Minecraft server security: the full checklist

In short: run an anticheat that covers every front, keep online-mode=true (or set up a proxy with a forwarding secret and a firewall), expose only the game port, take plugins only from official catalogs, keep OP with the owner alone and give your staff permissions through groups. Turn on two-factor sign-in wherever it exists, keep backups with a copy off the machine, log block changes and update the server and plugins regularly.

The security checklist#

Someone else's name: online-mode and the proxy secret#

With online-mode=true (the default) the server only lets in players verified against the Minecraft account database. The Minecraft Wiki says it plainly: with false, attackers with fake accounts can connect. If you do let in players without a paid account, you need an authentication plugin — see offline-mode servers.

In a Velocity network the game servers run with online-mode=false: the proxy checks the account. So nothing but the proxy may reach them. Velocity's docs call this extremely dangerous and give two layers: modern forwarding with the secret from forwarding.secret, and a firewall — modern forwarding, in their words, is not a replacement for a firewall. If the proxy and the servers share a machine, bind the servers to server-ip=127.0.0.1. Treat the secret like a password — step by step in setting up Velocity.

Ports and the firewall#

Only the game port faces the internet — 25565 or the proxy's port. Everything else is either off or closed in the firewall:

• RCON (`25575`). Off by default (enable-rcon=false). The protocol isn't encrypted and the password can be intercepted, so connect from the machine itself or through an SSH tunnel — see RCON.
• Query. Off by default (enable-query=false) — don't turn it on without a reason.
• The server management protocol. Off by default (management-server-enabled=false) and listening on localhost — leave it that way.
• Plugin databases. MySQL or MariaDB listen on a local address or your servers' addresses, not the whole internet.
• Game servers behind a proxy. Only 127.0.0.1 or the proxy's IP.

sudo ufw allow 22/tcp        # SSH (or your SSH port)
sudo ufw allow 25565/tcp     # Minecraft or the proxy
sudo ufw enable
sudo ufw status verbose

Velocity's general security advice adds: run your servers as an unprivileged user — no sudo, not as root — use strong passwords and secure every other service on the machine. A firewall won't stop bots or an attack on your bandwidth — for that you need an antibot and a protected proxy, see bots and DDoS.

Plugins only from trusted sources#

A plugin runs inside the server with the server's own rights: it can grant OP, read configs with database passwords and download anything. Velocity's docs advise thinking carefully about the impact of any plugin before installing it. Take plugins from Modrinth, Hangar, SpigotMC or the author's own GitHub releases, and never install "free" leaks of paid plugins. How to spot a backdoor and what to do if the server is already infected is in malicious plugins.

OP and staff permissions#

OP is every server command at once. A new operator gets the level from op-permission-level, 4 by default — the highest. Keep OP with the owner only, and give helpers, moderators and admins permissions through groups in LuckPerms: each gets exactly what the job needs. Levels and files are in OP and the whitelist, staff roles in the moderation team.

Two-factor sign-in#

A stolen password opens a server without any exploit. A second factor — a code from an app — closes that path: the password alone is no longer enough. Turn it on everywhere that gives access to the server:

• The Microsoft account of the owner and the staff — that's how they sign in to Minecraft. Microsoft supports two-step verification.
• The hosting panel and the email it's registered to: passwords are reset through that email.
• SSH on a VPS — sign in with a key. Password logins over SSH can be turned off with PasswordAuthentication no in sshd_config (they're allowed by default).
• The server's Discord: admins there control the channels with the rules, appeals and announcements.
• The anticheat panel. In DGuard two-factor sign-in is turned on in the settings: a code from an authenticator app, plus backup codes for when your phone isn't at hand.

Backups, logs and updates#

• Backups. Automatic, following the 3-2-1 rule, with a copy off the machine and a tested restore — see server backups. The archive holds database passwords and your DGuard license key: keep it as locked down as the server, and if it leaks, issue a new key in the panel.
• Block logs. CoreProtect shows who broke a block or opened a chest and rolls griefing back without restoring the whole world. Claims and regions are in grief protection.
• Updates. PaperMC recommends updating Paper at least once a week and never replacing a jar on a running server. Moving to a new game version is a separate job with a backup and plugin checks: updating the server.
• Dupes. By default Paper fixes TNT, carpet and rail duping and bedrock breaking; the settings that bring them back live in the unsupported-settings section — see dupes and exploits.

The anticheat: protection from cheaters#

Every layer above protects the server from being taken over, but not from a player with KillAura, Fly or Scaffold who logged in fair and square. That's the anticheat's job, and coverage matters here: a cheat the anticheat doesn't check walks past every other layer. DGuard — the best anticheat for a modern Minecraft server — has a check for every one of the 47 cheat types in our comparison; the nearest rival, Intave, has 27. Every rival's mark is checked against its source code and documentation.

• Every front at once: combat, movement, packets, inventory, building, world. Evidence piles up across all fronts, the ban is precise, and you set the strictness.
• Hidden mode: no setbacks or cancelled hits, so a cheater doesn't know he's been caught while the evidence builds up.
• Trained on real cheaters on a live server with 500+ online; a new bypass is closed within a couple of days, and support is direct.
• Load: 0.03 % of one core on the main thread — the checks run in network threads.
• No inbound ports: only outbound HTTPS to DGuard's site — for the license, updates and the cloud combat check with AI Combat. The firewall from this article doesn't get in its way.

DGuard runs on Paper and Leaf 1.21–26.3 next to the latest PacketEvents release. It's free up to 30 players online, with the same protection as on paid plans.

FAQ#