Secure a Minecraft Server: Whitelist, Operators and Velocity

This guide is for Java server owners who want to limit who can join and reduce ways to reach their server console or backend. You will finish with a whitelist plan, fewer full operator accounts and, if you use Velocity, a backend that only accepts connections from the proxy.

Turn on the whitelist and check its 26.3 default#

Java Edition 26.3 changed the default for white-list in a fresh server.properties file to true. If an updated or newly created server refuses players, check that setting before troubleshooting plugins. When the whitelist is on, players who are not listed cannot join.

For a private server, set these values deliberately:

white-list=true
enforce-whitelist=true
online-mode=true

enforce-whitelist defaults to false. When enabled, whitelist changes are enforced and players who are online but no longer listed are kicked. Add trusted players with /whitelist add PlayerName, check the list with /whitelist list, and remove access with /whitelist remove PlayerName. If you edit whitelist.json by hand while the server is running, use /whitelist reload to apply the edits.

Edit server.properties through the file access for your server, then run whitelist commands in its console:

Give staff only the operator power they need#

op-permission-level controls the permission level given to players added with /op. It defaults to 4, the Owner level, which includes server management commands. Levels 1, 2 and 3 grant progressively broader access: Moderator, Gamemaster and Admin. Lowering the default can reduce the power of future operators, but it does not replace reviewing who is already in ops.json.

Use /deop PlayerName to remove operator status from someone who no longer needs it. For staff who need specific plugin commands without full operator access, LuckPerms is a free permissions plugin that supports Paper and other platforms. Our LuckPerms ranks guide covers setting up groups and permissions.

LuckPerms Free A permissions plugin for giving staff specific permissions instead of full operator status. On Modrinth

Paper's access files include whitelist.json and ops.json. Review them in the server files and avoid granting operator status as a shortcut for routine staff permissions:

Disable remote services you do not use#

In server.properties, enable-rcon and enable-query both default to false. RCON exposes console access over a network, so leave it off unless you have a specific need and a plan to restrict access. If RCON is enabled with a blank password, it will not start. Query provides information about the server; leave it off if you do not need that service.

These settings are in the same server.properties file as the whitelist. Edit the file and schedule a restart if your change requires one:

Keep online mode on for a public-facing server#

online-mode defaults to true and verifies players against the Minecraft account database. Keep it true when players connect directly to this server. Turning it off on a directly reachable server can let a player impersonate another name.

A Velocity network is different: the proxy verifies and forwards player information, while backend servers use offline mode. That arrangement is safe only when the backends cannot be reached by anyone except the proxy. Velocity's modern forwarding uses a secret, but its documentation says forwarding does not replace a firewall.

Velocity is a proxy for connecting Minecraft servers behind one public entry point. Its security guidance recommends a firewall. Read our Velocity setup guide for network setup steps.

Velocity Free A Minecraft proxy that sits in front of servers and forwards player information using modern forwarding. On PaperMC

For modern forwarding, set player-info-forwarding-mode to modern in velocity.toml. In Paper's config/paper-global.yml, enable proxies.velocity.enabled and set proxies.velocity.secret to the value in Velocity's forwarding.secret file. Keep the Paper proxy online-mode setting in line with Velocity's setting. On the backend, set online-mode=false in server.properties and leave settings.bungeecord false in spigot.yml.

Keep the forwarding secret private. If the proxy and backends run on the same machine, set server-ip=127.0.0.1 in each backend's server.properties. That makes the backend listen only on localhost.

Edit the proxy and backend files through your server file access. For separate machines, configure the OS firewall so the backend port accepts traffic only from the proxy's IP. Firewall and port rules on a managed panel are usually controlled by the host, so ask them how to restrict backend access:

Check the public entry point and keep a recovery path#

By default, server-ip is blank, so a server listens on all available addresses. The default server-port is 25565, and it must be forwarded when the server is behind NAT. For a single server that should listen on one specific interface, set its address deliberately. For a same-machine Velocity backend, use localhost as described above.

Before making access or network changes, keep a restorable copy of the server files. Our backup guide explains how to automate backups, store a copy offsite and test a restore. On Pterodactyl, the Backups tab is where panel backups are managed; on a VPS, arrange a separate copy of the server directory. Ask your host how its panel handles backups if you are unsure.

A firewall limits which systems can connect to a backend port; it is one part of server security. For network-level attack protection, ask your host what protection and response options it provides.

Paper Free Minecraft server software whose documentation covers whitelist, operator and proxy settings. On PaperMC