# Minecraft server security guide: a checklist for 2026 Most break-ins on Minecraft servers start with something simple, such as an open backend port, an outdated plugin or an admin who reused a password. This checklist goes through the usual weak spots in the order we would check them. Updated: 2026-11-06 ## In short - Close the backend servers to everyone except the proxy and set up IP forwarding. - Keep Paper, Velocity and plugins updated, and download plugins only from their real pages. - Give staff only the permissions they need and protect their accounts. - Turn off RCON and query unless you use them, and keep backups off the server. - DDoS is stopped by your host; bots, VPNs and ban evasion by protection on the proxy. ## Lock down the proxy and the backends On a network every player should come in through the proxy. If a backend server's port is open to the internet, anyone can join it directly, skip everything the proxy checks and, if the backend uses plain BungeeCord forwarding without BungeeGuard, log in under any name, an admin's included. - Bind the backend servers to 127.0.0.1 or a private network, or close their ports in the firewall so only the proxy can reach them. - On Velocity with 1.13+ backends use modern player info forwarding and put the same forwarding secret into each Paper backend's config. For 1.8 to 1.12 backends use the bungeeguard forwarding mode with the BungeeGuard plugin. - On BungeeCord turn on `ip_forward` and add BungeeGuard, so a backend only accepts connections that carry your token. - Keep online mode on at the proxy unless you run a cracked server with an auth plugin. ## Keep the server and plugins up to date New Paper and Velocity builds regularly fix exploits, including ones that crash the server with a single packet. Update the server software and the proxy, and remove plugins you no longer use: every plugin is code that runs with full access. Download plugins only from their own pages: Hangar, Modrinth, SpigotMC or the author's GitHub. Leaked copies of paid plugins are one of the most common ways a backdoor ends up on a server. ## Permissions and op Give nobody op on a public server. Use a permissions plugin such as LuckPerms and give each role only what it needs. Be careful with wildcard permissions like `*` or `essentials.*`. They often include commands that run console commands, give items or change permissions, so anyone who takes over a moderator account gets nearly the same power as the console. Take a person's permissions away on the day they leave the team. ## Protect staff accounts On an online-mode server a staff account is a Microsoft account, so make sure your staff use a strong password and two-step verification there. On a cracked server the account is protected only by the auth plugin's password. Staff passwords should be long and used nowhere else, and two-factor login should be on if your auth plugin supports it. More in [password brute force](https://kordonlabs.com/guides/minecraft-password-brute-force). Look from time to time at where staff accounts log in from. A login from a new country or provider is worth a question. ## Close what you do not use - RCON gives full console access over the network. Leave `enable-rcon=false` unless you need it, and if you do, use a long password and allow only your own address in the firewall. - Turn off `enable-query` if you do not need it. - Ports of the panel, the database and SSH should be open only to the addresses that need them. ## Backups Keep backups of worlds and plugin data outside the server machine, and check now and then that you can restore them. A backup on the same disk does not help when the machine dies or someone takes over the hosting account. ## DDoS, bots and VPNs A DDoS attack floods the network before anything reaches Minecraft, so no plugin can stop it; your host or a network protection service has to. See [what a plugin can and cannot do against DDoS](https://kordonlabs.com/guides/minecraft-ddos-protection). Bot attacks, VPN users and ban evasion arrive as real logins, and they are stopped on the proxy: by address checks such as Kordon and, for bots from clean addresses, a verification plugin such as Sonar. See [how to block VPNs](https://kordonlabs.com/guides/block-vpn-minecraft-server) and [anti-bot plugins compared](https://kordonlabs.com/guides/best-minecraft-antibot-plugins). ## Checklist 1. Backends reachable only from the proxy, IP forwarding with a secret or BungeeGuard. 2. Server, proxy and plugins updated, unused plugins removed, nothing from leaked sources. 3. No op on a public server, roles with only the permissions they need. 4. Staff accounts with strong unique passwords and two-step verification. 5. RCON and query off or limited to your address. 6. Backups off the machine, restore tested. 7. DDoS protection from the host, bot and VPN protection on the proxy. ## Try it on your server Start in observe mode: Kordon shows who it would keep out, and you turn protection on when you are ready. [Create an account](https://panel.kordonlabs.com/register) ## More guides - [Minecraft DDoS protection: what a plugin can and cannot do](https://kordonlabs.com/guides/minecraft-ddos-protection): What a DDoS attack on a Minecraft server is, why no plugin stops a network flood, where DDoS protection really comes from, and how bot attacks differ. - [How to block VPNs and proxies on a Minecraft server](https://kordonlabs.com/guides/block-vpn-minecraft-server): Why players join through VPNs and proxies, which ways to block them exist, and how to set up the Kordon AntiVPN plugin on BungeeCord or Velocity step by step. - [Password brute force on a cracked Minecraft server: how to protect accounts](https://kordonlabs.com/guides/minecraft-password-brute-force): How attackers guess player passwords on servers with AuthMe or nLogin, which auth plugin settings stop it, and how blocking VPNs and proxies helps.