A good staff team rests on three things. Everyone has a role and permissions granted through a group, not OP. Punishments follow a shared table, not someone's mood. Every decision is logged, so any senior staff member can review a ban appeal even when the moderator who issued it is away.
Roles: helper, moderator, administrator
| Role | What they do | What they don't |
|---|---|---|
| Helper | Answers new players, watches chat, issues warnings and mutes | Doesn't ban, teleport to players or spectate |
| Moderator | Handles reports, spectates suspects, kicks and bans by the punishment table | Doesn't change plugin settings or lift other people's bans |
| Administrator | Configures plugins, reviews appeals, adds and removes moderators | Has no access to hosting billing, and to the console only if truly needed |
| Owner | Hosting, billing, console, backups, final decisions | Never shares their password |
It helps to take new staff on probation: a temporary role that expires on its own unless you extend it. LuckPerms has temporary groups for exactly that.
Permissions through LuckPerms, not OP
OP grants every command on the server at once — from /op for friends to /stop. A moderator doesn't need that, and a stolen moderator account with OP is a stolen server. Grant permissions through groups in LuckPerms, and let groups inherit from each other: a moderator can do everything a helper can, an administrator everything a moderator can.
lp creategroup helper
lp creategroup moderator
lp creategroup admin
lp group moderator parent add helper
lp group admin parent add moderator
lp group moderator permission set minecraft.command.kick true
lp group moderator permission set minecraft.command.spectate true
lp user ModeratorName parent add moderator
lp user NewcomerName parent addtemp helper 14d- Ban, mute and warn permissions depend on your punishment plugin — take them from its documentation.
- The
minecraft.command.gamemodepermission unlocks every mode, creative included. For spectating players, a vanish plugin with its own permissions is safer. /lp editoropens a web editor for permissions — easier than dozens of commands./lp log recentshows who changed permissions and when. Check it if someone suddenly has more power than they should.- DGuard's commands (
/dguard license,reload,update,perf) requiredguard.admin— give it to administrators only.
Never share the owner's password or the console
The password to your hosting, panel or owner account is the whole server: files, backups, billing. Staff come and go, their accounts get stolen, and a shared password can't be taken back from one person. When one person leaves, everyone's password has to change.
The rule is simple: everyone gets their own login and their own permissions. Then every action is tied to a person, and access is revoked in one step without touching anyone else. Many hosting panels can add users with limited rights — give console and file access only to those who really need it.
Rules and a punishment table
Players read the server rules; staff work from a punishment table: violation, punishment, duration — separately for a first offence and a repeat. The table removes the most common grievance: "he did the same thing and only got kicked".
| Violation | First time | Repeat | What to attach |
|---|---|---|---|
| Cheating | Ban | — | Anticheat report, recording |
| Chat abuse | 1-hour mute | 1-day mute | Screenshot or chat log |
| Griefing | Temporary ban and rollback | Ban | CoreProtect lookup |
| Refusing a check | Per your rules | — | Who called it, when, the player's answer |
You can build public rules with punishments in a minute with the rules generator and derive the staff table from them. How a moderator collects evidence is covered in how to check a player for cheats.
A punishment log makes every decision checkable
Every punishment goes into the log: who, whom, for what, when, for how long and on what evidence. Without a log, an appeal turns into "I definitely saw it", and a moderator's abuse stays invisible.
Your punishment plugin keeps manual punishments; links to recordings and screenshots fit well in a private staff channel. Bans and kicks from the DGuard anticheat land in the panel's log on their own: every ban with a report breaking down the evidence, filters by server, nickname, check and period, and CSV export. The log contains player nicknames, so you turn it on in the config with cloud.punishment-log: true and /dguard reload. Records are kept for 90 days.
Appeals
A ban appeal is reviewed by someone senior — an administrator or another moderator — not by the person who banned. The player has one channel for appeals and a clear response time, and the decision is logged next to the ban. If the anticheat issued the ban, start with its report. The full procedure and the typical causes of mistakes are in why anticheats ban honest players.
Once a month, go through the whole log: which moderators ban noticeably more, how many of their bans were overturned on appeal. A CSV export shows this without accusing anyone.
Team in DGuard: the log without your password
The DGuard panel has a Team section. Invite someone by email and pick a role — they accept the invitation in their own panel, which needs a free DGuard account with the same email. There are up to 10 seats, pending invitations included. Remove someone from the team and their access disappears at once.
| Permission | Moderator | Administrator | Owner |
|---|---|---|---|
| Server status, online and TPS | yes | yes | yes |
| Punishment log with reports, filters and CSV export | yes | yes | yes |
| Alerts when a server goes silent | no | yes | yes |
| Servers: add, rename, delete | no | yes | yes |
| New license key | no | yes | yes |
| Plan, billing, balance and the config store | no | no | yes |
| Team membership | no | no | yes |
This way a moderator answers "I got banned for nothing" from the report rather than from memory, and exports the log to CSV without ever knowing your password. You can see how it looks from the inside in the demo panel, no sign-up needed.
FAQ
How do I give a moderator permissions without OP?
Create a moderator group in LuckPerms, grant it what it needs with /lp group moderator permission set <permission> true, and add the player with /lp user <player> parent add moderator. Take ban and mute permissions from your punishment plugin's documentation.
How many moderators does a server need?
Enough that someone from the team is always online during peak hours, and reports and appeals get answered within the time your rules promise. Start small and add people as you grow.
How do I check that a moderator isn't abusing bans?
Log every punishment with its evidence and review the log monthly: bans per moderator and how many were overturned on appeal. LuckPerms' /lp log recent shows who changed permissions.
How many people can I add to a DGuard team?
Up to 10 seats, pending invitations included. Moderators see server status and the punishment log with CSV export; administrators also manage servers and keys.
Can a DGuard moderator see billing and the balance?
No. The plan, billing, balance, config store and team membership are available to the owner only.