MySQL and MariaDB for Minecraft plugins: when you need them and how to set them up

In short: on a single server, keep the default storage — H2, SQLite or files. A server network, shared permissions, bans and inventory sync need a network database: MySQL, MariaDB or PostgreSQL. Give each plugin its own database and its own user with rights to that database only, have the database server listen on 127.0.0.1 or sit behind a firewall, and back it up with mysqldump alongside the world.

When files are enough and when you need MySQL#

LuckPerms' docs put the rule plainly: a remote database is recommended if you expect a lot of data or are thinking about a network, and if you already run several servers that should share data, you need one. File databases, by the same docs, are sometimes prone to data corruption, but for a single server they're a sensible default.

• A server network. LuckPerms permissions, bans and mutes, and the economy must be the same on the lobby and every mode — so every copy of the plugin connects to one database. How such a network fits together: Minecraft server network.
• The plugin requires it. HuskSync, for example, which carries inventories, ender chests and experience between servers, requires MySQL, MariaDB, PostgreSQL or MongoDB plus a Redis server, per its docs.
• Lots of data. Per LuckPerms' docs, a network database handles more data and concurrent queries better than a file. CoreProtect can use MySQL on a large server too.

MySQL or MariaDB#

A plugin barely cares: per MariaDB's docs, its client protocol is binary compatible with MySQL's, and MySQL connectors, Java included, work with MariaDB unchanged. LuckPerms' storage list says it outright: "MariaDB (preferred over MySQL)". On your own VPS, install MariaDB from your distribution's repository; on game hosting, ask whether the host provides a database — many offer MySQL right in the panel, see best Minecraft hosting.

A database and a user with rights to it alone#

Don't connect plugins as root. Give each plugin its own database and user: if a password leaks from a config, one database is exposed, not all of them. Run these as an administrator in the mariadb or mysql console:

CREATE DATABASE luckperms;
CREATE USER 'luckperms'@'localhost' IDENTIFIED BY 'a-long-random-password-1';
GRANT ALL ON luckperms.* TO 'luckperms'@'localhost';

CREATE DATABASE coreprotect;
CREATE USER 'coreprotect'@'localhost' IDENTIFIED BY 'a-long-random-password-2';
GRANT ALL ON coreprotect.* TO 'coreprotect'@'localhost';

• luckperms.* — database-level rights: all tables in that one database and nothing else. This user can't see other databases.
• 'luckperms'@'localhost' — login from this machine only. An account in MySQL and MariaDB is a name@host pair.
• If Minecraft runs on another machine, use its IP instead of localhost: 'luckperms'@'10.0.0.5'. MariaDB's docs specifically warn that opening root to all hosts ('root'@'%') on the internet is highly discouraged.

Connecting LuckPerms#

storage-method: mariadb

data:
  address: localhost
  database: luckperms
  username: luckperms
  password: 'a-long-random-password-1'
  table-prefix: 'luckperms_'

By default storage-method is h2, and data holds the user root with an empty password: put your own in. The database has to exist beforehand — LuckPerms won't create it. You can leave out the port if it's the standard one; otherwise write host:port. To move permissions from H2 to MySQL, use the built-in commands: /lp export <file>, change storage-method and restart, then /lp import <file>. Everything else about LuckPerms is in its own article.

Connecting CoreProtect#

use-mysql: true
table-prefix: co_
mysql-host: 127.0.0.1
mysql-port: 3306
mysql-database: coreprotect
mysql-username: coreprotect
mysql-password: a-long-random-password-2

In public 24.x builds, data goes to SQLite by default and MySQL is turned on with use-mysql. In CoreProtect 25.0 and newer, the database-type key picks the engine (duckdb, clickhouse, sqlite or mysql), and new installations write to DuckDB by default. Note that switching engines opens a separate dataset and doesn't carry the old one over — the docs have a separate migration guide for that. How to use CoreProtect itself: CoreProtect.

Port 3306 is not for the internet#

A database server plus a password from someone's config means access to all your permissions, bans and logs. The defence is the same as for RCON: the database listens on a local address only or sits behind a firewall.

• Bind to localhost. In the [mysqld] section of the database server's config, set bind-address = 127.0.0.1 and restart. Per MariaDB's docs, many MariaDB packages already do this by default, while MySQL's default is * — every address on the machine.
• Firewall. If servers on other machines need the database, open 3306 to their IPs only, like the backend ports in a proxy network.
• Separate passwords. Each plugin gets its own user and a long random password. Posting a config in a discussion or a support ticket? Remove the password first.

sudo ss -tlnp | grep 3306
# 127.0.0.1:3306 — local only; 0.0.0.0:3306 or *:3306 — all addresses

Backing up the database#

Plugin databases don't live in the server folder, so a world backup won't save them. Dump them separately, on the same schedule:

mysqldump --single-transaction --databases luckperms coreprotect > db-$(date +%F).sql

# restore: a dump made with --databases creates the databases itself (on MariaDB: mariadb < …)
mysql < db-2026-10-18.sql

--single-transaction dumps InnoDB tables as a consistent snapshot without blocking plugins; don't change table structure while the dump runs. On MariaDB the program is called mariadb-dump, and mysqldump is an alias for it. Schedules, the 3-2-1 rule and restore tests: server backups.

The database and the anticheat#

DGuard — the best anticheat for a modern Minecraft server — keeps player data on your side too: names, IPs, chat and player dossiers stay on your servers, in your MySQL. DGuard's cloud check only receives game measurements — no names, UUIDs, IPs, chat or world coordinates. So include the database that holds the dossiers in the same dumps as LuckPerms and CoreProtect.

In a server network, DGuard goes on every game server with its own key, and all of them show up in one panel. DGuard is free up to 30 players online, with the same protection as the paid plans.

FAQ#