⚔️How to Secure Your Minecraft Server from Attacks

Introduction

DDoS protection handles the network. You handle the in-game side, griefers, bot spam, account takeovers, lag exploits.

Here's the practical hardening checklist.

Anti-Griefer Setup

1. 1Install CoreProtect, logs every block change, lets you roll back grief
2. 2Install WorldGuard, protect spawn, regions, valuable bases
3. 3Set spawn-protection=16 in server.properties
4. 4Turn on player ranks with LuckPerms, restrict commands by trust level
5. 5Set up auto-backups (every 6 hours) from the panel

Anti-Bot Setup

• Install AntiBot or NLogin, stops fake account floods on cracked/online servers
• Turn on whitelist mode for private servers, see the guide
• Set max-players low, bot floods can't exceed your cap
• Use a join captcha plugin if you run a public network

Anti-Lag Setup

• Install ClearLag, clears dropped items and mob entities
• Set view-distance to 8, simulation-distance to 6 in server.properties
• Use Spark to profile and find lag sources
• Cap mob spawning rates in bukkit.yml

Anti-Exploit Setup

• Install NoCheatPlus or Matrix, anti-cheat for movement and combat
• Patch the Log4j (CVE-2021-44228) mitigation flag in your startup args, Paper handles this automatically
• Keep your server software up to date, see version guide

Account Side

• Enable 2FA on your Endercloud account
• Use unique passwords for the panel and your Mojang/Microsoft account
• Don't OP people you don't trust

Need More Help?

Active griefer issue? Run /co lookup with CoreProtect, then ping us on Discord, we can walk you through rollbacks.