# Minecraft DDoS protection: what a plugin can and cannot do Search for a Minecraft DDoS protection plugin and you will find many that promise it. A plugin cannot stop a real DDoS attack. Here is what it can do, what your host has to handle, and how to tell a DDoS from a bot attack. Updated: 2026-11-06 ## In short - A DDoS attack overloads the network or the machine before traffic reaches Minecraft, so a plugin never sees it. - Protection against it comes from your host's network filtering or a protection service in front of the server. - Bot attacks are different: they arrive as logins and are stopped by plugins on the proxy. - Connection throttling in Velocity and BungeeCord slows down one address, which helps only against simple floods. - Kordon handles bot waves, VPNs and proxies at login; it does not filter network traffic. ## Three kinds of attack ### Network flood Huge amounts of traffic fill the server's connection. The server becomes unreachable or lags for everyone, and nothing new shows up in the login log. ### Connection flood Thousands of connections or server list pings that never become players. They do not saturate the connection, but they keep the proxy busy until it stops answering real players. ### Bot attack Fake players complete the login, take the slots and spam the chat. Each bot is a real connection, usually through a proxy list, so it looks like a player to the server. ## Why a plugin cannot stop a DDoS A plugin runs inside the proxy or the server. When the connection is saturated or the machine is busy dropping packets, the plugin never gets to run. Filtering has to happen before the traffic reaches your machine: at your host's network or at a service in front of it. ## Where real DDoS protection comes from - Many Minecraft hosts and some data centres, for example OVHcloud with its game filtering, include DDoS protection and filter attacks on their network before they reach you. - A protection proxy such as TCPShield or Cloudflare Spectrum (paid plans) sits in front of the server: players connect to its network and only clean traffic reaches you. Turn on PROXY protocol in the service and set `haproxy-protocol = true` in `velocity.toml` or `proxy_protocol: true` in BungeeCord's `config.yml` (or install the service's plugin), otherwise your proxy sees the service's addresses instead of the players', and IP bans and address checks stop working. - Keep the real address hidden. If attackers know the direct address of your proxy or backend, they go around the protection, so do not use that address for anything else and change it if it has leaked. These services filter traffic. They know nothing about VPN users, ban evasion or bots that complete the login. ## What you can set on the proxy Both proxies can slow down one address that connects too often: - Velocity: `login-ratelimit` in `velocity.toml`, the minimum time between logins from one address in milliseconds. - BungeeCord: `connection_throttle` and `connection_throttle_limit` in `config.yml`. This helps against a flood from a few addresses, not from thousands. On your own machine a firewall rule that limits new connections per address helps with small connection floods. ## Bot attacks: where plugins do help A bot attack is the case where a plugin is the right tool, because every bot comes in as a login. Kordon checks the address of each login, switches the server to attack mode when a wave starts and closes the networks the bots use; attack mode is on every plan, the free one included. A verification plugin such as Sonar catches bots that come from clean addresses. The two work well together on one proxy. Kordon does not filter network traffic, so against a real DDoS you still need your host. See [what to do during a bot attack](https://kordonlabs.com/guides/minecraft-bot-attack-what-to-do). ## How to tell which one you have If the server is unreachable or everyone has huge ping, while the login log shows no new joins and the host's graphs show a spike of traffic, it is a DDoS: contact your host. If the log fills with new nicknames and the slots are taken, it is a bot attack: protection on the proxy handles it. The two are sometimes combined, so check both. ## Try it on your server Start in observe mode: Kordon shows who it would keep out, and you turn protection on when you are ready. [Create an account](https://panel.kordonlabs.com/register) ## More guides - [Bot attack on a Minecraft server: what to do right now](https://kordonlabs.com/guides/minecraft-bot-attack-what-to-do): A step-by-step plan for a bot attack on your Minecraft server: how to tell it from DDoS, what to turn on in the first minutes and what to do once it is over. - [Minecraft server security guide: a checklist for 2026](https://kordonlabs.com/guides/minecraft-server-security-guide): A practical Minecraft server security checklist: proxy and backends, IP forwarding, updates, plugins, permissions, staff accounts, RCON, backups, attacks. - [Best Minecraft antibot plugins in 2026](https://kordonlabs.com/guides/best-minecraft-antibot-plugins): Minecraft antibot plugins for Velocity, BungeeCord and Paper compared: Sonar, LimboFilter, BotSentry, BotShield and Kordon. How they work and what they cost.