Five kinds of protection
Manual IP bans
You ban addresses by hand or with a ban plugin. It is free and simple, but a VPN gives a new address on every reconnect, and a banned address may later belong to an innocent player.
Free AntiVPN plugins
The plugin sends each new address to one or more detection services. You register with those services, put API keys into a config file and keep an eye on their daily request limits. Accuracy depends on the services you choose, and every server keeps its own results.
Anti-bot plugins with a limbo
New players first land in a small virtual world where the plugin checks that they behave like a real client: gravity, collisions, network packets. This stops floods of fake players well, but it does not tell you whether a real person is using a VPN to get around a ban.
Network DDoS protection
Your host or a proxy service filters traffic before it reaches the machine. It keeps the server online during a flood, but it knows nothing about Minecraft logins, nicknames or VPNs.
Hosted protection services
A plugin on your proxy asks an external service about every login. The service keeps a shared database of addresses, notices attacks across many servers and is set up in a web panel. You rely on the service being available, and advanced features are usually paid.
Side by side
| VPN and proxy users | Bot floods | Setup | Shared data | Cost | |
|---|---|---|---|---|---|
| Manual IP bans | Barely | No | None | No | Free |
| Free AntiVPN plugin | Yes, as good as the services you choose | Partly | API keys and a config file on every proxy | No | Free within the limits of the services |
| Anti-bot plugin with a limbo | No | Yes | Plugin plus tuning | No | Usually free |
| Network DDoS protection | No | Network floods only | At the host | No | Often included in hosting |
| Hosted service (Kordon) | Yes | Yes, through attack mode | One plugin, settings in a panel | Yes | Free plan for small servers, paid plans for more |
How to choose
- A small private server: a whitelist or online mode may be all you need.
- A public server where banned players come back: you need an AntiVPN check. A free plugin works if you are ready to manage API keys and limits; a hosted service saves that work and learns from other servers.
- A server that gets bot attacks: combine an address check with bot protection. Address checks stop known proxy networks at once; a limbo anti-bot catches bots that come from clean addresses.
- A network with several proxies: look for one place to manage settings and lists for all of them.
Where Kordon fits
Kordon is a hosted service with one plugin for BungeeCord, Waterfall and Velocity. It checks every login, keeps a database of addresses shared by all the servers it protects and switches to attack mode when a wave of bots arrives. Settings, lists and the login log live in a web panel, so there are no API keys to get.
What Kordon does not do: it does not test players in a limbo world and does not watch what they do in the game. If bots reach your server from clean home addresses, a limbo anti-bot next to Kordon covers that case.
Kordon needs an account: the free plan covers small servers, and paid plans add higher limits and more filters. See the pricing and how to set it up.