PulseNodeDashboard
Back to Blog
securityddosgriefingexploitsserver administrationfirewallpaperspigot

Minecraft Server Security: How to Protect Your Server from Exploits, Griefers, and DDoS Attacks

Published on July 26, 2026

# Minecraft Server Security: How to Protect Your Server from Exploits, Griefers, and DDoS Attacks

Running a public Minecraft server means you're constantly exposed to threats — from players trying to crash your server with exploits, to organized DDoS attacks targeting your IP, to griefers who want to ruin the experience for everyone else. Security is not optional; it's a fundamental part of stable server administration.

This guide covers the most critical security measures every Minecraft server admin should have in place, with specific configuration values and tools you can implement today.

---

1. Keep Your Software Up to Date

The single most impactful security measure is staying current. Outdated server jars contain known vulnerabilities that are actively exploited.

  • Always run the latest stable release of Paper, Purpur, or your chosen server software
  • Keep all plugins updated — outdated plugins are a top source of remote code execution (RCE) vulnerabilities
  • Subscribe to the [PaperMC Discord](https://discord.gg/papermc) or GitHub releases for security advisories
  • Never run EOL (end-of-life) Minecraft versions like 1.8 on public servers without patching known exploits manually

Paper patches dozens of vanilla exploits that exist in CraftBukkit and Spigot, making it the minimum recommended server software for any public server.

---

2. Secure Your server.properties

Your server.properties file has several security-relevant settings:

# Disable online-mode only if using a proxy (Bungeecord/Velocity)

online-mode=true



# Prevent players from bypassing the whitelist


enforce-whitelist=true



# Rate-limit logins to prevent brute-force


max-tick-time=60000



# Prevent excessive packet sizes


network-compression-threshold=256



# Don't expose RCON to the public internet


enable-rcon=false


rcon.port=25575

Never expose RCON to the internet. If you must use it, bind it to 127.0.0.1 only and use a strong password. The same applies to your query port — disable enable-query=true unless you specifically need it for a server list.

---

3. Harden Paper and Spigot Configs Against Exploits

paper-world.yml (per-world settings in modern Paper builds)

anticheat:

  anti-xray:


    enabled: true


    engine-mode: 2


    max-chunk-section-index: 3


    update-radius: 2


    lava-obscures: false


    use-permission: false


    hidden-blocks:


      - copper_ore


      - deepslate_copper_ore


      - gold_ore


      - iron_ore


      - coal_ore


      - diamond_ore


      - emerald_ore


      - lapis_ore


    replacement-blocks:


      - stone


      - oak_planks


      - deepslate

Engine mode 2 replaces all ores with fake blocks and only reveals the real ones when a player is close enough to see them — far more effective than mode 1.

spigot.yml

players:

  max-health: 2048


  tab-spam-increment: 1


  tab-spam-limit: 500

These settings prevent common tab-complete spam exploits that can cause server-side lag spikes.

---

4. Use a Proxy with IP Forwarding — Never Expose Your Real IP

If you run a network or even a single server with a proxy like Velocity (recommended) or BungeeCord, you gain a critical security layer: players never connect directly to your backend servers.

In paper-global.yml:

proxies:

  velocity:


    enabled: true


    online-mode: true


    secret: 'your-secret-here'

Also firewall your backend servers so they only accept connections from your proxy's IP. Using iptables on Linux:

# Allow only the proxy IP to reach port 25565

iptables -A INPUT -p tcp --dport 25565 -s YOUR_PROXY_IP -j ACCEPT


iptables -A INPUT -p tcp --dport 25565 -j DROP

This alone eliminates most bypass attacks targeting your backend directly.

---

5. DDoS Protection: Infrastructure-Level Defense

No Minecraft plugin can protect you from a volumetric DDoS attack — that's handled at the network level. Here's your layered approach:

Use a DDoS-Protected Hosting Provider

Hosting providers like OVH, Hetzner (with DDoS protection add-on), or dedicated Minecraft hosts with built-in mitigation absorb attack traffic before it reaches your server.

TCPShield / Cloudflare Spectrum

[TCPShield](https://tcpshield.com) is a free (up to a point) reverse proxy specifically for Minecraft that hides your real IP and filters malicious traffic. Cloudflare Spectrum offers similar protection but is paid.

Firewall Rules on the OS Level

Install fail2ban to automatically block IPs that attempt repeated connections:

apt install fail2ban

Configure it to watch your Minecraft logs for repeated failed login attempts and ban accordingly.

---

6. Anti-Grief Plugins and World Protection

For gameplay integrity, these plugins are industry standards:

  • CoreProtect — Logs every block placed/broken/interacted with. Invaluable for rollbacks after griefing incidents
  • WorldGuard — Define regions with granular permissions (no-pvp, no-build, etc.)
  • LuckPerms — Fine-grained permission management to ensure players can only do what they're allowed to
  • GriefPrevention or Lands — Player-driven claim systems that prevent griefing in the open world

In CoreProtect, set a sufficient logging retention period in config.yml:

logging:

  block-place: true


  block-break: true


  containers: true


  chat: true


expire-days: 30

---

7. Secure Your Admin Access

Your server console and admin accounts are high-value targets:

  • Never share OP status with players you don't fully trust — OP bypasses most plugin permission checks
  • Use LuckPerms to grant specific admin permissions instead of blanket OP
  • Enable 2FA on your hosting panel (SSH keys, two-factor authentication)
  • Use SSH key authentication instead of passwords for your VPS:

# Disable password auth in /etc/ssh/sshd_config


  PasswordAuthentication no


  PubkeyAuthentication yes

  • Restrict panel access to your home IP using your host's firewall rules

---

8. Monitor for Anomalies in Real Time

Security threats often show up as performance anomalies before they become catastrophic — a sudden TPS drop, a spike in player connections, or abnormal memory usage.

Tools like [PulseNode](https://pulsenode.tech) give you real-time visibility into your server's health metrics, so you can spot unusual patterns early — whether it's a bot flood causing connection spikes or a crash exploit hammering your tick rate.

Set up alerts for TPS drops below 18 and connection count anomalies so you're notified the moment something is wrong, not after your players have already left.

---

Security Checklist

  • [ ] Running latest Paper/Purpur version
  • [ ] All plugins updated
  • [ ] online-mode=true (or Velocity enforcing auth)
  • [ ] RCON disabled or bound to localhost only
  • [ ] Anti-Xray enabled (engine mode 2)
  • [ ] Backend servers firewalled behind proxy
  • [ ] DDoS-protected hosting or TCPShield
  • [ ] CoreProtect installed with 30-day retention
  • [ ] SSH key auth enabled, password auth disabled
  • [ ] OP list minimized; LuckPerms for admin permissions

---

Security is an ongoing process, not a one-time setup. Regularly audit your plugins, review your permission structure, and stay informed about new vulnerabilities in the Minecraft ecosystem. The servers that get compromised are almost always the ones running outdated software or using insecure defaults.

Protect your server before an incident forces you to. Set up monitoring with [PulseNode](https://pulsenode.tech) to get instant alerts when your server behaves abnormally — your first line of defense is knowing something is wrong.

Optimize your server performance?

PulseNode monitors your Minecraft server in real-time and gives you AI-powered optimization tips.

Start for free →
Minecraft Server Security: How to Protect Your Server from Exploits, Griefers, and DDoS Attacks — PulseNode Blog | PulseNode