How to Secure a Minecraft Server

Auth and Admins

Control entry first. Turn on the whitelist and add only players you trust. The list lives in whitelist.json and is managed from console. Operator status is far more dangerous: whitelist only decides who joins, while ops.json is the master list of players who bypass all permission checks and can run /ban, /op, and more. Keep it to a tiny set of names, ideally just yourself. Confirm server.properties keeps online-mode=true; with it false, any client can join under any name, letting strangers claim your username and clear your base.

[
  {
    "uuid": "2f4a9c1d-...",
    "name": "yourname",
    "level": 4
  }
]

• Run /whitelist on, then add friends with /whitelist add <name>.
• Verify ops.json holds only trusted accounts.
• /deop <name> as soon as you revoke access.
• Keep online-mode=true enabled at all times.

Permissions Control

Whitelisted players still have no reason to hold every command. Install LuckPerms and replace raw operator status with groups. Give the default group only harmless permissions, add a moderator group with kick and ban, and keep one admin tier. Never promote a stranger to operator on a support ticket. LuckPerms stores data in YAML or your MySQL database, and group changes apply live when you run /lp sync.

lp group default permission set minecraft.command.spawn true
lp group moderator create
lp group moderator permission set minecraft.command.ban true
lp user steve parent add moderators
lp sync

Anti-Cheat and Logging

The strongest safety net is a block logger with rollback. CoreProtect records every block change, chest access, and player action with timestamps and undoes damage in minutes. Install it before players arrive, not after the first grief. Paper ships movement anti-cheat you can extend with extra checks. Keep server logs enabled and review them on a schedule.

• Install CoreProtect and verify events with /co inspect.
• Undo grief with /co rollback t:<name> t:-1d.
• Restore a chest with /co restore c:<name>.
• Match anti-cheat and logger versions to your Paper release.

Backups and Restore

A backup you have never restored is an assumption. Use the panel's automatic daily snapshot as your baseline, and keep one copy outside the host by downloading the world zip weekly. Snapshot manually before every plugin or config change, so a bad update is one click from undone. Because backups live at the hosting layer, a corrupt world, a griefed spawn, or a wiped server is a restore away, not a restart from zero.

• Enable automatic daily snapshots in the panel.
• Download a world copy weekly for peace of mind.
• Snapshot before any plugin or config change.
• Test a full restore once a quarter.

DDoS and Layer Protection

A volumetric DDoS attack cannot be stopped by anything inside the server; the provider's network and filtering absorb it upstream. Your job is to keep the server on that protected network, secure panel credentials, and never scatter your raw IP, since a circled address invites floods. For extra mitigation, route players through a proxy like Velocity or use the provider's filtered front-end. The full trade-offs are in the dedicated DDoS protection guide.

• Keep the server on the provider's protected network.
• Never expose your raw IP anywhere.
• Use a proxy like Velocity on bigger networks.
• Confirm the provider's DDoS limits match your size.

Ongoing Audit

Security is a habit, not a one-time setup. Most takeovers come from unpatched Paper builds or plugins with known exploits. Update Paper and every plugin on release, and read the release notes for security fixes. Audit your admin list and whitelist monthly, scan logs for repeated failed logins, and disable unused features. RCON stays off by default and only turns on when needed, behind a strong password and a firewall rule, and command blocks stay disabled unless a map needs them.

• Update Paper and plugins promptly after each release.
• Review ops.json and the whitelist monthly.
• Scan recent logs for suspicious activity.
• Keep RCON and command blocks off unless in use.