Why restrict nicknames
The first reason is bots. Attack tools generate nicknames from a template, and one rule closes a whole wave.
The second reason is cracked servers. In offline mode Velocity accepts almost any character, spaces included. An Admin nickname with a Cyrillic "А" or a trailing space looks just like the admin's nickname in chat, yet it is a different account. A rule that allows only Latin letters closes this trick.
The default rule
Every new server has the "Like Paper" rule turned on:
^[a-zA-Z0-9_.]{1,16}$It lets in Latin letters, digits, the underscore and the dot, from 1 to 16 characters. The dot is there for Bedrock players: Floodgate adds it to the start of the nickname, as in .Steve. Cyrillic letters, spaces and special characters do not pass.
On the free plan this rule is always on and cannot be changed. You can add your own rules from the Basic plan.
Two kinds of rules
"Nickname must match": the player gets in only if the nickname matches the pattern. "Not allowed in nickname": the player does not get in if the pattern is found in the nickname.
The pattern is searched for anywhere in the nickname, so bot blocks both bot123 and Robot. To check the whole nickname, put ^ at the start and $ at the end. Case is ignored: Bot and BOT are the same to a rule.
There is no rule that lets a specific nickname in against the others. If you need to let someone in, add them to the whitelist.
Example patterns
| Pattern | Kind | What it does |
|---|---|---|
^[a-zA-Z0-9_]{3,16}$ | Must match | Nicknames as in nLogin and AuthMe: no dot, 3 to 16 characters. Keeps out Bedrock players whose nickname starts with a dot |
^[0-9]+$ | Not allowed | Nicknames made of digits only |
launcher | Not allowed | Nicknames with the word launcher anywhere in them |
^bot_?[0-9]+$ | Not allowed | bot123, bot_42 |
^lobby_[0-9]+$ | Not allowed | A prefix with a counter from a specific attack: lobby_1, lobby_2048 |
The first three patterns are ready-made in the panel, and each one is added with a single click.
Syntax in brief
^is the start of the nickname,$is the end;[a-z0-9_]is any one of the listed characters;{3,16}means 3 to 16 repeats,+means one or more;a|bis one or the other.
These are ordinary regular expressions, as in Java, but without lookahead, lookbehind or backreferences. A pattern can be up to 200 characters long. The panel will not save a pattern with an error in it.
How not to hit your own players
Unlike the VPN check, nickname rules apply in observe mode too. So before saving, try the pattern on a few of your players' nicknames with the "Test a nickname" button.
After you turn a rule on, look at the login log (from the Basic plan). A player kept out by a rule sees the "Nickname" message. Write in it which nicknames are allowed, so the person knows what to change.
A pattern made for one attack, like ^lobby_[0-9]+$, can be turned off after the attack without deleting it: every rule has an on/off switch.