Running a public Minecraft server means dealing with attacks, griefers, and cheaters. A secure server keeps legitimate players happy and minimizes downtime. This guide covers every protection layer — from network-level DDoS mitigation to in-game anti-grief and staff management.
Layer 1: DDoS Protection
DDoS attacks target the network layer and the game protocol. At the network level: CyberNex's 17 Tbit mitigation scrubs attack traffic before it reaches your server. At the game level: configure Paper's 'max-joins-per-second: 5' to prevent join-flood attacks. Set 'connection-throttle: 4000' in bukkit.yml. Use 'network-compression-threshold: 256' in server.properties to reduce bandwidth. For advanced protection, TCPShield or our built-in filtering add game-aware DDoS mitigation.
Layer 2: Anti-Cheat
Anti-cheat is essential for PvP servers. GrimAC is the best option in 2026 — it detects killaura, reach, velocity, scaffold, and fly hacks with minimal false positives. Configure: 'violations: max: 20' before kick, 'alerts: enabled: true' for staff notification. Pair with PacketLimiter to prevent network-level exploits. For cracked servers (offline mode), add LoginSecurity to enforce passwords. Never rely on anticheat alone — active moderation is equally important.
Layer 3: Anti-Grief
GriefProtection with WorldGuard is the standard anti-grief stack. GriefProtection lets players claim land with '/claim'. Configure: 'claims: max: 5' per player, 'blocks: 500' per claim, 'expiration: 30d' for inactive claims. WorldGuard protects spawn and high-value areas. CoreProtect logs every block change, interaction, and inventory action — use '/co inspect' to rollback grief. Keep logs for 30+ days on busy servers. Review logs weekly to catch serial griefers.
Layer 4: Server Hardening
Server-side configuration: disable 'enable-query' and 'enable-rcon' in server.properties unless needed. If using RCON, change default port 25575 and set a strong password. Disable 'online-mode: false' only if you understand the security implications (cracked servers have higher exploit risk). Keep Java updated. Use a non-root user for the server process. On VPS/VDS: configure iptables to rate-limit connections, use fail2ban for SSH, keep the OS updated. These steps prevent most server-level compromises.
Layer 5: Staff Security
Staff accounts are the most common security weakness. Never share accounts. Use LuckPerms with minimal permissions — give OPs only what they need. Set up staff mode: '/staffmode' hides staff from player list. Audit staff actions: CoreProtect logs show who did what. Ban appeal process: require proof for bans >24h. Never promote to OP — use LuckPerms admin group instead. Have a security policy for IRL friend requests from players — social engineering is a real threat.
Backup and Recovery
Even with perfect security, things go wrong. Automated backups: CyberNex snapshots your server every 6 hours with 7-day retention. Manual backups before major updates. Off-site backups: download world files weekly. Recovery plan: document your IP, panel URL, and admin contacts. Test restore monthly — a backup you can't restore is worthless. CoreProtect maintains its own database — back it up alongside world files for rollback capability.
Security is layered — no single tool protects your server. Combine DDoS protection (CyberNex includes it), anti-cheat (GrimAC), anti-grief (GriefProtection + CoreProtect), staff security (LuckPerms), and regular backups. Start with the basics and add layers as your server grows. Most attacks are opportunistic — making your server harder to grief than the next one is often enough.
More in minecraft
Minecraft Server Hosting
Deploy your Minecraft server in under 60 seconds. Paper, Forge, Fabric — Singapore nodes with 40ms to Sri Lanka.