Bot Attack on Your Minecraft Server: How to Tell and Stop It

How to tell it's a bot attack

Open the panel's «Console». A bot attack gives itself away by its rhythm: lots of joins in a row, with names that look generated (random letters and numbers, or the same name with a number after it), connecting and leaving within seconds.

If almost every line ends in «Failed to verify username», the bots have no Minecraft account and the server is already kicking them on its own: with «Official Minecraft accounts only» on, nobody gets in without a bought account. They clutter the console, but they never get to play.

If they really get in and move, break or type, either your server is cracked or the bots use real accounts. The first is by far the most common. And if what you notice is that nobody can join, ping shoots up and the console is quiet, it isn't bots connecting: it's traffic flooding the network, and that is stopped before it reaches your server (more below).

Before changing anything, look at «Performance»: if the CPU is high only during the wave of connections, it's the attack; if it was high before, the lag may come from something else and the lag guide helps you measure it.

The four kinds and what stops each one

A flood of joins on a cracked server. Hundreds of bots with made-up names join at once to fill the slots or crash the server. It's the most common attack because it costs nothing: without official accounts, a program can invent as many players as it likes. Turning «Official Minecraft accounts only» back on stops it or, if you need cracked, an antibot like Sonar plus AuthMe.

Robots that scan the internet for open servers. They try addresses, find your server in the list and join with an account to grief or leave messages. There aren't many at once, but they come back. The whitelist stops them: if you're not on it, you don't get in, whatever account you have.

Chat spam bots. A few join and post ads or insults non-stop. Minecraft already kicks anyone who types too fast for spamming; for the rest, ban them and, if they come back with other names, use the whitelist while it lasts.

A flooding attack (DDoS). Nobody joins: so much traffic is sent that the connection chokes. No plugin fixes that, because the problem arrives before the server does. At NapNodes the traffic of every server comes in through OVHcloud's network, which filters flooding attacks before they reach your machine.

First: lock the door from the panel

1. Check official accounts

   «Settings» → «Joining and players» → «Official Minecraft accounts only» must be on. It's what stops the most bots, because each one would need a bought account. If you turned it off to play cracked, think about whether you really need it.

2. Turn on the whitelist

   In the same section, «Whitelist» and «Kick anyone not on the list». Add your people in «Settings» → «Players» → «Whitelist» before turning it on, or you'll lock yourself out too. With the server on, whitelist add Name in the «Console» also works.

3. Kick the ones already inside

   With «Kick anyone not on the list», turning on the whitelist kicks everyone who isn't on it. If any of them broke things, ban Name in the «Console» or in «Settings» → «Players» → «Banned».

4. Restart

   «Settings» saves each setting on its own and it applies on restart. Press «Restart» and watch the «Console»: anyone not on the list leaves with «You are not white-listed on this server!».

If your server has to stay open

The whitelist is the strongest fix, but it's no good for a public server that wants new people. For that case there are three settings that already come with the game and with Paper, the server type we deliver.

Wait between connections. In «Files», bukkit.yml, the line connection-throttle: 4000 is how many milliseconds the same address has to wait between one join attempt and the next. Whoever tries sooner sees «Connection throttled! Please wait before reconnecting.». Raising it to 10000 slows down bots that reconnect non-stop from a few addresses; don't raise it much more, or a player whose connection drops will have to wait to come back. Restart for it to apply.

Packet limit. Paper already has a limiter that kicks anyone sending packets non-stop (packet-limiter in config/paper-global.yml), on by default: you don't need to touch it. There's also «Settings» → «Performance» → «Packet limit per player» (rate-limit), which defaults to 0, no limit; Paper's is usually enough, and a number that's too low kicks honest players.

Kick players joining through a VPN or proxy. In «Settings» → «Joining and players» there's «Kick players joining through a VPN or proxy» (prevent-proxy-connections): it compares the player's connection with the one Mojang saw at login. It cuts bots that use proxies, but it can also kick normal people with unusual connections, so try it and watch it for a few days before leaving it on.

An antibot: Sonar

If the settings aren't enough, Sonar is an open-source antibot (GPLv3 licence) for Paper, Velocity and BungeeCord. The first time someone connects, Sonar sends them through a very light fake server and checks they behave like a real game: that they fall with gravity, collide properly with blocks and send packets the way Minecraft sends them. A bot that can't imitate that doesn't get through. It also queues incoming connections, so hundreds can't join at once.

It doesn't ask normal players for a captcha or make them type anything: the first join takes a moment longer and that's it. Its authors say it almost never locks out an honest player because Minecraft runs over TCP and packets always arrive in order, so ping doesn't affect it.

Its authors also advertise a separate version 3.0 on their website; the open-source one, version 2, is the one that shows up in «Mods & plugins» (Modrinth has it for Paper up to 26.3) and for a small or medium server it's plenty.

Installing Sonar

1. Make a backup

   «Backups» → create. That way you can roll back in a minute if something doesn't convince you.

2. Search for it in «Mods & plugins»

   Search for Sonar and install it. The panel only shows the versions that work with your Minecraft version. If it doesn't show up, download it from the «Releases» of jonesdevelopment/sonar on GitHub (the Bukkit/Paper .jar) and upload it with «Files» to the plugins folder.

3. Restart

   Press «Restart». In the «Console» you'll see Sonar start and, when someone new joins, how they pass the check.

4. Join first yourself

   Connect like any other player and check you get in. If you have Bedrock friends on Geyser, have them try too before calling the problem solved.

If your server is cracked

A server with «Official Minecraft accounts only» turned off is the favourite target: anyone can join with any name, including an op's, and a bot can invent a thousand players. If you still want it cracked, you need two things at once.

AuthMe, so every name has its password: whoever joins with an already registered name and doesn't know the password doesn't play. Register your admin name first. And an antibot like Sonar so bots don't even reach the registration screen.

How to set up cracked with AuthMe, and why we don't recommend it, in the cracked server guide. To play with Bedrock friends you don't need it: Geyser and Floodgate let their Microsoft accounts in without opening the server to anyone else.

After the attack

Check what they did. If the bots got to play, CoreProtect tells you who broke what and undoes it with a rollback; if you didn't have it, the last copy in «Backups» from before the attack is your way back.

Banning by name doesn't do much, because every bot brings a new one. Banning by address (ban-ip) only works if they come from a few; in an attack with hundreds of addresses, the whitelist or Sonar do the work and you don't have to chase anyone.

If the server is on a public server list, the attacks will come back now and then: keep what worked for you. And if the console is still full or the server doesn't run well again, write to «Help» in the panel with a few lines from the «Console».

Frequently asked questions