthMe, nLogin or LibreLogin, or protection on your proxy.
- Does Security Radar protect my server from DDoS attacks?
- No. It is a check, not a shield. It points out missing login, bot and proxy protection. Attacks that fill your network line need protection from your host or a protected proxy.
- How do I stop the alerts?
- Every alert has a link that stops them at once without logging in. In the dashboard you can also pause the review, withdraw your consent or delete all radar data of a server.
Close the gaps on your server.