CoreProtect: find griefers and roll back the damage

CoreProtect records almost everything players do to the world: blocks placed and broken, chests, chat, commands, logins. To find a griefer, turn on the inspector with /co i and click where the damage is. To undo their work, run /co rollback u:<player> t:<time> r:<radius> — and add #preview before any big rollback.

Install and database#

Download CoreProtect from Modrinth, put it into plugins/ and restart — there's nothing to configure, logging starts right away. Logs only cover the time since install, so add it before you open the server, not after the first grief.

In the current public releases, data goes into an SQLite file in the plugin folder by default; for a large server or a network you can use MySQL — use-mysql: true in plugins/CoreProtect/config.yml. The docs already describe newer storage options (DuckDB, ClickHouse) for version 25.0 and up — check the configuration page for what your build supports.

The inspector: who broke this block#

/co inspect, or just /co i, turns the inspector on; run it again to turn it off. While it's on, your clicks show history instead of doing their usual thing:

• Left-click a block — who placed it.
• Right-click a block — which adjacent block was broken.
• Place a block where one was broken — what was broken there, and by whom.
• Right-click a door, chest and so on — who used it last.

A typical case: a player says their chest is gone. Stand nearby, turn on /co i and place a block where the chest was — you'll see who broke it and when. If the chest is there but the items aren't, right-clicking it shows who used it, and a lookup with a:-container shows exactly what was taken.

Lookups: /co lookup#

/co lookup (or /co l) searches the whole server with filters. Unlike rollbacks, lookups have no default radius: without r: they search everywhere.

The most useful actions: a:block (placed and broken), a:+block / a:-block (placed only / broken only), a:container with plus or minus (put into chests / taken out), a:inventory, a:item, a:chat, a:command, a:session (logins and logouts), a:kill (mobs killed). Flip pages with /co l <page>.

/co lookup u:Steve t:2d r:30
/co lookup r:10 t:3d a:-container
/co lookup u:Steve t:7d a:chat
/co lookup u:Steve a:session

Rollbacks: /co rollback#

/co rollback (or /co rb) takes the same parameters as a lookup but changes the world. One important detail: without a radius, a rollback only covers 10 blocks around you — set by default-radius in the config. For the whole server you need r:#global.

1. 1

   Size it up

   /co lookup u:Steve t:2d a:block shows how much the player built and broke, and where. If the griefer worked in one spot, go stand there.

2. 2

   Preview it

   /co rollback u:Steve t:2d r:30 #preview shows what would change without touching the world.

3. 3

   Roll it back

   The same command without #preview. To put items back into chests use a:container, to undo only broken blocks a:-block, to skip dirt and stone e:dirt,stone.

4. 4

   If you overdid it

   /co undo reverts the last rollback or restore. /co restore (/co rs) with the same parameters re-applies rolled-back actions.

Purging the database: /co purge#

Logs grow with the server. /co purge t:30d deletes data older than 30 days and keeps the last month. In game you can only purge data older than 30 days; from the console, older than 24 hours. You can purge one world (r:#world_nether) or specific blocks (i:stone,dirt). Take a backup before a big purge: deleted logs don't come back.

Spotting X-Ray in the logs#

X-Ray only changes what the client draws, so no plugin anticheat can see it directly. But CoreProtect sees the result: what the player mined and where. Check how much diamond ore and ancient debris they've mined in the last few days:

/co lookup u:Steve t:3d a:-block i:diamond_ore,deepslate_diamond_ore,ancient_debris
/co lookup u:Steve t:3d a:-block i:diamond_ore,deepslate_diamond_ore,ancient_debris #count
/co lookup u:Steve t:3d a:-block i:stone,deepslate,netherrack #count

It's suspicious when there's a lot of valuable ore but little ordinary stone dug around it, and the coordinates jump from vein to vein with hardly any stray tunnels. That's a reason to look closer, not proof: honest players get lucky too. The more reliable fix is to make X-Ray pointless — turn on Paper's built-in anti-xray (it's off by default), which hides ores from the client: X-Ray protection. How to check a player end to end is in checking a player for cheats.

CoreProtect shows "what", an anticheat shows "how"#

CoreProtect will tell you Steve flattened half his neighbour's base in a minute, but not whether he was cheating. That's the anticheat's job: Nuker breaks everything around at once, FastBreak breaks faster than possible, GhostHand opens chests through walls. DGuard checks for these, and every ban comes with a report that breaks down the evidence — your moderator just compares it with the CoreProtect logs.

FAQ#