Minecraft Server Whitelist & Player Management: How to Control Access and Reduce Grief

# Minecraft Server Whitelist & Player Management: How to Control Access and Reduce Grief

One of the most overlooked aspects of running a Minecraft server is proper player management. Whether you're running a private survival server for friends or a large public network, controlling who can join — and what they can do — directly affects both performance and player experience. Grief, spam logins, and bot attacks don't just ruin the game; they can cause real TPS drops and even bring your server down.

This guide walks you through whitelists, ban systems, operator management, and advanced access control tools that every server admin should know.

---

Why Player Management Matters for Performance

Player management isn't just about safety — it has real performance implications:

• Bot attacks and mass join attempts can flood your server's login queue, spike CPU usage, and cause connection timeouts for legitimate players.
• Griefers who mass-place TNT or spawn entities can cause instant TPS drops.
• Unauthorized operators can execute lag-inducing commands like /summon or /fill without restriction.

A tightly managed server is a stable server.

---

Setting Up the Whitelist

The whitelist is your first line of defense. Only players on the list can join.

Enabling the Whitelist

In server.properties:

white-list=true
enforce-whitelist=true

The enforce-whitelist=true option (added in 1.17) is critical — it immediately kicks players who are removed from the whitelist while the server is running, rather than waiting until they disconnect.

Managing the Whitelist

Use these in-game or console commands:

/whitelist add PlayerName
/whitelist remove PlayerName
/whitelist list
/whitelist reload

The whitelist is stored in whitelist.json in your server root. You can edit it directly for bulk changes:

[
  {
    "uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "name": "PlayerName"
  }
]

After editing the file manually, run /whitelist reload to apply changes without restarting.

---

Managing Bans Effectively

Minecraft has a built-in ban system, but it has limitations. Here's how to use it correctly.

Standard Ban Commands

/ban PlayerName Reason here
/ban-ip 192.168.1.100
/pardon PlayerName
/pardon-ip 192.168.1.100
/banlist players
/banlist ips

Ban data is stored in banned-players.json and banned-ips.json.

Temporary Bans and Advanced Ban Management

The vanilla ban system doesn't support temporary bans. For this, you'll want a plugin like:

• LiteBans — highly performant, supports MySQL for multi-server sync, temp bans, mutes, warns
• AdvancedBan — free alternative with temp bans and customizable messages
• LibresBans — open source, lightweight

With LiteBans, a temp ban looks like:

/tempban PlayerName 7d Repeated griefing

For networks using BungeeCord or Velocity, LiteBans supports global bans synced across all servers via a shared MySQL database — essential for large networks.

---

Operator (OP) Management

Being careless with OP permissions is one of the most common server admin mistakes. OP gives players full access to all commands, including potentially destructive ones.

Setting OP Levels

In server.properties:

op-permission-level=2

OP levels in Minecraft:

| Level | Permissions |

|-------|-------------|

| 1 | Bypass spawn protection |

| 2 | Use all single-player cheats, command blocks |

| 3 | Manage players (ban, kick, whitelist) |

| 4 | Full OP, including stop/restart |

Set op-permission-level=2 for most trusted players instead of giving full level 4.

Never Use OP as a Permissions System

Instead, use LuckPerms (covered in our permissions guide) to assign specific commands without granting full OP. This lets you give a player /ban access without also giving them /stop or /execute.

---

Protecting Against Bot Attacks and Spam Logins

Public servers are frequent targets for bot floods — hundreds of fake accounts connecting rapidly to overwhelm your server.

Connection Throttling in bukkit.yml

# bukkit.yml
connection-throttle: 4000

This value (in milliseconds) throttles repeated connection attempts from the same IP. The default is 4000ms (4 seconds), which is reasonable. Don't set it to -1 (disabled) on public servers.

Online Mode

In server.properties:

online-mode=true

Keep online-mode=true unless you specifically need to support cracked clients. Online mode forces Minecraft account authentication through Mojang/Microsoft, preventing fake accounts from joining.

If you're running a network behind BungeeCord or Velocity, set the proxy to handle authentication and keep backend servers in offline mode — but always use bungeecord: true in spigot.yml or velocity-secret in paper-global.yml to prevent IP spoofing.

Anti-Bot Plugins

For high-traffic public servers, consider:

• JPremium / JPremium-Lite — premium account verification
• BotSentry — detects and blocks bot joins automatically
• Sonar — modern, performant bot protection with CAPTCHA-style verification

---

Spawn Protection and Build Restrictions

Spawn Radius

In server.properties:

spawn-protection=16

This protects a 16-block radius around the world spawn point from non-OP players. On servers with a custom spawn or lobby, set this to 0 and use a protection plugin instead for more granular control.

Region Protection Plugins

For grief prevention, the industry standards are:

• WorldGuard — define regions with custom flags (no-pvp, no-build, no-fire, etc.)
• GriefPrevention — claim-based protection, self-service for players
• Lands — modern alternative to GriefPrevention with nation/war features
• CoreProtect — block logging and rollback tool, essential for investigating and undoing grief

CoreProtect is especially valuable — it logs every block place and break, allowing you to roll back grief with a single command:

/co rollback u:GrieferName t:2h

---

Monitoring Player Activity

Knowing what players are doing on your server helps you catch problems early. Tools like PulseNode give you real-time visibility into player counts, session patterns, and server performance — so you can spot unusual spikes in connections or activity before they become a problem.

For in-game logging, CoreProtect combined with a chat logging plugin like ChatLogger or eChat gives you a complete audit trail.

---

Quick Reference: Key Files and Commands

| File | Purpose |

|------|--------|

| whitelist.json | Approved player list |

| banned-players.json | UUID-based player bans |

| banned-ips.json | IP-based bans |

| ops.json | Operator list with levels |

| server.properties | Core server settings |

| bukkit.yml | Connection throttle and more |

---

Summary

Effective player management is the foundation of a well-run Minecraft server. Start with enforce-whitelist=true, use LuckPerms instead of raw OP, install LiteBans for flexible punishment management, and protect your world with WorldGuard or GriefPrevention. For large public servers, add bot protection via Sonar or BotSentry.

Combined with real-time performance monitoring from PulseNode, you'll have full visibility over both who is on your server and how it's performing — giving you the tools to act fast when something goes wrong.

A well-managed server isn't just safer — it's a better place to play.