How to Protect Your Minecraft Server from Griefers: Whitelist, CoreProtect and Backups

1. Decide who gets in

If the server is for friends, the whitelist solves almost everything: only people on the list can join. The commands are in the admin commands guide (whitelist on, whitelist add Name). In the NapNodes panel, “Settings” also lets you manage the whitelist by name.

If it's public, put some rules in the server message and appoint one or two moderators with limited permissions (with LuckPerms), not full op: an op can wipe the world with a single command.

2. Protect what's been built (plugins on Paper)

GriefPrevention lets each player claim their land with a golden shovel: nobody else can break blocks or open chests inside. It's the simplest option for small communities. WorldGuard is more powerful (regions, flags) and fits protecting the spawn or shared areas.

They're plugins: they work on Paper and similar, not on the vanilla server or on Fabric/Forge. If you don't know which one you're running, see the Paper, Fabric and Forge guide.

3. Undo the damage with CoreProtect

CoreProtect records who changed each block, when, and what they took from chests. That way you can roll back only what the culprit did, without restoring a whole backup and making honest players lose their own progress.

1. Install it

   From “Mods & plugins” in the panel (if it doesn't show up in the search, upload the .jar from its official page to the plugins folder from “Files”) and restart the server.

2. See who did it

   With inspector mode (/co inspect) you click a block or chest and it tells you who touched it and when.

3. Roll back the culprit

   For example, /co rollback u:Name t:1d r:30 undoes what that player did in the last day within 30 blocks around you. Try it with a small radius first.

4. If you suspect X-ray

   /co lookup a:-block i:diamond_ore,deepslate_diamond_ore t:3d shows who has mined diamonds in the last 3 days. To stop it happening again, Paper has its own anti-xray, turned off out of the box (how to turn it on).

5. Kick them out

   ban Name in the console, and ban-ip if they come back on another account (bearing in mind an IP can be shared).

4. The safety net: backups

If the griefing is massive or the world breaks, a recent backup wins. Make one before any big change and schedule regular backups; how to make and restore them is in the backups guide. Restoring takes everyone back to the moment of the backup, which is why CoreProtect comes first and the backup is the last resort.

And attacks on the server

It's a different thing when someone tries to take the server down by flooding it with traffic (DDoS). Plugins don't fix that: it depends on the provider's network. NapNodes servers are in the EU with DDoS protection from the OVHcloud network. Even so, don't publish your home IP or the IP of your other services, and don't give admin permissions to people you don't know.

Also keep the server and plugins up to date: old versions are the ones that get exploited. The guide to updating the version shows how to do it without losing the world.

Frequently asked questions