Server security is crucial for protecting your players and data. Here’s your complete security checklist for 2025.<\/p>\n
Never:<\/strong> Always:<\/strong> Password Formula:<\/strong> Secure file transfer access: Protect your MySQL database: Distributed Denial of Service attacks flood your server with traffic, making it unreachable.<\/p>\n Layer 1: Hosting Provider<\/strong> Layer 2: Proxy Services<\/strong> Layer 3: Server Configuration<\/strong> 1. Sign up at tcpshield.com Players connect to: play.yourdomain.com Essential Anti-Cheat:<\/strong> What They Detect:<\/strong> Configuration Tips:<\/strong> CoreProtect<\/strong> (Essential) Usage:<\/strong><\/p>\n GriefPrevention<\/strong> LuckPerms Best Practices:<\/strong><\/p>\n Never give players: Use inheritance for ranks:<\/p>\n Audit permissions monthly for security holes.\n<\/p>\n Trusted:<\/strong> Never:<\/strong> Before installing: Outdated plugins have security vulnerabilities: Remove these from plugins if possible: Advantages over Spigot\/Bukkit: Run latest Java version: Critical:<\/strong> How Often:<\/strong> Automated:<\/strong> 3-2-1 Rule:<\/strong> Monthly: Red flags: Green flags: Tier System:<\/strong><\/p>\n Helper:<\/strong> Moderator:<\/strong> Admin:<\/strong> Owner:<\/strong> Train staff on: “Urgent” Messages:<\/strong> Staff Impersonation:<\/strong> Plugin “Updates”:<\/strong> \u2022 Never share passwords Only open required ports: Close everything else.<\/p>\n If you have SSH access: Watch for:<\/strong> Tools:<\/strong> Educate players: For offline-mode servers: Post ToS covering: If serving EU: For players under 13: 1. Immediate:<\/strong><\/p>\n 2. Investigation:<\/strong><\/p>\n 3. Recovery:<\/strong><\/p>\n 4. Prevention:<\/strong><\/p>\n \u2705 Strong unique passwords everywhere Review monthly: Keep handy: Security is ongoing, not one-time. Budget time monthly for security maintenance. The cost of prevention is far less than recovery.<\/p>\n Secure your player base.<\/strong> [List your server](https:\/\/minecraftserverslist.co\/add.php) and grow with confidence!<\/p>\n","protected":false},"excerpt":{"rendered":" Server security is crucial for protecting your players and data. Here’s your complete security checklist for 2025. Account & Access Security Secure Your Server Panel Never: \u2022 Use default passwords… Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":72,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-18","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/minecraftserverslist.co\/blog\/wp-json\/wp\/v2\/posts\/18","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/minecraftserverslist.co\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/minecraftserverslist.co\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/minecraftserverslist.co\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/minecraftserverslist.co\/blog\/wp-json\/wp\/v2\/comments?post=18"}],"version-history":[{"count":5,"href":"https:\/\/minecraftserverslist.co\/blog\/wp-json\/wp\/v2\/posts\/18\/revisions"}],"predecessor-version":[{"id":84,"href":"https:\/\/minecraftserverslist.co\/blog\/wp-json\/wp\/v2\/posts\/18\/revisions\/84"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/minecraftserverslist.co\/blog\/wp-json\/wp\/v2\/media\/72"}],"wp:attachment":[{"href":"https:\/\/minecraftserverslist.co\/blog\/wp-json\/wp\/v2\/media?parent=18"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/minecraftserverslist.co\/blog\/wp-json\/wp\/v2\/categories?post=18"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/minecraftserverslist.co\/blog\/wp-json\/wp\/v2\/tags?post=18"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n\u2022 Use default passwords
\n\u2022 Share admin credentials
\n\u2022 Use same password across sites
\n\u2022 Store passwords in plain text<\/p>\n
\n\u2022 Use strong unique passwords (20+ characters)
\n\u2022 Enable 2FA on hosting panel
\n\u2022 Limit panel access to trusted IPs
\n\u2022 Review access logs regularly<\/p>\n
\nMinimum: 20 characters, uppercase, lowercase, numbers, symbols
\nExample tool: Bitwarden or 1Password<\/p>\nFTP\/SFTP Security<\/h3>\n
\n\u2022 Use SFTP instead of FTP
\n\u2022 Different password than panel
\n\u2022 Limit to specific IP addresses
\n\u2022 Disable when not in use
\n\u2022 Never share FTP credentials<\/p>\nDatabase Security<\/h3>\n
\n\u2022 Strong unique password
\n\u2022 Disable remote access if possible
\n\u2022 Regular backups
\n\u2022 Different password per server
\n\u2022 Monitor for suspicious queries\n<\/p>\nDDoS Protection<\/h2>\n
What is DDoS?<\/h3>\n
Protection Layers<\/h3>\n
\nChoose hosts with built-in DDoS protection:
\n\u2022 OVH Game
\n\u2022 Path.net
\n\u2022 BisectHosting
\n\u2022 Apex Hosting<\/p>\n
\nFree DDoS protection:
\n\u2022 TCPShield<\/strong> (Free tier: 10 Gbps)
\n\u2022 Cloudflare Spectrum<\/strong> (Paid: Enterprise)
\n\u2022 CosmicGuard<\/strong> (Various tiers)<\/p>\n
\nHide your real IP:
\n\u2022 Never share real IP publicly
\n\u2022 Use SRV records for custom domain
\n\u2022 Don’t resolve IP in Discord
\n\u2022 Change IP if leaked<\/p>\nSetting Up TCPShield<\/h3>\n
\n2. Add your domain
\n3. Create backend (real IP)
\n4. Update DNS records
\n5. Configure server with verification<\/p>\n
\nTCPShield filters traffic before reaching your server.<\/p>\nIn-Game Security<\/h2>\n
Anti-Cheat Plugins<\/h3>\n
\n\u2022 Spartan<\/strong> (Paid, very effective)
\n\u2022 Matrix<\/strong> (Free, good coverage)
\n\u2022 Vulcan<\/strong> (Paid, low false positives)<\/p>\n
\n\u2022 Fly hacking
\n\u2022 Speed hacking
\n\u2022 Kill aura
\n\u2022 X-ray
\n\u2022 Auto-clicker<\/p>\n
\n\u2022 Start with low sensitivity
\n\u2022 Monitor false positives
\n\u2022 Whitelist staff if needed
\n\u2022 Auto-ban repeat offenders<\/p>\nAnti-Grief Protection<\/h3>\n
\n\u2022 Logs all block changes
\n\u2022 Rollback grief instantly
\n\u2022 Inspect specific players
\n\u2022 Check container access<\/p>\n\/co inspect - Check block history\n\/co rollback u:griefer t:24h - Undo damage\n\/co restore u:player t:1h - Restore blocks<\/code><\/pre>\n
\nLet players claim land:
\n\u2022 Golden shovel claims
\n\u2022 Prevents grief automatically
\n\u2022 Configurable claim sizes
\n\u2022 Trusted player system<\/p>\nPermission Security<\/h3>\n
\n\u2022 *<\/code> (all permissions)
\n\u2022 essentials.*<\/code>
\n\u2022 worldedit.*<\/code>
\n\u2022 Any admin permissions<\/p>\nDefault \u2192 Member \u2192 VIP \u2192 Moderator \u2192 Admin<\/code><\/pre>\nPlugin Security<\/h2>\n
Only Download from Trusted Sources<\/h3>\n
\n\u2022 SpigotMC.org
\n\u2022 BukkitDev
\n\u2022 PaperMC.io
\n\u2022 Modrinth<\/p>\n
\n\u2022 Random Discord servers
\n\u2022 “Leaked” premium plugins
\n\u2022 Unknown websites
\n\u2022 Nulled plugin sites<\/p>\nVerify Plugins<\/h3>\n
\n\u2022 Check reviews and ratings
\n\u2022 Look for recent updates
\n\u2022 Review required permissions
\n\u2022 Scan for malware
\n\u2022 Test on local server first<\/p>\nKeep Plugins Updated<\/h3>\n
\n\u2022 Update weekly
\n\u2022 Read changelogs
\n\u2022 Backup before updating
\n\u2022 Monitor for exploits<\/p>\nDangerous Permissions<\/h3>\n
\n\u2022 File system access
\n\u2022 Command execution
\n\u2022 Network requests
\n\u2022 Database access (except needed plugins)\n<\/p>\nServer Software Security<\/h2>\n
Use Paper or Purpur<\/h3>\n
\n\u2022 Security patches faster
\n\u2022 Exploit fixes
\n\u2022 Better permission handling
\n\u2022 Active development<\/p>\nKeep Java Updated<\/h3>\n
\n\u2022 Java 17 minimum
\n\u2022 Java 21 recommended for 1.20+
\n\u2022 Security patches
\n\u2022 Performance improvements<\/p>\nServer.properties Security<\/h3>\n
# Prevent exploits\nenable-command-block=false\nspawn-protection=16\nenforce-whitelist=true (for whitelisted servers)\nenable-rcon=false (unless needed)\nrcon.password=<\/code><\/pre>\nBackup Strategy<\/h2>\n
What to Backup<\/h3>\n
\n\u2022 World files
\n\u2022 Plugin configurations
\n\u2022 Player data
\n\u2022 Permissions\/ranks
\n\u2022 Economy data<\/p>\n
\n\u2022 Hourly: Player data
\n\u2022 Daily: Worlds
\n\u2022 Weekly: Full server
\n\u2022 Before updates: Everything<\/p>\nBackup Solutions<\/h3>\n
\n\u2022 Hosting panel backups
\n\u2022 Plugin: DiscordSRV with backups
\n\u2022 External: Google Drive, Dropbox
\n\u2022 Dedicated: BackupPC, Duplicati<\/p>\n
\n\u2022 3 copies of data
\n\u2022 2 different storage types
\n\u2022 1 off-site backup<\/p>\nTesting Backups<\/h3>\n
\n\u2022 Download backup
\n\u2022 Restore on test server
\n\u2022 Verify data integrity
\n\u2022 Time how long restore takes\n<\/p>\nStaff Security<\/h2>\n
Hiring Safe Staff<\/h3>\n
\n\u2022 Very new account
\n\u2022 No Discord history
\n\u2022 Pushes for quick promotion
\n\u2022 Asks for sensitive info<\/p>\n
\n\u2022 Active server member
\n\u2022 Mature communication
\n\u2022 Past staff experience
\n\u2022 Positive reputation<\/p>\nStaff Permissions<\/h3>\n
\n\u2022 Kick\/warn
\n\u2022 Mute
\n\u2022 Basic commands<\/p>\n
\n\u2022 Temp ban
\n\u2022 Rollback grief
\n\u2022 Advanced moderation<\/p>\n
\n\u2022 Permanent ban
\n\u2022 Plugin management
\n\u2022 Server configuration<\/p>\n
\n\u2022 Full access
\n\u2022 Panel access
\n\u2022 Billing<\/p>\nStaff Training<\/h3>\n
\n\u2022 Common exploits
\n\u2022 Social engineering attempts
\n\u2022 When to escalate
\n\u2022 Evidence collection\n<\/p>\nSocial Engineering Prevention<\/h2>\n
Common Attacks<\/h3>\n
\n“Your server will be deleted unless you log in here!”
\n\u2192 Always fake. Check official sources.<\/p>\n
\n“Hi, I’m from your hosting. Give me your password.”
\n\u2192 Real staff never ask for passwords.<\/p>\n
\n“Download this critical security update!”
\n\u2192 Only download from official sources.<\/p>\nProtection<\/h3>\n
\n\u2022 Verify requests through multiple channels
\n\u2022 Enable 2FA everywhere
\n\u2022 Question urgent requests
\n\u2022 Train staff on tactics<\/p>\nNetwork Security<\/h2>\n
Firewall Rules<\/h3>\n
\n\u2022 25565 (Minecraft)
\n\u2022 If needed: 22 (SSH), 3306 (MySQL)<\/p>\nSSH Security<\/h3>\n
\n\u2022 Disable password login
\n\u2022 Use SSH keys only
\n\u2022 Change default port (22 \u2192 custom)
\n\u2022 Fail2Ban for brute force protection
\n\u2022 Sudo access only when needed<\/p>\nMonitoring<\/h3>\n
\n\u2022 Unusual login times
\n\u2022 Failed login attempts
\n\u2022 Unexpected file changes
\n\u2022 Strange process names
\n\u2022 High bandwidth usage<\/p>\n
\n\u2022 Server logs
\n\u2022 Hosting panel analytics
\n\u2022 Process monitors
\n\u2022 Network monitors<\/p>\nPlayer Account Security<\/h2>\n
Encourage Security<\/h3>\n
\n\u2022 Use unique passwords
\n\u2022 Enable 2FA (if using AuthMe)
\n\u2022 Don’t share accounts
\n\u2022 Log out on shared computers<\/p>\nAuthMe Plugin<\/h3>\n
\n\u2022 Forces player login
\n\u2022 Encrypts passwords
\n\u2022 2FA support
\n\u2022 Email recovery\n<\/p>\nLegal Protection<\/h2>\n
Terms of Service<\/h3>\n
\n\u2022 Account ownership
\n\u2022 Data collection
\n\u2022 Chargeback policy
\n\u2022 Behavior expectations
\n\u2022 Disclaimer of liability<\/p>\nGDPR Compliance (EU Players)<\/h3>\n
\n\u2022 Privacy policy
\n\u2022 Data deletion on request
\n\u2022 Transparent data usage
\n\u2022 Cookie notice on website<\/p>\nCOPPA Compliance (US)<\/h3>\n
\n\u2022 Parental consent
\n\u2022 Limited data collection
\n\u2022 Transparent privacy policy<\/p>\nIncident Response Plan<\/h2>\n
When Compromised<\/h3>\n
\n
\n
\n
\n
Security Checklist<\/h2>\n
\n\u2705 2FA on panel and important accounts
\n\u2705 DDoS protection enabled
\n\u2705 Backups automated and tested
\n\u2705 Plugins from trusted sources only
\n\u2705 Server software up to date
\n\u2705 Anti-cheat and anti-grief installed
\n\u2705 Staff trained on security
\n\u2705 Permissions audited
\n\u2705 Monitoring in place\n<\/p>\nMonthly Security Audit<\/h2>\n
\n\u2022 [ ] Update all plugins
\n\u2022 [ ] Update server software
\n\u2022 [ ] Change critical passwords
\n\u2022 [ ] Review staff permissions
\n\u2022 [ ] Test backups
\n\u2022 [ ] Check security logs
\n\u2022 [ ] Audit plugin permissions
\n\u2022 [ ] Review failed login attempts\n<\/p>\nEmergency Contacts<\/h2>\n
\n\u2022 Hosting support contact
\n\u2022 DDoS protection support
\n\u2022 Backup locations
\n\u2022 Staff Discord\/contact info
\n\u2022 Incident response plan\n<\/p>\nConclusion<\/h2>\n