Secure your server (anti-grief, permissions)

An unprotected public server quickly becomes a target for griefers: destruction, theft, command abuse. A combination of whitelist, fine-grained permissions, and protected regions reduces these risks.

Cause / The problem

By default, any connected player can break blocks, open chests, and move anywhere. Operators (OP) have full access, which becomes dangerous as their numbers grow.

Solution

1. Enable the whitelist in server.properties:

   white-list=true
   enforce-whitelist=true

   Add players with whitelist add <username> in the console.
2. Keep online-mode=true. Offline mode disables Minecraft account verification and allows username spoofing. Disable it only with full awareness of the consequences.
3. Install LuckPerms as your permissions manager. Create sensible groups:
   • default: chat, movement, basic interaction.
   • vip: cosmetic perks, extra homes.
   • mod: kick, mute, inspection.
   • admin: full management.
4. Limit OPs. Only OP trusted admins, and prefer delegating precise rights through LuckPerms rather than using op.
5. Protect regions with WorldGuard + WorldEdit. Select a region (//pos1, //pos2) then:

   /rg define spawn
   /rg flag spawn passthrough deny
   /rg flag spawn build deny

   Repeat for sensitive areas (spawn, shops, events).
6. Hide the server from public lists until setup is finalized (server.properties → leave unwanted motd empty, and don’t publish the IP).

Monitor the logs and immediately revoke rights from a compromised account with /lp user <username> clear.