# Nickname filter on a Minecraft server: rules and regular expressions

Bots rarely get nicknames made up by hand. Usually it is random letters, digits only or a shared prefix with a counter. A nickname rule cuts such connections off right at the proxy.

Updated: 2026-10-27

## In short

- A rule checks the nickname at login: either the nickname has to match a pattern, or it must not contain something forbidden.
- The "Like Paper" rule is on by default: Latin letters, digits, `_` and the dot, 1 to 16 characters.
- Patterns are regular expressions, and letter case is ignored.
- Rules apply in observe mode too, so test a new rule on a few nicknames first.
- Your own rules are available from the Basic plan, up to 30 per server.

## Why restrict nicknames

The first reason is bots. Attack tools generate nicknames from a template, and one rule closes a whole wave.

The second reason is cracked servers. In offline mode Velocity accepts almost any character, spaces included. An `Admin` nickname with a Cyrillic "А" or a trailing space looks just like the admin's nickname in chat, yet it is a different account. A rule that allows only Latin letters closes this trick.

## The default rule

Every new server has the "Like Paper" rule turned on:

```
^[a-zA-Z0-9_.]{1,16}$
```

It lets in Latin letters, digits, the underscore and the dot, from 1 to 16 characters. The dot is there for Bedrock players: Floodgate adds it to the start of the nickname, as in `.Steve`. Cyrillic letters, spaces and special characters do not pass.

On the free plan this rule is always on and cannot be changed. You can add your own rules from the Basic plan.

## Two kinds of rules

"Nickname must match": the player gets in only if the nickname matches the pattern. "Not allowed in nickname": the player does not get in if the pattern is found in the nickname.

The pattern is searched for anywhere in the nickname, so `bot` blocks both `bot123` and `Robot`. To check the whole nickname, put `^` at the start and `$` at the end. Case is ignored: `Bot` and `BOT` are the same to a rule.

There is no rule that lets a specific nickname in against the others. If you need to let someone in, add them to the whitelist.

## Example patterns

| Pattern | Kind | What it does |
| --- | --- | --- |
| `^[a-zA-Z0-9_]{3,16}$` | Must match | Nicknames as in nLogin and AuthMe: no dot, 3 to 16 characters. Keeps out Bedrock players whose nickname starts with a dot |
| `^[0-9]+$` | Not allowed | Nicknames made of digits only |
| `launcher` | Not allowed | Nicknames with the word launcher anywhere in them |
| `^bot_?[0-9]+$` | Not allowed | `bot123`, `bot_42` |
| `^lobby_[0-9]+$` | Not allowed | A prefix with a counter from a specific attack: `lobby_1`, `lobby_2048` |

The first three patterns are ready-made in the panel, and each one is added with a single click.

## Syntax in brief

- `^` is the start of the nickname, `$` is the end;
- `[a-z0-9_]` is any one of the listed characters;
- `{3,16}` means 3 to 16 repeats, `+` means one or more;
- `a|b` is one or the other.

These are ordinary regular expressions, as in Java, but without lookahead, lookbehind or backreferences. A pattern can be up to 200 characters long. The panel will not save a pattern with an error in it.

## How not to hit your own players

Unlike the VPN check, nickname rules apply in observe mode too. So before saving, try the pattern on a few of your players' nicknames with the "Test a nickname" button.

After you turn a rule on, look at the login log (from the Basic plan). A player kept out by a rule sees the "Nickname" message. Write in it which nicknames are allowed, so the person knows what to change.

A pattern made for one attack, like `^lobby_[0-9]+$`, can be turned off after the attack without deleting it: every rule has an on/off switch.

## Try it on your server

Start in observe mode: Kordon shows who it would keep out, and you turn protection on when you are ready. [Create an account](https://panel.kordonlabs.com/register)

## More guides

- [How to protect a Minecraft server from bot attacks](https://kordonlabs.com/guides/minecraft-bot-attack-protection): What a bot attack on a Minecraft server looks like, why it comes through proxies, and how Kordon's attack mode closes the networks bots come from while real players keep joining.
- [Protecting a cracked Minecraft server: bots, fake nicknames and ban evasion](https://kordonlabs.com/guides/cracked-minecraft-server-protection): What an offline mode server risks, why anyone can join as the admin without an auth plugin, and how Kordon helps against bots, VPNs and ban evasion.
- [Bot attack on a Minecraft server: what to do right now](https://kordonlabs.com/guides/minecraft-bot-attack-what-to-do): A step-by-step plan for a bot attack on your Minecraft server: how to tell it from DDoS, what to turn on in the first minutes and what to do once it is over.