Secure Your Minecraft Server Against Unknown Bots

You are casually checking your Minecraft server console on the BoxToPlay panel or reviewing your latest log files, when suddenly a line catches your eye: an unknown username, such as scanner672715, tried to join your private world in the middle of the night.

An unfamiliar username in the logs does not prove your server was hacked. It may be a bot scanning IP addresses for reachable servers. To find out whether it got in, check whether the connection was rejected or accepted.

To protect a private server, start with three steps: enable the whitelist, add only your friends, and keep official account authentication enabled. If you use offline mode or a proxy, follow the relevant precautions below too. This guide covers Java, modded servers, Bedrock, and NukkitX.

1. Understanding Logs: Scan vs. Intrusion

When a scanning bot crawls the internet, it tests thousands of IP addresses and ports in sequence to automatically catalog active game servers.

When it detects a running server, its script sends a connection handshake to check if access is open. Here is the exact type of message that appears in your console or logs/latest.log file:

[03:14:22 INFO]: Disconnecting com.mojang.authlib.GameProfile@... [scanner672715]: You are not white-listed on this server!

What this message means

This message tells you that this connection attempt was rejected by the whitelist.

The player did not enter the world through that connection. This single message cannot tell you what happened during other connections or prove that the whole server is secure.

On Java, a joined the game entry means a player entered the world. If you find an accepted connection under an unfamiliar name, remove any permissions it has, ban it, and review recorded actions before resuming normal play.

2. Enabling the Whitelist

For a private server intended for solo play, family, or friends, the whitelist is by far the simplest, most effective, and most reliable defense available.

The whitelist is a built-in feature of Minecraft Java, including Vanilla, Paper, Purpur, Fabric, Forge, and NeoForge. NukkitX also provides /whitelist commands, while official Bedrock uses an allowlist. It restricts entry to approved players, with possible exemptions for operators. Keep /op privileges limited too.

From the BoxToPlay panel

1. Open Configuration in your BoxToPlay panel.
2. On Java, enable Whitelist (white-list=true). If your version provides enforce-whitelist=true, enable it to disconnect unapproved players when the list is reloaded. After removing someone, run /whitelist reload and check who is still connected.
3. Save and restart your server. You can also manage invited players through Players → Whitelist and Manual Entry.

Whitelist commands (Java and NukkitX)

You can also use your panel console or run the commands in-game with the necessary permissions:

• Turn on the whitelist: /whitelist on
• Add a trusted friend: /whitelist add PlayerName
• Remove a player from the list: /whitelist remove PlayerName
• View all approved players: /whitelist list
• Reload the list after a change: /whitelist reload

Allowlist commands (Official Bedrock)

On the official Minecraft Bedrock server (BDS), the whitelist is called the Allowlist (allow-list=true), whereas NukkitX servers keep the classic /whitelist command. On your Bedrock panel, simply set Whitelist to Yes in the Configuration page, while keeping Microsoft account required (online-mode=true) enabled.

On official Bedrock, use the panel console to manage access. Running these commands in-game requires the appropriate permissions:

• Turn on the allowlist: /allowlist on
• Add a player: /allowlist add "Player Gamertag"
• Remove a player: /allowlist remove "Player Gamertag"
• View authorized players: /allowlist list
• Reload the list: /allowlist reload

Essential tip for Bedrock:
Xbox Gamertags frequently contain spaces (for example, Alex The Miner). To add such players without triggering a syntax error in your console, always wrap their name in quotes: /allowlist add "Alex The Miner".

The whitelist controls who can enter, not who can discover your server address. In offline mode, it cannot by itself stop someone from using an approved username.

3. Securing Offline-Mode (Cracked) Servers

With online-mode=true, the server verifies official accounts before allowing a connection. A stranger cannot take your identity simply by entering your username. This does not protect an account whose credentials have been stolen.

However, if you have enabled Cracked server (online-mode=false) in Configuration to let friends join without an official paid account, any bot or intruder can try to connect using the username of the server owner or an operator with full /op permissions.

The simplest choice is to keep online-mode=true. If you need offline mode, install a compatible authentication system from the panel catalog and check that it works before opening access. Vanilla without an authentication plugin or mod should stay in online mode.

Before opening the server, register the owner and administrator accounts so a stranger cannot claim their names first. Use unique passwords that differ from your Microsoft and panel passwords. Behind a proxy, authentication and backend isolation must be configured together, as explained in section 4.

Plugin servers (Paper, Purpur, Spigot)

Modded servers (Fabric, Forge, NeoForge)

Pure modded servers do not run Spigot/Paper plugins. Instead, you need a server-side mod (installed in the server’s mods/ folder via the Plugins and Mods → Mods menu on your panel), which does not require your friends to install anything on their own clients.

A note about large modpacks:
A vanilla client that is incompatible with your modpack may be rejected before entering. This compatibility check replaces neither the whitelist nor player authentication.

NukkitX and Crossplay (Java + Bedrock)

If you host a NukkitX server with Xbox authentication turned off, or a Java + Bedrock crossplay server running in offline mode, here are the right tools:

4. Isolating a BungeeCord or Velocity Network

If you run a network of multiple Minecraft servers linked together by a BungeeCord or Velocity proxy, you must pay close attention to isolating your underlying game servers (the « backend » servers). Feel free to read our dedicated guide to building a BungeeCord and Velocity network to learn more about this architecture.

The proxy bypass trap

In a standard proxy network:

• Players connect exclusively to the public address of your proxy.
• The proxy verifies their identity and forwards them to your lobby, survival world, or minigame servers.

Backend servers use online-mode=false because the proxy handles authentication first. Keep online-mode=true on the proxy to verify official accounts. If your network accepts offline players, its authentication system must also prevent them from leaving the login server before authenticating.

The danger: if a backend server accepts direct connections without verifying that they actually came through your proxy, an IP scanner can discover the backend server’s port and connect to it directly, completely bypassing the proxy and its authentication!

Locking down backend servers

If you control the machine’s firewall, also restrict backend ports to the proxy alone. On shared hosting, use the appropriate forwarding protections below and contact support if you are unsure about isolation. Keep the Velocity secret or BungeeGuard token private.

Paper and Purpur servers

• With Velocity (recommended): use modern forwarding. For a compatible Paper backend linked through the BoxToPlay panel, the configuration enables proxies.velocity.enabled and sets the shared secret in config/paper-global.yml. Restart the backend to load these settings, then check that joining through the proxy works and a direct connection is rejected.
• With BungeeCord: classic forwarding (settings.bungeecord: true in spigot.yml) does not verify a secret. Install BungeeGuard on the proxy and each backend. Copy the proxy’s generated token into allowed-tokens on every backend, then restart them. Installing the plugin alone is not enough.

Modded servers (Fabric, Forge, NeoForge)

• On Fabric: install and configure FabricProxy-Lite with the same secret as Velocity. CrossStitch can help with modded command compatibility, but does not replace that verification.
• On Forge and NeoForge: Proxy Compatible Forge (PCF) supports modern forwarding on compatible versions. Configure that mode and the shared secret in PCF as well as Velocity. For Forge 1.13 through 1.20.1, Ambassador may also be needed on the proxy for modded protocol compatibility.

5. Limit Exposed Information and Protect Access

Some scanners query server status to collect its version, description, or a sample of connected players. You can limit that information, but this does not make the server port invisible.

On Java, the following settings are in server.properties and, depending on the version, in Configuration on the panel:

• Hide the player sample (hide-online-players=true): removes usernames from the status response. It does not hide the player count or protect names already known elsewhere.
• Disable status replies (enable-status=false): the server appears offline in the multiplayer list, but players can still try to join it. Let your friends know so they do not mistake this display for an outage.
• Keep secure profiles enabled (enforce-secure-profile=true): on supported Java versions, this rejects players without a Mojang-signed public key. It does not by itself guarantee that every message is signed or replace online-mode=true. For proxies or crossplay, follow the settings supported by your setup.
• Keep the RCON password private: RCON allows remote administrator commands. Keep the strong password generated by BoxToPlay and the technical settings managed by the panel. Query supplies server information and is not protected by that password.

6. Protecting Public Servers (Anti-Bot & Anti-VPN)

If you run a public community server open to newcomers, a whitelist is obviously not an option. How do you stop a bot wave from flooding your server with fake connections?

1. Choose a compatible anti-bot plugin: UltimateAntiBot and EpicGuard are free, open-source projects. Check supported Minecraft versions and server software before installing. On a network, place protection at the entry point, on the proxy, using the correct build for it.
2. Tune the checks with your players: anti-VPN checks can reject legitimate players and may use external services with their own quotas or fees. Check Geyser/Floodgate connections too before making filtering stricter.

These plugins filter Minecraft connections. They do not replace network-level DDoS protection or guarantee that every bot will be stopped.

7. Permissions, Anti-Grief Rollback, and Panel Tools

For everyday administration, complement these protections with the tools in your BoxToPlay panel:

• Limit /op with LuckPerms: avoid giving full operator privileges to every player or moderator. LuckPerms lets you grant only the commands each role needs.
• Set up logging before griefing happens: on Paper and Purpur, CoreProtect lets you inspect recorded actions with /co inspect. To undo a player’s actions over the past two hours within 20 blocks of your position, start with /co rollback u:<player> t:2h r:20 #preview. After checking the preview and making a backup, remove #preview to apply the rollback. The plugin must have been installed before the damage occurred. On Fabric, Ledger also provides logging and rollbacks. GriefLogger logs interactions on compatible Forge, NeoForge, and Fabric versions, without providing the same rollback system on its own.
• Manage access from Players: add or remove friends from the Whitelist, manage Operators (OP), and ban usernames or IP addresses through the interface or Manual Entry.
• Delegate through Co-administrators: use Others → Co-administrator to grant moderators only the panel permissions they need, without sharing your password or FTP credentials.
• Restore a backup: check the available dates in Others → Backups and select a point before the problem. A full restore replaces the current server state and discards changes made since that point.

Keep your server, plugins, and mods updated, and protect your BoxToPlay account with a unique password and two-factor authentication. With an appropriate whitelist, verified identities, and available backups, an unfamiliar username in the logs becomes much easier to handle.

Ready to launch a new multiplayer world on fast, secure, and continuously backed-up hardware? Explore our BoxToPlay Minecraft server hosting plans today and set up your world in just a few clicks!