Protect your server: backups, griefing and hijacked accounts

A server rarely dies from a lack of players. It dies from a lost world, irreparable griefing, or a makeshift administrator who gave operator status to the wrong person. The four defences below take an evening to set up and will spare you the one mistake there's no coming back from.

1. Backups, and restoring them

A backup you've never restored isn't a backup: it's an intention.

The rule of three fits in one line: three copies, two different media, one off the server. A copy on the same machine protects against nothing, not a disk failure, not an unfortunate command, not a compromised account.

In practice:

• A daily automatic backup of the world folder and the plugins folder. Lost configurations cost as much time as a lost world.
• A copy sent elsewhere every night: another machine, remote storage, it doesn't matter, but elsewhere.
• A test restore every three months. Load the backup on a test server and log in. It's the only way to know it works.

And back up before every update, without exception.

An outage unnoticed at night costs players: once the server is listed on CubeVote, turn on the offline alert in your dashboard to be warned on Discord and by email as soon as it stops answering.

2. Block logging

CoreProtect records who placed and broke what, where and when. It lets you undo griefing in one command: /co rollback u:username t:2h r:50.

Without it, griefing is repaired by hand or not at all, and "not at all" often means the end of the server, because the players affected leave.

Install it on day one, before opening. It only logs what happens after it's installed: added afterwards, it's no use for what just happened.

For areas that absolutely must be protected (spawn, shops, arenas) WorldGuard prevents griefing rather than repairing it. The two complement each other: one prevents, the other recovers.

3. Minimal permissions

The principle fits in one sentence: everyone gets what they need, nothing more.

• Operator is you and nobody else. op bypasses all permissions, including those you think you removed, and gives access to commands that can wipe a world.
• Moderators get a LuckPerms group with moderation commands, and nothing touching the world or plugins.
• Dangerous commands: /stop, /op, /ban-ip, large-radius WorldEdit commands, stay out of intermediate groups.

A moderator who needs one more command will ask for it. A moderator who was given everything "to keep it simple" will eventually make a mistake, and you won't know which.

4. The console and the ports

Your server's console is full access to the machine. Treat it as such.

• Close RCON if you don't use it (enable-rcon=false). If you do, change the default password and never expose its port to the Internet.
• Only expose 25565. Everything else (database, admin panel, RCON) goes through a private network or a tunnel.
• Update. The Log4Shell flaw at the end of 2021 hit tens of thousands of Minecraft servers precisely because they ran old versions. A version a year behind is a vulnerable version.

The case of unauthenticated accounts

A server in online-mode=false accepts clients that haven't authenticated with Mojang. It's a legitimate choice (it opens the server to players who can't buy the game) but it has a consequence you have to face: anyone can connect under any username, including yours.

If you make this choice, AuthMe or an equivalent isn't optional: without an authentication plugin, the first person to come along logs in under your administrator's username and gets their rights. The same goes for a whitelist: in unauthenticated mode, it only checks a username.

And remember to state it clearly on your listing: players looking for a server with unauthenticated accounts look for it specifically, and those who don't want one prefer to know beforehand.

Flood attacks

A growing server ends up attracting an attack. Two measures are enough at first:

• Don't publish the machine's real IP address. Advertise a domain name, and point it to a filter or proxy. A published IP can't be unpublished.
• Choose a host that advertises DDoS protection. It's now common, including on ten-euro offers.

The day-one checklist

• CoreProtect installed before opening
• Daily automatic backup, with an off-machine copy
• A successful test restore
• LuckPerms, groups defined, op reserved for you
• WorldGuard on the spawn
• RCON closed or protected
• Server and plugins up to date
• An authentication plugin if online-mode=false

Eight lines, one evening. It's the difference between an incident and a closure.

---

A well-run server shows: steady uptime, no unexplained outages. List yours, the status page publishes its measured uptime, and that's a selling point.