How to secure your Minecraft server: public, private, and cracked setups

How to secure your Minecraft server: public, private, and cracked setups

Hosting a Minecraft server is an incredible experience, but leaving your server unprotected can quickly turn a fun project into a nightmare. From automated port scanners and unauthorized operator access to account spoofing on cracked servers and proxy bypass exploits, unmanaged servers face constant risks.

Whether you run a small private SMP for close friends or a multi-instance public network running offline-mode (cracked) compatibility, this comprehensive guide covers the exact guidelines, plugins, network configurations, and best practices to keep your world bulletproof.

---

Understanding your server model

Security requirements differ significantly depending on who plays on your server and how authentication is handled.

1. Private Server (Friends Survival / Whitelisted SMP)

• Goal: Keep uninvited strangers out and protect builds from accidental damage.
• Primary Risk: Port scanners indexing open ports and griefing unprotected bases.

2. Public Community Server

• Goal: Allow open access while enforcing fair play, protecting spawn regions, and guarding against crashes/DDoS.
• Primary Risk: Cheaters, bot raids, packet crashes, malicious staff impersonation, and DDoS attacks.

3. Online-Mode (online-mode=true) vs Offline-Mode / Cracked (online-mode=false)

• Online Mode: The server verifies every joining player against official Mojang/Microsoft authentication servers. Account identity is tied to verified UUIDs.
• Offline Mode (Cracked): Mojang authentication is completely disabled. Anyone can connect using any launcher (e.g., TLauncher) with any username.

---

The critical dangers of Offline-Mode (Cracked Servers)

When you set online-mode=false in server.properties, the Minecraft server accepts any username without verification.

⚠️ Warning Without an authentication plugin, anyone can type your admin or OP username into a launcher and join your server with full administrative rights. They do not need a password or a legitimate Minecraft account.

If you host an offline-mode server, implementing an authentication framework is mandatory.

---

1. Authentication & Identity Management for Cracked Servers

Install an Authentication Plugin

For any cracked or hybrid server, install a trusted authentication plugin:

• AuthMeReloaded (Spigot/Paper): The gold standard for in-game password authentication.
• nLogin (Paper/Velocity/Bungee): Modern, fast authentication plugin with built-in 2FA and auto-login support.
• FastLogin (Paper/Velocity): Enables seamless automatic login for legitimate premium accounts while requiring cracked players to type /register and /login.

Mandatory In-Game Command Flow

When a player joins for the first time, they must register:

/register <password> <confirmPassword>

On subsequent joins, they must authenticate before moving or executing any commands:

/login <password>

Essential AuthMe Configuration Tweaks

In plugins/AuthMe/config.yml:

# Force unauthenticated players into spawn and freeze movement
settings:
  restrictions:
    allowCommands: ["/login", "/register"]
    denyTabComplete: true
    maxJoinPerIp: 2
    protectInventoryBeforeLogIn: true

# Session protection
settings:
  sessions:
    enabled: true
    timeout: 10 # Session valid for 10 minutes from same IP

Enforce Two-Factor Authentication (2FA) for Staff

Even with strong passwords, staff accounts can be compromised. Require admins and moderators to activate 2FA:

• AuthMe 2FA: Enable Google Authenticator integration in AuthMe via /2fa add. Staff must enter a 6-digit TOTP code upon login.
• LuckPerms Staff PIN: Restrict staff nodes (* or luckperms.*) behind IP whitelist rules or secondary PIN verification plugins.

---

2. Securing Private Servers (Survival Worlds with Friends)

If you are hosting a server strictly for friends, keep it simple and locked down:

Enable Whitelist

Turn on the whitelist so only invited players can connect:

/whitelist on
/whitelist add PlayerName

Hide Default Ports & Use Custom Domains

• Change the default port (25565) to a non-standard port in server.properties (e.g., 25789).
• Set up an SRV Record on your domain (e.g., play.yourdomain.com) pointing to your custom port. This prevents automated bot scrapers from discovering your server through simple IP port-range scans.

Restrict Query and RCON Ports

In server.properties:

enable-query=false
enable-rcon=false

If you must use RCON for remote server management panels:

• Set a long, random password (rcon.password=SuperSecretRandomPassword123!).
• Never expose the RCON port (25575) directly to the public internet; bind it to 127.0.0.1 or restrict incoming IPs using a firewall.

---

3. Network, Proxy, and Proxy-Bypass Prevention (BungeeCord / Velocity)

When scaling to multi-server networks using Velocity or BungeeCord, backend servers run in online-mode=false because the proxy handles player authentication.

The Proxy Bypass Exploit

If a backend server port (e.g., 25566 for Survival) is open to the public internet, an attacker can bypass your Velocity/BungeeCord proxy entirely and connect directly to IP:25566 using a cracked client under an OP username!

Solution A: Modern Forwarding with Secret Keys (Velocity)

1. On Velocity (velocity.toml):

   player-info-forwarding-mode = "modern"
   forwarding-secret-file = "forwarding.secret"
   

2. On backend Paper (config/paper-global.yml):

   proxies:
     velocity:
       enabled: true
       online-mode: true
       secret: "COPY_CONTENT_FROM_FORWARDING_SECRET_FILE"
   

This cryptographic handshake ensures backend servers only accept connection packets signed by your Velocity proxy.

Solution B: BungeeGuard for BungeeCord

If using BungeeCord, install BungeeGuard on the proxy and all backend Paper instances to enforce token validation.

Solution C: Firewall Port Isolation (UFW / iptables)

Block all public direct connections to backend ports on your Linux host:

# Allow SSH and Proxy Port
sudo ufw allow 22/tcp
sudo ufw allow 25565/tcp

# Deny public access to backend server port
sudo ufw deny 25566/tcp

If backend servers are on separate hosts, allow incoming connections only from the proxy's IP address:

sudo ufw allow from PROXY_IP to any port 25566 proto tcp

---

4. Permissions & Operator (OP) Safety

Giving players /op grants unlimited access to corrupt, crash, or wipe your server.

Apply the Principle of Least Privilege

• Never grant /op permanently.
• Use LuckPerms to create structured group roles (default, member, mod, admin).
• Assign specific permission nodes instead of blanket wildcard (*) access.

# Create clear group structures
/lp creategroup member
/lp creategroup mod
/lp creategroup admin

# Give moderators essential permissions only
/lp group mod permission set essentials.kick true
/lp group mod permission set essentials.ban true
/lp group mod permission set coreprotect.inspect true

Block Dangerous Admin Commands

Prevent unauthorized staff or compromised accounts from ruining the server:

• Disable /op, /deop, /stop, /reload, /plugin, /luckperms for non-console users.
• Use plugins like CommandWhitelist or PlugManX restrictions to hide installed plugins (/plugins) from players, preventing attackers from identifying vulnerable plugin versions.

---

5. World Protection, Logging, and Anti-Griefing

CoreProtect (Block & Container Logging)

Install CoreProtect on every Paper/Spigot server. It logs every block placed, broken, item taken from chest, and command executed.

• Inspect griefed area: /co inspect (right-click blocks with a feather or block).
• Rollback griefer's damage over the last 24 hours:

  /co rollback u:GrieferName t:24h r:50
  

WorldGuard & WorldEdit

Protect your spawn, hubs, and shop zones:

1. Select area with WorldEdit (//wand).
2. Claim region: /rg define spawn.
3. Set protection flags:

   /rg flag spawn pvp deny
   /rg flag spawn tnt deny
   /rg flag spawn creeper-explosion deny
   /rg flag spawn mob-spawning deny
   

Player Land Claiming

For public survival, allow players to secure their builds:

• GriefPrevention: Simple shovel-based land claiming.
• Lands or Towny: Advanced chunk-based claiming and community management.

---

6. Anti-Cheat & Exploit Mitigation

Modern Anti-Cheat Solutions

Public servers inevitably attract cheaters using movement hacks, X-Ray, or aura bots.

• GrimAC: Open-source, highly accurate predictive anti-cheat for modern Minecraft versions.
• Vulcan / Spartan: Commercial anti-cheat solutions for comprehensive combat, movement, and inventory checks.

Prevent Server Crash Exploits

Attackers may attempt to crash your server using oversized nbt book packets, massive redstone clocks, or entity cramming.

• Use Paper or Purpur server software; they include built-in protection against illegal packet sizes, book exploits, and gravity block dupe crashes.
• Configure paper-global.yml packet rate limits to automatically kick players sending flood packets.

Avoid Pirated / Nulled Plugins (Malware Warning!)

🚨 Caution Never download "free" pirated or nulled versions of premium plugins from third-party sites. Over 90% of nulled plugins contain backdoors (e.g., force-op scripts, secret admin commands, remote code execution bugs, or auto-downloading botnet payloads).

Only download plugins from trusted, official sources:

• SpigotMC.org
• Hangar (PaperMC)
• Modrinth.com
• GitHub (Official repositories)

---

7. DDoS Protection & Server Backups

Protection Against DDoS Attacks

Minecraft servers run on TCP, making them easy targets for UDP/TCP flood attacks.

• For public networks, route player traffic through a reverse proxy service like TCPShield, CosmicGuard, or Cloudflare Spectrum.
• Keep your true backend server IP secret so attackers cannot hit your raw server interface.

Automated Off-Site Backups

No security setup is complete without reliable backups.

• Enable automatic daily rolling backups (keep at least 7–14 days of snapshots).
• Maintain off-site backups so you can recover quickly even in the event of hardware failure or severe corruption.

---

Complete Security Checklist

Security Task	Private SMP	Public Server	Cracked Server
Server Whitelist Enabled	Yes	Optional	Optional
Auth Plugin (AuthMe / nLogin)	Optional	Recommended	Mandatory
Proxy Forwarding Secret (Velocity)	N/A	Mandatory	Mandatory
Backend Ports Firewalled (UFW)	Recommended	Mandatory	Mandatory
LuckPerms (No Permanent OP)	Recommended	Mandatory	Mandatory
Staff 2FA / Secondary Auth	Optional	Mandatory	Mandatory
CoreProtect & WorldGuard	Recommended	Mandatory	Mandatory
Anti-Cheat (GrimAC / Vulcan)	No	Mandatory	Mandatory
Official Plugins Only (No Nulled)	Mandatory	Mandatory	Mandatory
Automated Daily Backups	Mandatory	Mandatory	Mandatory

---

Summary

Securing your Minecraft server comes down to identity verification, access control, and proactive defenses:

1. For Cracked Servers: Always use AuthMeReloaded or nLogin with strict command restrictions and 2FA for staff.
2. For Proxies: Secure backend ports using Velocity modern forwarding or UFW firewall rules to prevent proxy bypasses.
3. For World & Staff Safety: Replace blanket /op with LuckPerms, install CoreProtect for instant rollbacks, and only download plugins from official platforms.

With these guidelines in place, your Minecraft server will stay safe, stable, and ready for your players to enjoy!