How to protect a Minecraft server from griefers and cheaters

Every public Minecraft server sooner or later meets a player who wants to wreck other people's builds, steal from chests or play with cheats. You can't prevent it completely, but you can make it much harder and, above all, fix it quickly. Protection comes in several layers: sensible permissions, logging world changes, land claims, correct server settings, anticheat and secure access to the panel. This article walks through each of them.

Permissions: LuckPerms and no OP for everyone

The most common mistake on small servers is handing out OP. An operator can change game modes, spawn items, teleport, ban players and even stop the server. One untrustworthy or compromised account is all it takes. Keep OP for yourself and your closest co-admins, and even they should only use it when needed.

For everyone else, use the LuckPerms plugin. It assigns permissions to groups (for example player, helper, moderator, admin), and players are simply added to groups. Follow the principle of least privilege: each group gets only what its role actually needs. A moderator needs kick, temporary bans and access to logs, not a command for giving items. The difference between OP and the whitelist is explained in our Whitelist and OP guide.

CoreProtect: who did it and how to undo it

CoreProtect logs changes in the world — placed and broken blocks, container access, fire, explosions and more. That lets you find out who did what and undo the damage without restoring a whole backup. The most used commands:

/co inspect                          # inspect mode: click a block to see its history
/co lookup u:Player t:2h             # what the player did in the last 2 hours
/co rollback u:Player t:2h r:30      # undo their changes within 30 blocks

Try rollbacks out before you need them for real, and always limit them by time and radius so you don't undo other players' legitimate builds. The logs take up disk space, so it makes sense to purge old data now and then as the documentation describes.

Rules and moderation

Tools help, but people decide what the atmosphere on a server is like. Write short, clear rules and put them where players will see them — at spawn, on Discord and on your website. Players need to know what is forbidden and what the penalty is. Moderators then have something to base decisions on, and players don't feel that punishments are random.

• Give players a simple way to report griefing or a suspicious player, such as a Discord channel.
• Before punishing anyone, check the evidence in CoreProtect or a recording, not just another player's complaint.
• Escalate penalties: a warning, a temporary ban, a permanent ban. And offer a way to appeal.
• Pick new moderators from long-standing, trusted players and start them with limited permissions.

Land claims

CoreProtect repairs the damage; land claims prevent it. Survival servers often use GriefPrevention: players mark out their own claim with a golden shovel, and others can't build on it or open chests unless the owner grants access. For areas managed by admins — spawn, arenas, markets — WorldGuard is a good fit. It sets rules for regions (no building, PvP, explosions and so on) and requires WorldEdit to run.

Whitelist and online mode

In server.properties a public server must always have online-mode=true. The server then verifies that players really own the account they connect with. In offline mode, anyone can join under any name — including an admin's — and inherit their permissions. Offline mode on a public server is therefore a serious security risk. The exception is a network behind a proxy, where the proxy does the authentication, and even then the forwarding must be properly secured.

For a server for friends or a closed community, turn on the whitelist (/whitelist on, /whitelist add Jmeno). A player who isn't on the list won't get in at all. It is the most effective protection of all, though it doesn't suit a server that wants new players.

Anticheat

An anticheat plugin watches player movement and actions and looks for unusual behaviour such as flying, moving too fast or hitting from impossible distances. Well-known options include the open-source Grim and the paid Vulcan. They differ in detection approach, supported versions and how much configuration they need. No anticheat catches everything, and any of them can occasionally flag an honest player, especially under lag. Treat it as a helper for moderators rather than an automatic judge: after deploying one, watch the alerts and only configure punishments once it is tuned.

Against X-ray (finding ores through modified textures), Paper has a built-in anti-xray that you enable in the world configuration.

Backups before every change

When everything else fails, a backup saves you. Make one before installing a new plugin, changing versions or running a large rollback. At BlazeHost, the server is backed up automatically every night and the last 5 days are kept; before a bigger change, start a manual backup in the panel as well. See the guide to backups and version changes.

A secure panel and SFTP

Anyone with access to the panel or SFTP can upload any plugin, delete the world or give themselves OP. So:

• Don't share your account. Add co-admins in the Pterodactyl panel as subusers with only the permissions they need — for example console access without files or backups. See Pterodactyl panel basics.
• Strong, unique passwords. Don't reuse your panel password anywhere else.
• Two-factor authentication. If your panel supports it, enable it in your account settings.
• Revoke access. When someone leaves the team, delete their subuser straight away.

Updates and trusted plugin sources

Outdated plugins can contain known bugs that can be exploited. Update them regularly, and always with a backup first. Download only from official sources — Hangar, Modrinth, SpigotMC or the author's own page. "Leaked" copies of paid plugins from unknown sites are a common source of malicious code that can open a backdoor into your server. Installation is covered in installing plugins.

Summary

• OP only for yourself; everyone else gets LuckPerms groups with the least permissions they need.
• CoreProtect logs changes and allows targeted rollbacks. GriefPrevention and WorldGuard prevent damage in the first place.
• A public server always runs with online-mode=true. A closed server uses a whitelist.
• Anticheat is a helper, not a guarantee. Expect tuning and false positives.
• A backup before every change, subusers with limited permissions, strong passwords and plugins only from trusted sources.