How to whitelist and protect your Minecraft server

A Minecraft server is public the moment it is reachable. Bots scan for open servers all day, and griefers love an unprotected world. A few settings keep your server for the people you want.

1. Turn on the whitelist

The whitelist is a list of players who may join. Everyone else is refused. In the console:

whitelist on
whitelist add FriendName
whitelist list

You can also set white-list=true in server.properties. Add enforce-whitelist=true so that players who are removed from the list are kicked even if they are online.

2. Keep online-mode on

online-mode=true makes the server check each player with Mojang. With it off, anyone can join with any name, including the name of an operator, and take control. Leave it on. If you need cracked or proxy setups, you need other protections, and that is a bigger topic.

3. Be careful with operators

An operator can do anything: run any command, change the game mode, give items and ban players. Give it only to people you would trust with the whole server, and only when needed.

op FriendName
deop FriendName

For helpers who should be able to do a few things, use a permissions plugin instead.

4. Use LuckPerms for roles

LuckPerms is the most common permissions plugin. It lets you create groups and give each group only the commands it needs.

/lp creategroup moderator
/lp group moderator permission set essentials.kick true
/lp user FriendName parent set moderator

The names of permissions depend on your plugins, and each plugin lists them. Start with the default group having only what every player should have.

5. Protect the world itself

• Set spawn-protection so that only operators can build at spawn.
• Use a claim plugin if players should build safely in their own areas.
• Keep backups, so a griefed world can be restored. See how to back up a Minecraft world.
• Log who does what with a block-logging plugin such as CoreProtect, so you can undo damage.

6. Keep the software updated

Servers and plugins get security fixes. Do not run plugins you do not use, and take them from known places such as Modrinth and Hangar, not from random links in chat.

7. Do not expose what you do not need

RCON, a remote console, should stay off unless you use it. If you host at home, every open port is a risk, which is one reason many people use a hosted server. See hosting at home versus a hosted server.

On Saryno

The dashboard has a whitelist switch and an access page where you add players and operators, without typing commands. Each server runs in its own machine, and the platform limits outgoing traffic and blocks mail ports, so a bad plugin cannot easily be used for spam or attacks.