server.properties sits in the server's root folder and is created on first start. The format is simple: one key=value per line, lines starting with # are comments. The server reads the file only at startup, so every change needs a restart. Missing keys and invalid values are replaced with defaults, and the file is rewritten.
Access and security
These keys decide who can join and what the outside world sees. Mistakes here cost the most: an exposed RCON, or account checks turned off without an auth plugin, means handing your server to the first stranger.
| Key | Default | What it does and what to set |
|---|---|---|
online-mode | true | Only let in players whose account Mojang's servers have verified. Set false only behind a proxy, or on an offline-mode server with an auth plugin: see offline mode. |
white-list | false, true since 26.3 | Only let in players from whitelist.json (/whitelist add <name>, /whitelist on). Operators are whitelisted automatically. For private servers and testing. |
enforce-whitelist | false | When the whitelist is reloaded, kick online players who are no longer on it. Turn it on together with white-list, or a removed player keeps playing until they leave. |
enforce-secure-profile | true | Only allow players with a Mojang-signed public key. If disabled, chat messages are unsigned and can't be reported, and clients get a warning when connecting. |
prevent-proxy-connections | false | Kick a player if their ISP/AS differs from the one they authenticated with Mojang through. A player whose login and game traffic take different networks gets kicked too. |
hide-online-players | false | Don't send the list of names in the server-list ping. The online count is still shown. |
enable-status | true | Answer server-list pings. false makes the server look offline to scanners, but it still accepts connections. |
server-port | 25565 | The TCP port the server accepts players on. More in the article on IP and port. |
server-ip | blank | The address to listen on. Blank means all addresses of the machine. 127.0.0.1 means local only — the way to hide game servers behind a proxy on the same machine. |
enable-rcon, rcon.port, rcon.password | false, 25575, blank | Remote console. The connection isn't encrypted and the password travels in plain text — connect only from the machine itself and never expose the port. With a blank password RCON won't start. |
enable-query, query.port | false, 25565 | The query protocol (UDP) with server info. On Paper it also sends the plugin list by default (query-plugins in bukkit.yml). Don't need it — leave it off. |
spawn-protection | 16 | Spawn protection radius: a square with a side of 2×N+1, so 33×33 blocks. Only works if the server has at least one operator. 0 disables it, if a plugin protects your spawn. |
chat-spam-threshold-seconds, command-spam-threshold-seconds | 10, 10 (since 26.2) | The built-in auto-kick for spamming chat messages and commands; 0 disables it. |
log-ips | true | Write player IPs to the console and log. Useful for moderators hunting alt accounts — but then the log is data you have to protect. |
enable-command-block | false | Before 1.21.9: whether command blocks work. Since 1.21.9 the key is gone and it's a game rule; since 1.21.11 it's named command_blocks_work, and /gamerule command_blocks_work with no value shows the current setting. |
allow-flight: why to keep it false
allow-flight doesn't let anyone fly. It only decides whether to kick someone who hangs in the air in Survival. With false (the default) the server kicks such a player after a few seconds with “Flying is not enabled on this server”. With true that kick is off for everyone.
It's a built-in and very crude check: Paper's reference says this kind of flight is most likely hacking, but false positives happen. The Minecraft Wiki warns that allow-flight=true makes griefers' work easier. So keep it false unless you have a reason.
If you do turn it on (say, because of false kicks on a map with jump pads), know the trade-off: flight in Survival is now caught by your anticheat alone. The vanilla kick only notices hovering — it doesn't see Speed, Timer or NoFall, and Fly cheats know how to dodge it. Make sure your anticheat covers flight completely:
| Cheat | DGuard | GrimAC | Vulcan | Polar | Intave | Matrix |
|---|---|---|---|---|---|---|
| Flyflies without elytra or creative | ||||||
| ElytraFlycontrolled elytra flight | partly: not named — the simulation recreates 'most' movements | |||||
| BoatFly / EntitySpeedflies and speeds up on vehicles |
Performance
These keys drive CPU, memory and network load. If the server lags, start with the distances: they give the most and break nothing. For finding the actual cause, see server lag.
| Key | Default | What it does |
|---|---|---|
view-distance | 10 | How many chunks around a player the server sends to the client (radius, 3–32). This is memory, network and generating new chunks. A pre-generated world removes the last one: see pre-generation. |
simulation-distance | 10 | The radius in chunks where the world is “alive”: mobs move, farms grow, redstone runs (3–32). This is CPU load. Entities beyond it aren't ticked. |
entity-broadcast-range-percentage | 100 | How close entities must be to be sent to the client, as a percentage of the default (10–1000). Higher means seen from farther away, at a higher cost. On Paper this percentage scales the entity-tracking-range values in spigot.yml. |
network-compression-threshold | 256 | Packets of this many bytes or more are compressed. -1 disables compression, 0 compresses everything. Below 64 may bring no benefit; above the MTU (usually 1500) isn't recommended. |
rate-limit | 0 | How many packets a player may send before being kicked; 0 disables it. Paper has its own packet-limiter in config/paper-global.yml: 500 packets per 7 seconds by default, then a kick. |
sync-chunk-writes | true | Synchronous chunk writes: protect the world from corruption after a crash, but can slow the server down. On Paper it has no effect by default unless the matching Java system property is set. |
max-players | 20 | How many players can be online at once. It's a slot limit, not a performance one: how many players your machine handles depends on hardware and plugins. |
Gameplay
| Key | Default | What it does |
|---|---|---|
gamemode | survival | Default game mode: survival, creative, adventure, spectator. |
force-gamemode | false | true puts players into the default mode on every join. false lets them join in the mode they left in. |
difficulty | easy | Difficulty: peaceful, easy, normal, hard. |
hardcore | false | Hardcore for newly created worlds: a player who dies becomes a spectator. |
pvp | true | Before 1.21.9: whether players can damage each other. Since 1.21.9 the key is gone — use the pvp game rule. |
motd | A Minecraft Server | The server description in the server list. Supports § formatting codes; \n starts a second line. |
level-name | world | The world folder name. Change it and the server creates a new world; the old one stays on disk. |
level-seed | blank | Seed for generating a new world; blank means random. |
player-idle-timeout | 0 | Kick players idle for this many minutes; 0 never kicks. Keep in mind that AntiAFK cheats exist to get around exactly this. |
Since 1.21.9, PvP and command blocks are switched with game rules; the names below are for 1.21.11 and newer. Paper keeps game rules per world, so run the command in every world where you need it:
/gamerule pvp false
/gamerule command_blocks_work falsePaper's configs: what isn't set here
server.properties is the vanilla file. Paper adds its own configs, and many important settings live there:
config/paper-global.yml— server-wide settings: thepacket-limiter, accepting players from a Velocity proxy (proxies.velocity, see Velocity setup), chunk loading rates.config/paper-world-defaults.yml— defaults for every world: for example anti-X-ray (anticheat.anti-xray, off by default — how to enable it is in X-ray protection).paper-world.ymlin a world's folder — overrides for that one world. Since 26.1 these files live inworld/dimensions/minecraft/<dimension>/. Copy in only what you change; the rest comes frompaper-world-defaults.yml.bukkit.ymlandspigot.yml— inherited from Bukkit and Spigot: the delay between connections from one IP,query-plugins, entity tracking ranges.
An anticheat isn't configured in any of these files — it's a separate plugin with its own config. DGuard goes into plugins/ on Paper or Leaf, the license key goes into plugins/DGuard/config.yml, and so does how strictly it punishes. Step by step: the install guide.
FAQ
Where is server.properties?
In the server's root folder, next to the server jar. It's created on first start; on a hosting service you usually open it in the panel's file manager.
Why didn't my server.properties changes apply?
The server reads the file only at startup, so you need a full restart after editing. If a key is misspelled or a value is invalid, the server falls back to the default.
How do I turn off PvP on a Minecraft server?
Before 1.21.9, set pvp=false in server.properties. Since 1.21.9 the key is gone: run /gamerule pvp false in every world where you don't want PvP.
Why does my new server say “You are not white-listed”?
Since 26.3 the whitelist is on by default (white-list=true). Add players with /whitelist add <name>, or set white-list=false and restart.
Should I enable allow-flight?
Usually not: with false the server kicks for long flight in Survival itself, with true all flight protection falls on your anticheat. Enable it only if the vanilla kick hurts honest players, and make sure your anticheat catches Fly.
What view-distance should I use?
The default is 10, the allowed range is 3–32. If the server can't keep up, lower simulation-distance first (CPU load), then view-distance (memory and network).
Sources
- Minecraft Wiki: server.properties
- Paper: server.properties reference
- Paper: configuration files
- Paper: paper-global.yml
- Paper: paper-world-defaults.yml
- Paper: spigot.yml (entity-tracking-range)
- Paper: bukkit.yml
- Minecraft Wiki: game rules
- DGuard, the best anticheat for a modern Minecraft server: checks compared with GrimAC, Vulcan, Polar, Intave and Matrix
- DGuard: installation, requirements and troubleshooting
- DGuard: supported Paper and Leaf versions