Minecraft Server Security: Protect Your Server from Hackers & Griefers

Server security is crucial for protecting your players and data. Here’s your complete security checklist for 2025.

Account & Access Security

Secure Your Server Panel

Never:
• Use default passwords
• Share admin credentials
• Use same password across sites
• Store passwords in plain text

Always:
• Use strong unique passwords (20+ characters)
• Enable 2FA on hosting panel
• Limit panel access to trusted IPs
• Review access logs regularly

Password Formula:
Minimum: 20 characters, uppercase, lowercase, numbers, symbols
Example tool: Bitwarden or 1Password

FTP/SFTP Security

Secure file transfer access:
• Use SFTP instead of FTP
• Different password than panel
• Limit to specific IP addresses
• Disable when not in use
• Never share FTP credentials

Database Security

Protect your MySQL database:
• Strong unique password
• Disable remote access if possible
• Regular backups
• Different password per server
• Monitor for suspicious queries

DDoS Protection

What is DDoS?

Distributed Denial of Service attacks flood your server with traffic, making it unreachable.

Protection Layers

Layer 1: Hosting Provider
Choose hosts with built-in DDoS protection:
• OVH Game
• Path.net
• BisectHosting
• Apex Hosting

Layer 2: Proxy Services
Free DDoS protection:
• TCPShield (Free tier: 10 Gbps)
• Cloudflare Spectrum (Paid: Enterprise)
• CosmicGuard (Various tiers)

Layer 3: Server Configuration
Hide your real IP:
• Never share real IP publicly
• Use SRV records for custom domain
• Don’t resolve IP in Discord
• Change IP if leaked

Setting Up TCPShield

1. Sign up at tcpshield.com
2. Add your domain
3. Create backend (real IP)
4. Update DNS records
5. Configure server with verification

Players connect to: play.yourdomain.com
TCPShield filters traffic before reaching your server.

In-Game Security

Anti-Cheat Plugins

Essential Anti-Cheat:
• Spartan (Paid, very effective)
• Matrix (Free, good coverage)
• Vulcan (Paid, low false positives)

What They Detect:
• Fly hacking
• Speed hacking
• Kill aura
• X-ray
• Auto-clicker

Configuration Tips:
• Start with low sensitivity
• Monitor false positives
• Whitelist staff if needed
• Auto-ban repeat offenders

Anti-Grief Protection

CoreProtect (Essential)
• Logs all block changes
• Rollback grief instantly
• Inspect specific players
• Check container access

Usage:

/co inspect - Check block history
/co rollback u:griefer t:24h - Undo damage
/co restore u:player t:1h - Restore blocks

GriefPrevention
Let players claim land:
• Golden shovel claims
• Prevents grief automatically
• Configurable claim sizes
• Trusted player system

Permission Security

LuckPerms Best Practices:

Never give players:
• * (all permissions)
• essentials.*
• worldedit.*
• Any admin permissions

Use inheritance for ranks:

Default → Member → VIP → Moderator → Admin

Audit permissions monthly for security holes.

Plugin Security

Only Download from Trusted Sources

Trusted:
• SpigotMC.org
• BukkitDev
• PaperMC.io
• Modrinth

Never:
• Random Discord servers
• “Leaked” premium plugins
• Unknown websites
• Nulled plugin sites

Verify Plugins

Before installing:
• Check reviews and ratings
• Look for recent updates
• Review required permissions
• Scan for malware
• Test on local server first

Keep Plugins Updated

Outdated plugins have security vulnerabilities:
• Update weekly
• Read changelogs
• Backup before updating
• Monitor for exploits

Dangerous Permissions

Remove these from plugins if possible:
• File system access
• Command execution
• Network requests
• Database access (except needed plugins)

Server Software Security

Use Paper or Purpur

Advantages over Spigot/Bukkit:
• Security patches faster
• Exploit fixes
• Better permission handling
• Active development

Keep Java Updated

Run latest Java version:
• Java 17 minimum
• Java 21 recommended for 1.20+
• Security patches
• Performance improvements

Server.properties Security

# Prevent exploits
enable-command-block=false
spawn-protection=16
enforce-whitelist=true (for whitelisted servers)
enable-rcon=false (unless needed)
rcon.password=

Backup Strategy

What to Backup

Critical:
• World files
• Plugin configurations
• Player data
• Permissions/ranks
• Economy data

How Often:
• Hourly: Player data
• Daily: Worlds
• Weekly: Full server
• Before updates: Everything

Backup Solutions

Automated:
• Hosting panel backups
• Plugin: DiscordSRV with backups
• External: Google Drive, Dropbox
• Dedicated: BackupPC, Duplicati

3-2-1 Rule:
• 3 copies of data
• 2 different storage types
• 1 off-site backup

Testing Backups

Monthly:
• Download backup
• Restore on test server
• Verify data integrity
• Time how long restore takes

Staff Security

Hiring Safe Staff

Red flags:
• Very new account
• No Discord history
• Pushes for quick promotion
• Asks for sensitive info

Green flags:
• Active server member
• Mature communication
• Past staff experience
• Positive reputation

Staff Permissions

Tier System:

Helper:
• Kick/warn
• Mute
• Basic commands

Moderator:
• Temp ban
• Rollback grief
• Advanced moderation

Admin:
• Permanent ban
• Plugin management
• Server configuration

Owner:
• Full access
• Panel access
• Billing

Staff Training

Train staff on:
• Common exploits
• Social engineering attempts
• When to escalate
• Evidence collection

Social Engineering Prevention

Common Attacks

“Urgent” Messages:
“Your server will be deleted unless you log in here!”
→ Always fake. Check official sources.

Staff Impersonation:
“Hi, I’m from your hosting. Give me your password.”
→ Real staff never ask for passwords.

Plugin “Updates”:
“Download this critical security update!”
→ Only download from official sources.

Protection

• Never share passwords
• Verify requests through multiple channels
• Enable 2FA everywhere
• Question urgent requests
• Train staff on tactics

Network Security

Firewall Rules

Only open required ports:
• 25565 (Minecraft)
• If needed: 22 (SSH), 3306 (MySQL)

Close everything else.

SSH Security

If you have SSH access:
• Disable password login
• Use SSH keys only
• Change default port (22 → custom)
• Fail2Ban for brute force protection
• Sudo access only when needed

Monitoring

Watch for:
• Unusual login times
• Failed login attempts
• Unexpected file changes
• Strange process names
• High bandwidth usage

Tools:
• Server logs
• Hosting panel analytics
• Process monitors
• Network monitors

Player Account Security

Encourage Security

Educate players:
• Use unique passwords
• Enable 2FA (if using AuthMe)
• Don’t share accounts
• Log out on shared computers

AuthMe Plugin

For offline-mode servers:
• Forces player login
• Encrypts passwords
• 2FA support
• Email recovery

Legal Protection

Terms of Service

Post ToS covering:
• Account ownership
• Data collection
• Chargeback policy
• Behavior expectations
• Disclaimer of liability

GDPR Compliance (EU Players)

If serving EU:
• Privacy policy
• Data deletion on request
• Transparent data usage
• Cookie notice on website

COPPA Compliance (US)

For players under 13:
• Parental consent
• Limited data collection
• Transparent privacy policy

Incident Response Plan

When Compromised

1. Immediate:

• Change all passwords
• Restore from backup
• Kick all players
• Review logs

2. Investigation:

• Identify attack vector
• Check for damage
• Document everything
• Contact hosting if needed

3. Recovery:

• Fix vulnerability
• Restore data
• Inform affected players
• Implement new security

4. Prevention:

• Update security measures
• Train staff
• Monitor more closely
• Review incident monthly

Security Checklist

✅ Strong unique passwords everywhere
✅ 2FA on panel and important accounts
✅ DDoS protection enabled
✅ Backups automated and tested
✅ Plugins from trusted sources only
✅ Server software up to date
✅ Anti-cheat and anti-grief installed
✅ Staff trained on security
✅ Permissions audited
✅ Monitoring in place

Monthly Security Audit

Review monthly:
• [ ] Update all plugins
• [ ] Update server software
• [ ] Change critical passwords
• [ ] Review staff permissions
• [ ] Test backups
• [ ] Check security logs
• [ ] Audit plugin permissions
• [ ] Review failed login attempts

Emergency Contacts

Keep handy:
• Hosting support contact
• DDoS protection support
• Backup locations
• Staff Discord/contact info
• Incident response plan

Conclusion

Security is ongoing, not one-time. Budget time monthly for security maintenance. The cost of prevention is far less than recovery.

Secure your player base. [List your server](https://minecraftserverslist.co/add.php) and grow with confidence!