Protecting a Minecraft server from crashers and crash exploits

In short: run Paper and update it at least once a week — PaperMC's own advice. Keep the limits in config/paper-global.yml on: packet-limiter, spam-limiter and item-validation. Lag machines are held back by max-tnt-per-tick in spigot.yml, max-chained-neighbor-updates in server.properties and the entity limits in the world config. Put Velocity in front with connection and command rate limits, firewall your game servers, and track the culprit down with the spark profiler and CoreProtect logs.

What crashers do#

A crash isn't always a dead process. More often the server hangs: a tick never finishes, and after 60 seconds the watchdog stops it. How to read that log is in crash logs. Dupes, which also live on server bugs, have their own article: dupes and exploits.

Packets: Paper's limiter#

packet-limiter:
  all-packets:
    action: KICK
    interval: 7.0
    max-packet-rate: 500.0
  overrides:
    minecraft:place_recipe:
      action: KICK
      interval: 7.0
      max-packet-rate: 500.0
spam-limiter:
  incoming-packet-threshold: 300
  recipe-spam-increment: 1
  recipe-spam-limit: 20
  tab-spam-increment: 1
  tab-spam-limit: 500

• `packet-limiter.all-packets` — no more than 500 packets per 7 seconds from one player. KICK removes the offender, DROP just discards the extra packets.
• `overrides` — a separate limit for a single packet by its identifier; Paper points to the Minecraft Wiki for the identifiers. minecraft:place_recipe is there by default.
• `spam-limiter` — incoming-packet-threshold is the point at which the server treats incoming packets as spam and ignores them; tab-complete and recipe spam get the player kicked.
• `rate-limit` in server.properties — the vanilla packet limit before a kick; 0 (the default) turns it off. On Paper, packet-limiter is more flexible.

Books and heavy items#

Books are a weapon even without an exploit: a bot writes hundreds of them within the limits, and chests of heavy books bloat the world save. That's a separate kind of abuse — BookBot — and length limits don't stop it.

Lag machines: redstone, TNT and entities#

Chunk generation#

The server generates new chunks wherever a player goes for the first time, and fast flight into unexplored areas is the heaviest case. The chunk-loading-basic section of paper-global.yml has per-player limits: player-max-chunk-load-rate: 100 and player-max-chunk-send-rate: 75 chunks per second, while player-max-chunk-generate-rate defaults to -1 — generation isn't limited. Limiting the world itself is more reliable: generate it ahead of time and set a border — see pre-generating the world and world border.

Chat and command spam#

• The server, 26.2 and newer. chat-spam-threshold-seconds and command-spam-threshold-seconds in server.properties (default 10) kick players who send messages or commands too often; 0 turns the kick off.
• Velocity. command-rate-limit is the minimum gap between commands, 50 ms by default (20 commands per second); kick-after-rate-limited-commands is how many commands over the limit a player may send before a kick, and 0 or lower disables the kick. Tab completion has the same pair: tab-complete-rate-limit and kick-after-rate-limited-tab-completes.
• Heavy plugin commands. Don't give everyone commands that generate, search or iterate over lots of blocks. Hand out permissions by group in LuckPerms.

Velocity in front of the server#

login-ratelimit = 3000
command-rate-limit = 50
kick-after-rate-limited-commands = 0
tab-complete-rate-limit = 10
kick-after-rate-limited-tab-completes = 0

These are the values from Velocity's default config. login-ratelimit is the minimum gap in milliseconds between connections from one IP; 0 disables it. Kicking for command and tab-complete spam is off by default — turn it on with a positive number. Most important, though, is that game servers behind the proxy can't be reached directly: the Velocity docs strongly recommend a firewall and say plainly that modern forwarding doesn't replace one. Step by step in Velocity setup.

If the server hangs anyway#

• Early warning. After 10 seconds of hanging, Paper prints a thread dump and repeats it every 5 seconds (watchdog in paper-global.yml). The Server thread stack shows what it's stuck on.
• Stop. After 60 seconds without a tick (settings.timeout-time in spigot.yml) the watchdog stops the server and, with restart-on-crash: true, runs restart-script (./start.sh by default). If the operating system killed the process, this mechanism won't restart it.
• Restart. It's more reliable to let systemd or Docker bring the server back — see Minecraft server on Linux.

How to find the culprit#

1. 1

   Catch the heavy ticks

   /spark tickmonitor --threshold-tick 50 reports ticks longer than 50 ms, and /spark profiler start --only-ticks-over 100 --timeout 600 records only those. The report shows what eats the tick: redstone, entities, chunk generation or a plugin. Details in the spark profiler.

2. 2

   Find the place

   /paper entity list shows how many entities of each type are ticking in a world, and /paper chunkinfo how many chunks are loaded. A pile of one entity type or a hot chunk is the suspicious spot.

3. 3

   Find the builder

   CoreProtect shows who placed redstone or spawned entities nearby: a:+block lists placed blocks, a:spawn entities a player placed or spawned. Commands in CoreProtect.

4. 4

   Remove it and punish

   Roll the build back with #preview first so you don't touch the neighbors, and punish under your rules: "lag machines and deliberate server load are not allowed". How to word it is in server rules.

/co lookup r:30 t:2h a:+block i:redstone_wire,repeater,comparator,observer,piston
/co lookup r:30 t:2h a:spawn
/co rollback u:Steve t:2h r:30 #preview

Updates close new crashes#

New ways to bring a server down keep turning up, and they get fixed in new builds of the server software and plugins. PaperMC recommends updating Paper at least once a week, with a backup and never by swapping the jar on a running server; plugins are easy to update through the plugins/update folder — they're replaced on restart. Moving to a new game version is a separate job: updating the server.

Where the anticheat comes in#

Paper's and Velocity's limits are the first line: they keep a single player from taking the server down. An anticheat doesn't replace them and doesn't fix bugs in the server software. But many crash exploits are built on packets an honest client never sends — and that's evidence against a specific account. DGuard — the best anticheat for a modern Minecraft server — checks those packets: impossible values (BadPackets), packet order within a tick, and books written by a bot (BookBot). In our comparison only DGuard has a full BookBot check.

DGuard's checks run in network threads — 0.03 % of one core on the main thread — so the anticheat doesn't become one more load on the tick. It works behind Velocity and BungeeCord, and punishments rest on accumulated evidence rather than one odd packet: players join from different versions through ViaVersion, and a rule has to know what's normal for them.

FAQ#