Two ways to stop bots
A verification plugin sends each new player to a lightweight fake server first and checks things a simple bot gets wrong: gravity, collisions, the network protocol, sometimes a CAPTCHA drawn on a map. A real client passes in a second or two, then joins as usual. This catches bots no matter which address they use, but every new player goes through the extra step.
Address-based protection looks at the connection instead: VPNs, proxies, hosting networks, and sudden waves of joins from the same networks. Bots for attacks almost always come through proxy lists, so closing those networks stops most of a wave without bothering real players. It does not catch a bot that comes from a clean home address.
Verification plugins
Sonar
One of the most widely used anti-bots, with about 75,000 downloads on Modrinth. Sonar 2 is free and open source (GPL-3.0) and runs on Velocity, BungeeCord, Waterfall, Paper, Spigot and Folia. It checks gravity, block collisions, vehicle packets and the vanilla protocol, and queues joins during a flood. It does not do VPN checks and has no CAPTCHA by default. Sonar on Modrinth
Sonar 3.0 is a separate hosted product: cloud checks, a web CAPTCHA, VPN, proxy and Tor blocking, country rules and a panel. It is paid only, from €5 a month for one server with up to 150 players. sonar.top Kordon compared with Sonar
LimboFilter
A Velocity-only plugin built on LimboAPI. New players land in a virtual limbo world with a customizable map CAPTCHA and a check of client settings and brand. Free and open source (AGPL-3.0). The last tagged release is from June 2024, though development builds kept coming in 2026. LimboFilter on Modrinth
Paid all-in-one plugins
BotSentry
A long-running paid plugin (€10.99 on SpigotMC) for BungeeCord, Spigot, Sponge and Velocity. It switches on during an attack: players with at least two minutes of play time get in, new players solve a CAPTCHA on BotSentry's site. It also has an IP blacklist, an optional system firewall, a bad-packet filter and, since version 9.2, VPN and country blocking. BotSentry on SpigotMC
BotShield
A newer paid plugin (€5.99, a sale price on 3 November 2026) for Velocity, BungeeCord and Paper that checks each connection before the player object is created and includes an AntiVPN module. No CAPTCHA or fall checks. Updated in October 2026. BotShield on SpigotMC
nAntiBot and AlixSystem
nAntiBot has a free version with cloud checks, an invalid-packet check, an online CAPTCHA and country restrictions; we could not confirm the price of its premium version. AlixSystem is a free login system for Spigot (with a separate Velocity version) that bundles a CAPTCHA, anti-bot and AntiVPN checks; it suits cracked servers that need a login plugin anyway. nAntiBot, AlixSystem
Address-based: Kordon
Kordon is our hosted AntiVPN and anti-bot service for BungeeCord, Waterfall and Velocity. It does not have a verification world. It checks every login within the plan's daily limit, and every login during an attack. When a wave of bots arrives it switches the server to attack mode: new players who look like the attack are refused, residential proxies are closed on every protection level, and players your server already let in before the attack are not affected by the attack checks. Attack mode is on every plan, including the free one, and checks during an attack do not count toward the daily limit.
Because it works at the address level, Kordon fits well next to Sonar 2: Sonar catches bots from clean addresses, Kordon closes VPNs and proxy networks and gives you a login log and attack reports in a panel. See how attack mode works.
Side by side
| How it works | Platforms | Price | VPN checks | Maintained | |
|---|---|---|---|---|---|
| Sonar 2 | Verification server | Velocity, BungeeCord, Paper, Spigot, Folia | Free, open source | No | Yes |
| Sonar 3.0 | Hosted checks, web CAPTCHA | Velocity, BungeeCord, Paper 1.21+ | From €5/month | Yes | Yes |
| LimboFilter | Limbo world, map CAPTCHA | Velocity | Free, open source | No | Dev builds only |
| BotSentry | Attack mode, web CAPTCHA, firewall | BungeeCord, Spigot, Sponge, Velocity | €10.99 | Yes | Yes |
| BotShield | Early connection checks | Velocity, BungeeCord, Paper | €5.99 (sale) | Yes | Yes |
| Kordon | Address checks, attack mode | BungeeCord, Waterfall, Velocity | Free plan, paid per server | Yes | Yes |
No longer maintained
UltimateAntiBot still has tens of thousands of downloads, but its last update was in July 2024. EpicGuard's repository is archived, the last version came out in August 2025. Both may still work on older setups, but they will not get fixes for new Minecraft or proxy versions.
Which one to choose
If you only need to stop floods of fake players, Sonar 2 is free, maintained and easy to set up. If bots come through proxies and you also deal with VPN users and ban evasion, add address checks, either from a paid all-in-one plugin or a service like Kordon. During an attack, follow this checklist.