Most server breaches are not clever. They are preventable.

DDoS protection, honestly

A distributed denial-of-service attack is a flood of traffic aimed at knocking a connection offline. People usually meet it the hard way: they host a server at home, someone attacks the address, and their entire home internet drops for everyone in the house. Moving to a hosting provider is itself part of the defence, because the attack lands on the provider’s network instead of on your front door.

On top of that, a protected network filters and absorbs the bulky traffic that would otherwise take a line down. What it honestly cannot do is make you invincible. A determined attacker can still aim game-level abuse at your server, and no amount of filtering will fix a weak password or a plugin you installed from a strange source. Treat DDoS protection as one layer, not the whole wall.

Lock down the panel first

The control panel is the most powerful surface you own. From there you can start and stop the server, reinstall its software and version, read the console, and browse its files. Whoever holds that login can do anything to your world. It deserves more care than the game account itself.

• Use a long, unique password that you do not reuse on any other site. A password shared across services is one breach away from being your server password.
• Turn on two-factor authentication for your account so a stolen password alone is not enough.
• Never share your panel login with anyone, including people you trust with in-game access. Give them their own account or their own role instead.
• Be sceptical of links that ask you to sign in. Phishing aimed at game communities is common and convincing.

Account security settings are reachable from the storefront, and the panel is where the server itself is managed. If you ever suspect a login is compromised, change the password and review who has access before doing anything else.

Protect the game port

The game port is the second door. It has to be reachable for players to join, but that does not mean it should be left wide open to anyone who finds it.

• Keep online-mode on unless you have a specific, understood reason to turn it off. It is what stops one player impersonating another.
• Use a whitelist on a private server, and keep permission plugins tight on a public one, so a stranger who joins cannot immediately do damage.
• Do not hand operator rights to people you do not know. Operator status is effectively full control.
• Keep the server software, plugins and mods updated. Old versions carry known problems that have already been fixed upstream.
• Install plugins and mods only from reputable sources, and be wary of anything that wants access it has no reason to need.

Strong admin practice

The theme running through all of this is least privilege: give every account, plugin and person only what they need, and not a step more.

• Keep an admin account separate from the account you play on, so a stolen game login is not also a stolen panel login.
• Audit who is an operator regularly and remove anyone who no longer plays or no longer needs it.
• Keep working backups, so a mistake or a bad actor is something you can recover from rather than something you lose.
• Be deliberate about every new person you promote. Verify who you are giving access to before you give it.

Permissions are where most of this is enforced in practice, and the whitelist and permissions page covers the mechanics. Backups are your safety net, and the backup guide covers how to make that net real.

If something does go wrong

Even careful servers have bad days, and how you respond matters more than the mistake that started it. Work through the basics in order before you try anything clever.

• Change the password on the account that controls the server, then review who else has access while you are there.
• Audit operators, staff groups and the whitelist, and remove anything you do not recognise or no longer need.
• Read the console history and recent file changes to understand what actually happened before you undo it.
• If the world was damaged, restore from a backup you have tested rather than improvising under pressure.
• If the server or the network is under attack, raise a ticket or ask in Discord, and check the status page for the node.

What a host can do for you — and what it cannot

Server security — questions