Server Security Essentials
Running a public Minecraft server means being a target. Griefers, hackers, and bots will find you eventually. Here's how to be prepared.
Anti-Cheat Protection
Why You Need Anti-Cheat
Even small servers attract cheaters. Without anti-cheat, a single fly-hacking, auto-clicking, or X-raying player can ruin the experience for everyone.
Recommended Anti-Cheats
- Vulcan — Premium, excellent detection, low false positives
- Grim — Free/open-source, improving rapidly
- Spartan — Premium with extensive customization
- Matrix — Free with decent detection rates
Configuration Tips
- Start with default settings and adjust based on your server's gameplay
- Whitelist creative mode players from movement checks
- Log violations before auto-banning to reduce false positives
- Set appropriate punishment thresholds (warn → kick → tempban → ban)
Grief Protection
Land Claiming
Install GriefPrevention for player self-service claiming:
- Players receive claim blocks over playtime
- Golden shovel creates claim boundaries
- Trust levels: access, container, build
- Automatic new-player protection near spawn
Block Logging
CoreProtect is essential:
- Log every block place/break/interact
- Roll back grief with
/co rollback - Inspect who did what with
/co inspect - Prune old data to save storage
Spawn Protection
- Use WorldGuard to protect spawn and key areas
- Set
spawn-protectionin server.properties - Disable TNT, fire spread, and creeper explosions in protected regions
DDoS Protection
What is a DDoS Attack?
Distributed Denial of Service floods your server with fake traffic, making it unreachable for real players. Common in competitive Minecraft communities.
Protection Methods
- 1Host with DDoS protection — Many hosts include basic protection
- 2Use a proxy — TCPShield, Cosmic Guard, or BungeeCord behind a protected proxy
- 3Hide your real IP — Use an SRV record pointing to a protected proxy
- 4Rate limiting — Limit connections per IP on your firewall
TCPShield (Free Tier Available)
- Proxies connections through their DDoS-protected network
- Hides your real server IP
- Free tier handles most small-scale attacks
- Easy setup: change your DNS to point to TCPShield
Bot Protection
Signs of a Bot Attack
- Dozens of accounts joining simultaneously
- Random or sequential usernames (Player1, Player2...)
- Immediate disconnects or spam in chat
- Server join rate way above normal
Prevention
- AuthMe — Require login/registration (for offline-mode servers)
- BotSentry / AntiBot — Rate-limit joins and detect bot patterns
- Connection throttle in spigot.yml — Limit joins per second per IP
- Whitelist mode — Nuclear option during active attacks
Operator Security
Never Give OP Carelessly
- OP = full server access. One compromised OP account can destroy everything
- Use LuckPerms for granular permissions instead
- Only give specific permissions that staff members need
Secure Your Console
- Use strong passwords for RCON, panel access, and SSH
- Enable two-factor authentication where available
- Limit panel access to specific IPs if possible
- Rotate passwords regularly
Backup Everything
- Daily automatic backups at minimum
- Store backups off-server (different cloud/location)
- Test your backup restoration process annually
- Keep at least 7 days of backup history
Emergency Response
When You're Being Attacked
- 1Stay calm — panicking leads to mistakes
- 2Enable whitelist mode if players can't connect
- 3Check your DDoS protection status and upgrade if needed
- 4Review console logs for the attack type
- 5Contact your host's support team
When Someone Griefed
- 1Use CoreProtect to identify the griefer:
/co lookup - 2Roll back their changes:
/co rollback u:username t:24h - 3Ban the player and document the incident
- 4Review your claim protection settings
When an Admin Account is Compromised
- 1Remove all permissions immediately
- 2Change all passwords (RCON, panel, SSH)
- 3Check for unauthorized changes (plugins, configs, bans)
- 4Roll back to a known-good backup if necessary
- 5Audit your permission setup to prevent recurrence