On this page
- Check your CoreProtect build and storage options
- Install the plugin and check its status
- Inspect who changed a block or took items
- Narrow a lookup before deciding what to repair
- Preview a targeted rollback before applying it
- Restore changes or undo the last recovery
- Give investigators fewer permissions than recovery staff
- Choose a retention window before purging history
- Compare Prism and LogBlock before committing
Key takeaways
6- Check the exact CoreProtect build's Minecraft support because its listings differ.
- Narrow investigations by user, time and radius before preparing a repair.
- Use #preview before applying a rollback.
- /co undo reverses the last rollback or restore.
- Separate investigation permissions from recovery and purge permissions.
- Choose a retention window before deleting old logging records.
This guide is for Minecraft server owners and staff who need to investigate damaged builds or missing items. You will check your CoreProtect build, enable logging, narrow an investigation and preview a repair before applying it.
Check your CoreProtect build and storage options
CoreProtect records block changes and other actions so staff can inspect history, search it and roll back or restore changes.
Check the requirements of the actual build you download. The researched listings differ: Modrinth lists support through Minecraft 26.3, while the SpigotMC page identifies Community Edition 24.1 as supporting versions through 26.2. Hangar also lists 24.1 with support through 26.2. Those pages do not establish that every available build supports 26.3.
The current configuration documentationSource site describes database-type with four choices. Check your installed build's generated configuration before changing it.
| Storage | Configuration value | What the documentation establishes |
|---|---|---|
| DuckDB | duckdb | The documented default for new installations. |
| SQLite | sqlite | An alternative file-based database. |
| MySQL | mysql | An optional database backend. |
| ClickHouse | clickhouse | Another supported database backend. |
For a first installation, our team recommends starting with the build's documented default unless you already have a reason to use another backend. Do not treat changing the storage setting as a migration procedure for existing history.
Install the plugin and check its status
Choose a build that explicitly supports your server software and Minecraft version. Before adding it to an existing server, follow a backup plan that includes a tested restore.
- Stop the server through its console.
- Place the matching CoreProtect plugin JAR in the server's
pluginsdirectory. - Start the server again.
- Locate
plugins/CoreProtect/config.ymlto review the generated settings.
- Stop the server using the controls on the Console page.
- Use the File Manager or SFTP to upload the matching CoreProtect JAR into
plugins. - Start the server from the Console page.
- Open
plugins/CoreProtect/config.ymlin the File Manager to review the generated settings.
- Stop the server from its control page.
- Use Files / FTP to upload the matching CoreProtect JAR into
plugins. - Start the server again and check its console.
- Use Files / FTP to locate
plugins/CoreProtect/config.ymland review the generated settings.
The investigation and recovery commands below are entered in Minecraft chat by an authorised staff member. They are the same whichever hosting method you use.
/co status
/co helpCoreProtect's configuration also supports per-world files and a blacklist.txt that can exclude users, commands, blocks, entities or items from logging. Review those exclusions if an investigation returns less history than expected.
Inspect who changed a block or took items
Start at the reported location and turn on inspect mode. Use a nearby lookup when you need a broader view of the activity around you.
/co inspect
/co near/co inspect, also available as /co i, toggles inspection. /co near performs a lookup with a five-block radius. Run the inspect command again when you finish investigating.
CoreProtect's documented action types include block changes, container transactions, inventory changes and item movements. For a missing-item report, investigate those records rather than assuming that a nearby block change proves who took something.
Narrow a lookup before deciding what to repair
Use the documented lookup parametersSource site to limit the search. Replace ExamplePlayer with the name you are investigating.
/co lookup u:ExamplePlayer t:1h r:10
/co lookup 2u:selects a user. Multiple names can be separated by commas.t:selects a time window, such as1hor5d2h.r:limits the radius. Start with a small area around the incident.a:selects an action type.i:includes specified blocks or items, whilee:excludes them.
The second command opens page two of the lookup results. Compare the recorded user, location and time with the report before preparing a rollback.
Preview a targeted rollback before applying it
Use a player, time window and radius that match the evidence. This example previews changes associated with one player during the last hour within a radius of 30 blocks.
/co rollback u:ExamplePlayer t:1h r:30 #previewThe documented #preview flag tests the rollback without applying it. Inspect the proposed repair and check whether legitimate activity falls inside your chosen scope.
When the preview matches the repair you intend, run the same parameters without #preview:
/co rollback u:ExamplePlayer t:1h r:30Check the affected area afterwards. Review both the reported damage and nearby legitimate work before considering the incident resolved.
Restore changes or undo the last recovery
CoreProtect provides /co restore alongside rollback. Keep the same discipline when selecting its user, time and radius parameters.
/co restore u:ExamplePlayer t:1h r:30If your last rollback or restore was a mistake, the documented reversal command is:
/co undo/co undo reverses the last rollback or restore. Check which operation you performed last before using it.
Recovery and prevention serve different jobs. After repairing a public area, consider protecting spawn, shops and arenas with region rules to reduce repeat incidents.
Give investigators fewer permissions than recovery staff
CoreProtect documents separate permissions for inspection, lookup, rollback, restore and maintenance. Use that separation when planning staff access.
| Staff responsibility | Relevant permission nodes | Suggested access |
|---|---|---|
| Investigate reports | coreprotect.help, coreprotect.inspect, coreprotect.lookup | Start with investigation commands. |
| Repair confirmed damage | coreprotect.rollback, coreprotect.restore | Reserve for staff trained to review scope. |
| Maintain logging | coreprotect.status, coreprotect.reload, coreprotect.purge | Assign according to maintenance duties. |
The permissions documentationSource site also lists command-handler permissions, including coreprotect.co for /co. If a staff member cannot inspect, check both command access and coreprotect.inspect, then check the logging exclusions described earlier.
coreprotect.* grants all commands. Prefer explicit permissions when building staff groups. Lookup subtypes, including chat, commands and container records, can also be restricted with the documented negative permissions.
For an existing rank structure, use the guide to groups, inheritance and promotions when deciding where these permissions belong.
Choose a retention window before purging history
Decide how far back staff should be able to investigate reports before removing old records. A practical policy should reflect how long players may be away before noticing damage.
For example, this in-game command purges records older than 180 days:
/co purge t:180dThe command documentation sets a minimum age of 30 days for in-game purges. Choose the retention period deliberately and keep database backups within your broader backup plan.
Compare Prism and LogBlock before committing
CoreProtect is one approach to logging and recovery. If you are still selecting a tool, compare the platform and database requirements before installing one.
Prism documents event logging for Paper-based servers on Minecraft 1.21.4 and newer. Its features include rollback, restore, previews, investigation wands and a report command.
LogBlock records block changes for Spigot and Paper and lets administrators investigate and roll them back. Its documented storage requirement is MySQL.
| Tool | What it offers | Database choices | What to check |
|---|---|---|---|
| CoreProtect | Inspection, lookup, rollback and restore across several action types. | DuckDB, ClickHouse, SQLite or MySQL in current documentation. | The exact build's version support and feature availability. |
| Prism | More than 40 logged event types, previews and investigation wands. | H2, SQLite, MySQL, MariaDB or PostgreSQL. | Its Paper-based server requirement and Minecraft 1.21.4+ baseline. |
| LogBlock | Block-change investigations and rollback. | MySQL. | Whether you want its block-focused workflow and can provide MySQL. |
Choose around the incidents your staff handle and the storage you can maintain. Then practise an investigation and a narrowly scoped recovery on a test server before granting recovery access to the wider staff team.
Frequently asked questions
How do I find out who broke a block or stole from a chest?
Start with /co inspect at the reported location, then narrow a lookup by time, radius and user. CoreProtect documents block changes, container transactions and item movements among its action types. Check the relevant records before deciding who was responsible.
What is the CoreProtect rollback command?
A targeted example is /co rollback u:ExamplePlayer t:1h r:30 #preview. Replace the name and adjust the time and radius to match your investigation. Review the preview, then run the same parameters without #preview when you intend to apply the repair.
How do I undo a CoreProtect rollback?
Use /co undo to reverse the last rollback or restore. Confirm which recovery operation you performed last before running it.
Why is CoreProtect inspect not working for a staff member?
Check coreprotect.inspect and the command-handler permission for the command they use, such as coreprotect.co for /co. If commands work but history is missing, review per-world settings and blacklist.txt for logging exclusions.
Does CoreProtect support Minecraft 26.3?
The researched listings differ: Modrinth lists support through 26.3, while SpigotMC's Community Edition 24.1 and Hangar's listed 24.1 build show support through 26.2. Confirm the requirements of the exact build you obtain. Do not assume the free Community Edition supports 26.3 from the broader project listing alone.
