How to protect your Minecraft server from griefers

Griefing means deliberately breaking, stealing or ruining what other players have built. You protect your Minecraft server against it in three layers: control who gets in, control what players can do, and make sure you can undo the damage. A whitelist, very few operators, CoreProtect and automatic backups get you most of the way.

Where does griefing usually start?

A few situations you want to avoid:

• a friend of a friend gets the address and pops in for a look around;
• someone was made operator as a joke and then actually uses it;
• a player leaves after an argument and takes the contents of the shared chests along;
• a player’s account gets stolen and someone else logs in with it.

Most measures therefore start at the front door and with the keys, not with complicated software.

Who gets onto your server?

• Turn on the whitelist. On servers from 26.3 it’s on by default. Only add people you know, with /whitelist add name or under Players in the game panel. See Turn on the whitelist and add operators.
• Set enforce-whitelist=true in server.properties. When you remove someone from the whitelist, they’re kicked as soon as the whitelist reloads.
• Keep online-mode=true. Then only players with a genuine Minecraft account can join. With it off, someone with a fake account can connect, even under another player’s name. Bedrock players coming in through Geyser don’t need it switched off: Floodgate lets them join with online mode on.
• Don’t publish the address if the server is just for friends.
• Ban troublemakers with /ban name.

Where to find these settings is explained in Edit the settings in server.properties. The plugins in this article, such as LuckPerms, GriefPrevention and CoreProtect, go on your server as described in Install plugins on your Minecraft server.

Who can do what on your server?

An operator can do anything: ban players, spawn items and run commands that change the world. So only give operator status to yourself and at most one trusted co-admin.

Want builders or moderators to have a few extras without making them operators? Use LuckPerms. You create groups and give each group only what it needs:

• /lp creategroup moderator creates a group;
• /lp group moderator permission set minecraft.command.kick true gives that group the /kick command;
• /lp user name parent add moderator adds a player to the group.

Type /lp editor to do the same in a clear web editor.

Don’t forget the keys outside the game. Give co-admins their own access to the game panel under Users, with only the permissions they need, instead of sharing your password. And switch on two-factor authentication for your game panel account and for My CakeHosting.

How do you protect builds?

Land claims with GriefPrevention

With GriefPrevention, players protect their own land. A new player automatically gets a claim around their first chest. After that you claim more land with a golden shovel, and the amount you can claim grows with your playtime. Inside your claim nobody else can build or break anything unless you allow it:

• /trust name: they can build with you;
• /containertrust name: they can use your chests, furnaces and animals;
• /accesstrust name: they can only use buttons, levers and beds;
• /untrust name: takes it back.

Protecting spawn

Minecraft protects an area around the spawn point by itself. With spawn-protection=16, the default, that’s a 33 by 33 block square where only operators can build. If there are no operators, the protection is off. For a larger or precisely defined area, such as a town square, use the WorldGuard plugin. It needs WorldEdit to select the area: How to use WorldEdit on your Minecraft server.

Which game rules prevent damage?

Not all damage comes from players. These game rules switch off a few familiar culprits:

• /gamerule mob_griefing false: creepers stop blowing holes and endermen stop picking up blocks. It affects other things too, such as villagers harvesting crops.
• /gamerule tnt_explodes false: TNT no longer explodes.
• /gamerule fire_spread_radius_around_player 0: fire stops spreading.

Since Minecraft 1.21.11, game rules use these lowercase names. On older servers, the first and the last are still called mobGriefing and doFireTick.

How do you roll back griefing with CoreProtect?

CoreProtect logs who places or breaks which block, who takes items from a chest and more. That lets you find the culprit and undo exactly their damage, without turning back the clock for everyone else. Install it early: CoreProtect only sees what happens after it’s on your server.

1. Find out who did it. Type /co i and click a broken or placed block to see who did it and when. Type /co i again to stop.
2. Preview first. /co rollback u:name t:2h r:20 #preview shows what would be restored within 20 blocks of you, without changing anything yet.
3. Roll it back. Leave out #preview to do it for real. Without r: the radius is 10 blocks; with r:#global you undo everything that player did across the whole world.
4. Made a mistake? /co undo reverses your last rollback.

CoreProtect is a plugin for Paper, Purpur and Spigot. On a Fabric server, the Ledger mod does something similar.

When should you restore a backup?

A backup puts the whole server back to an earlier moment. It’s your safety net when CoreProtect isn’t enough, for example when someone changed the world with commands. The catch: everything built since then is gone too. So schedule a nightly backup under Schedules, lock a backup from a good moment and download one to your own computer now and then. Each server keeps 2 at a time. Here’s how: Create and restore a backup.

What about x-ray and other hacks?

Paper has a built-in anti-xray. It hides ores from players who use a hack to look through walls, and you switch it on per world in Paper’s configuration. On a server for friends only, the whitelist is your first line of defence: whoever isn’t on it can’t get in.

Playing with children? Read A Minecraft server for your kids as well. Running a Velocity network? Make sure forwarding is set up properly: Secure your Minecraft network.