Lock down the proxy and the backends
On a network every player should come in through the proxy. If a backend server's port is open to the internet, anyone can join it directly, skip everything the proxy checks and, if the backend uses plain BungeeCord forwarding without BungeeGuard, log in under any name, an admin's included.
- Bind the backend servers to 127.0.0.1 or a private network, or close their ports in the firewall so only the proxy can reach them.
- On Velocity with 1.13+ backends use modern player info forwarding and put the same forwarding secret into each Paper backend's config. For 1.8 to 1.12 backends use the bungeeguard forwarding mode with the BungeeGuard plugin.
- On BungeeCord turn on
ip_forwardand add BungeeGuard, so a backend only accepts connections that carry your token. - Keep online mode on at the proxy unless you run a cracked server with an auth plugin.
Keep the server and plugins up to date
New Paper and Velocity builds regularly fix exploits, including ones that crash the server with a single packet. Update the server software and the proxy, and remove plugins you no longer use: every plugin is code that runs with full access.
Download plugins only from their own pages: Hangar, Modrinth, SpigotMC or the author's GitHub. Leaked copies of paid plugins are one of the most common ways a backdoor ends up on a server.
Permissions and op
Give nobody op on a public server. Use a permissions plugin such as LuckPerms and give each role only what it needs.
Be careful with wildcard permissions like * or essentials.*. They often include commands that run console commands, give items or change permissions, so anyone who takes over a moderator account gets nearly the same power as the console.
Take a person's permissions away on the day they leave the team.
Protect staff accounts
On an online-mode server a staff account is a Microsoft account, so make sure your staff use a strong password and two-step verification there.
On a cracked server the account is protected only by the auth plugin's password. Staff passwords should be long and used nowhere else, and two-factor login should be on if your auth plugin supports it. More in password brute force.
Look from time to time at where staff accounts log in from. A login from a new country or provider is worth a question.
Close what you do not use
- RCON gives full console access over the network. Leave
enable-rcon=falseunless you need it, and if you do, use a long password and allow only your own address in the firewall. - Turn off
enable-queryif you do not need it. - Ports of the panel, the database and SSH should be open only to the addresses that need them.
Backups
Keep backups of worlds and plugin data outside the server machine, and check now and then that you can restore them. A backup on the same disk does not help when the machine dies or someone takes over the hosting account.
DDoS, bots and VPNs
A DDoS attack floods the network before anything reaches Minecraft, so no plugin can stop it; your host or a network protection service has to. See what a plugin can and cannot do against DDoS.
Bot attacks, VPN users and ban evasion arrive as real logins, and they are stopped on the proxy: by address checks such as Kordon and, for bots from clean addresses, a verification plugin such as Sonar. See how to block VPNs and anti-bot plugins compared.
Checklist
- Backends reachable only from the proxy, IP forwarding with a secret or BungeeGuard.
- Server, proxy and plugins updated, unused plugins removed, nothing from leaked sources.
- No op on a public server, roles with only the permissions they need.
- Staff accounts with strong unique passwords and two-step verification.
- RCON and query off or limited to your address.
- Backups off the machine, restore tested.
- DDoS protection from the host, bot and VPN protection on the proxy.