Skip to main content

Comprehensive Guide: Minecraft Server Security Standards

Server security is a fundamental aspect that must not be overlooked. A server that isn't properly secured is highly vulnerable to hacker attacks, access abuse, and bot attacks that can damage your server's data integrity.

This guide is structured systematically to implement layered security standards (Defense in Depth), from authentication to network protection.

1. Authentication System​

If your server operates in Offline mode or allows Cracked players, the biggest security risk is identity theft. Without a login system, anyone can use the username "Admin" or "Owner" and take over control of the server.

Solution: LibreLogin Plugin​

We recommend using the LibreLogin plugin because of its lightweight architecture and modern security features.

Version Compatibility Guide: The choice of plugin version depends heavily on the Minecraft server version you're running. Please pay attention to the following guide so the plugin runs stably:

  • For Minecraft 1.21.5+: You can use LibreLogin Prod, which is 0.25.x (or newer).

  • For Minecraft 1.21.1 - 1.21.4: Use the latest LibreLogin version, which is 0.24.0 (or newer), to ensure full compatibility with the latest server protocol.

  • For Minecraft below 1.21.0 (example: 1.20.4 and below):

    1. It's recommended to try version 0.24.0 first.
    2. However, if you experience stability issues (such as errors at startup or players failing to join), you can switch the plugin to version 0.23.1.

Required Configuration (config.conf):

  • Account Restriction (Max Accounts): Set max_accounts_per_ip to 2 or 3. This aims to prevent bot attacks that create thousands of fake accounts simultaneously.
  • Password Strength: Make sure the Administrator account uses a long, complex, and unique password.
  • Login Session: Enable the session feature so players whose connection is briefly interrupted don't need to log in repeatedly.

2. "Zero OP" Policy (Access Rights Management)​

A fatal mistake that often happens is giving Operator (/op) status permanently to staff. OP status grants unlimited access to the entire server system ("God"), which is very dangerous if that account is hacked.

Standard Operating Procedure (SOP) for Granting OP​

We strongly recommend implementing a strict access policy:

  1. Only When Necessary: OP status should only be given when there's an urgent need (such as system repair or debugging) that can't be done with regular permissions.
  2. Only When Online: Give OP status only when you are online on the server.
  3. Immediate Revocation: Immediately revoke that status (/deop <nama>) once the task is done or before you log out/go offline. Never leave an account in OP status when inactive.

Technical Solutions​

  • Permission Delegation (LuckPerms): Use the LuckPerms plugin for daily needs. Give specific permissions (like essentials.ban or gamemode) without granting OP.
  • Automatic Safeguard: Use the OPGuard plugin to ensure the SOP above runs automatically (for example: automatic deop on logout).

3. The Last Layer of Security (OPGuard)​

Even if your account has a strong password, the risk of hacking or a security hole (backdoor) in third-party plugins still exists.

Solution: Protection with OPGuard​

This plugin functions as an internal supervisor for holders of high access rights.

  • Main Function: Prevents malicious plugins from secretly giving OP status to foreign players.
  • Command Restriction: You can block critical commands like /stop, /restart, or /reload so they can't be executed carelessly, even by an OP.
  • Secondary Authentication: OPGuard allows setting a second password specifically for executing administrative commands. This provides a double layer of security if the admin account is successfully hacked.

Recommendation: For detailed configuration regarding securing the operator account, please read the page: OPGuard Guide.

4. Prevention of Illegal Programs (Anti-Cheat)​

The use of illegal modification programs (Hack Clients) by irresponsible players can ruin other players' gameplay experience, such as the ability to fly (Fly) or attack automatically (KillAura).

Solution: GrimAC (Free)​

For modern version servers (1.20 and above), GrimAC is a highly recommended Anti-Cheat solution because of its high detection accuracy and being open-source (open-source).

  • Punishment Configuration: By default, GrimAC may only cancel the player's illegal movement. It's recommended to change the punishments configuration in config.yml so the system automatically kicks (kick) or blocks (ban) players detected cheating repeatedly.

Recommendation: For detailed configuration regarding securing the operator account, please read the page: GrimAC Guide.

5. Server Stability & Anti-Exploit​

Technical attacks are often carried out by sending large amounts of abnormal data packets (such as books with corrupted characters) to overload the server CPU until the server stops operating (Crash).

Solution: ExploitFixer & Paper Configuration​

  • ExploitFixer: This plugin monitors data packet traffic. If an anomaly in packets that could potentially cause damage is detected, that player's connection will be disconnected automatically.
  • Paper Configuration Optimization (paper-global.yml):
    • anti-xray: Enable (mode 2) to hide the presence of valuable minerals from X-Ray users.
    • book-size: Make sure the book size limit is enabled to prevent book data exploitation.

6. Data Recovery & Audit (CoreProtect)​

No security system is perfect. If region destruction (griefing) occurs by players who slip past supervision, you need the ability to restore the state.

Solution: CoreProtect​

This plugin records every block change activity, chest interaction, and chat history.

  • Rollback Feature: You can restore the condition of a certain area to a previous time.
    • Example Command: /co rollback u:NamaPelaku t:1h r:50
    • Function: Restores all damage done by "NamaPelaku" within the last 1 hour in a radius of 50 blocks.

7. Physical Region Protection (WorldGuard)​

Vital server assets like the Spawn area or Main Lobby must be permanently protected from player interaction.

Solution: WorldGuard​

  • Defining a Region: Use WorldEdit to select the area, then save it with the command /rg define spawn.
  • Applying Rules (Flags):
    • build deny: Prevents block placement or destruction.
    • pvp deny: Disables attacks between players.
    • tnt deny & creeper-explosion deny: Prevents damage from explosions.

8. Information Security (Security by Obscurity)​

Don't give hackers a "map". If they know the list of plugins you use, they can easily look for specific security holes (exploits) in those plugins.

There are two methods to hide this information, from basic methods to using professional tools.

A: Basic Method (Permission Management)​

The easiest way to prevent players from seeing the plugin list (the /plugins or /pl command) is to revoke its access permission globally using LuckPerms.

  1. Disable Bukkit Permissions: Run the following commands in the console or in-game (as admin) to revoke access from the default group (regular players): 
    /lp group default permission set bukkit.command.plugins false
    /lp group default permission set bukkit.command.version false
    /lp group default permission set bukkit.command.help false
  2. Result: When a regular player types /plugins, the server will respond with the message "You do not have permission...", as if the command doesn't exist for them.

B: Plugin Hide Pro (Paid)​

For advanced security and a cleaner look (Premium), we highly recommend using Plugin Hide Pro.

This tool doesn't only block commands, but also manipulates the Tab-Complete feature. This means, when players type /, they won't see any sensitive command suggestions at all.

  • Download: Plugin Hide Pro (SpigotMC)
  • Main Features:
    • Tab-Complete Filter: Prevents players from peeking at admin commands via the TAB button.
    • Command Rewrite: You can change the "Unknown Command" message into a custom message so it looks more professional.
    • Cross-Platform: Supports Spigot, BungeeCord, and Velocity.

Additional: Hide the Server Version​

Don't forget to hide your server "engine" version from the debug menu (F3).

  • Open the config/paper-global.yml file.
  • Change the version-hiding setting to true.

9. Proxy Network Security (BungeeCord/Velocity Only)​

CRITICAL WARNING

This section is specifically for those of you using a proxy network (BungeeCord or Velocity). Ignore it if you only run a single server.

The most common security hole on a proxy network is a hacker's ability to bypass the proxy login system by connecting directly to the backend server port (Survival/Lobby).

Solution: BungeeGuard​

  • Install BungeeGuard on the Proxy and all your backend servers.