Operators and the whitelist: who may do what on a server

In short: op <name> in the console gives a player the level from op-permission-level (4 by default — every command, stop included). The whitelist is turned on with whitelist on or white-list=true in server.properties; since 26.3 it's on by default on a new server. Operators always get past the whitelist. For a moderation team, use a permissions plugin — LuckPerms — instead of OP.

Operator levels#

The server console runs with full rights. The full command list with levels is in the command cheat sheet.

How to give and remove OP#

1. 1

   From the console

   op Steve to give, deop Steve to remove. In game the same commands need level 3.

2. 2

   The default level

   A new operator gets the level from op-permission-level in server.properties, 4 by default. Set 3 or 2 if OP goes to anyone besides the owner.

3. 3

   An exact level for one player

   Stop the server and change the player's level field in ops.json; the bypassesPlayerLimit field there decides whether they can join a full server.

[
  {
    "uuid": "069a79f4-44e9-4726-a5be-fca90e38aaf5",
    "name": "Notch",
    "level": 3,
    "bypassesPlayerLimit": true
  }
]

The whitelist#

• Operators always get in. On Java Edition an operator joins while the whitelist is on, even without an entry in whitelist.json.
• Kicking removed players. Normally a player removed from the list finishes their session. With enforce-whitelist=true the server kicks anyone not on the list when it reloads it.
• On by default since 26.3. On a fresh server white-list defaults to true: nobody but operators gets in until you add players or turn the list off.
• The whitelist checks UUIDs. On an online-mode server a player can change their name and keep their entry.

The files next to the server#

Edit these files with the server stopped, or reload them with a command: on shutdown the server writes its own copy over yours. Include them in your backups — without them a restored server comes back with no operators and no bans.

Moderators need permissions, not OP#

OP levels are blunt: a moderator needs level 3 to kick and ban, and with it they get op — so they can make anyone an operator. A permissions plugin grants exactly the commands needed — kick, mute, player checks — without op, stop or giving items. A ready group layout default → helper → moderator → admin is in LuckPerms; how to organise the team itself is in building a moderation team.

The punishment log is also best given separately from server rights. In DGuard — the best anticheat for a modern Minecraft server — you invite moderators to the panel by email: they see the punishment log with reports and the server status, but get neither OP nor your password.

FAQ#