How to Secure a Minecraft Server and Your Home Network: A Security Checklist

What we are protecting against

An open port doesn’t expose your whole computer to the internet: only the program that listens on that port, that is, the Minecraft server, can be reached through it. That is why almost all the risks come down to four:

• Strangers joining. Without a whitelist anyone can get onto the server and wreck builds, take items or spam the chat. Griefers (players who ruin other people’s worlds) often find servers with automated scanners, even if you never published the address.
• Impersonation. If you turn off online-mode, the server stops checking who is connecting, and anyone can join under any nickname, including an operator’s.
• Someone else’s code on your computer. A vulnerability in the game itself or in its libraries (like Log4Shell in 2021) or a malicious mod can let someone else run their program on the computer where the server runs. This is the most serious risk.
• Weak spots in your network. A router with its factory password, remote management left on, extra forwarded ports: the danger is not only to the server but to every device in your home.

Two settings take care of the first two risks in a minute; the others need a bit more time.

The ten-minute minimum

If you are short on time, do at least this, and look at the sections below for details and checks:

• The whitelist is on: server.properties has white-list=true.
• server.properties has online-mode=true.
• Only you and people you trust as much as yourself are operators.
• RCON and Query are off, and port 25575 is not open on the router.
• Only the port you need is forwarded on the router, “DMZ” is off, the factory admin password has been replaced, and remote management is off.
• The server, Java and the router firmware are up to date.
• Mods and plugins come only from reliable sources.
• There is a fresh backup of the world.

The whitelist

The whitelist is a list of players who are allowed to join the server. It is stored in the whitelist.json file. To everyone else the server answers “You are not white-listed on this server!” and doesn’t let them in. For a server with friends this is the most effective protection: even if the address ends up in the wrong hands, strangers still can’t get in.

Since Minecraft 26.3 (15 September 2026) a newly created server has the whitelist turned on by default (white-list=true in server.properties). A server created on an older version keeps its old setting even after an update to 26.3. In that case, and on older versions, turn the whitelist on with the same line and restart the server, or type /whitelist on in the server console. The server always lets operators in, even if they are not on the list.

The commands are typed in the server console (the window where the server runs):

• /whitelist add PlayerName — add a player (replace PlayerName with your friend’s nickname). With online-mode=true the server looks the account up by nickname, so the nickname has to be real and spelled without typos.
• /whitelist remove PlayerName — remove a player.
• /whitelist list — show everyone on the list.
• /whitelist reload — reload the whitelist.json file if you edited it by hand.

If you removed a player from the list but they are still on the server, open server.properties, set enforce-whitelist=true and restart the server: then the server kicks anyone you have removed from the list. You can also kick a player by hand with /kick PlayerName.

To check, ask someone who is not on the list to join: if the game answers “You are not white-listed on this server!”, the whitelist works. If they got in, it is off: check white-list=true and restart the server.

Bedrock Edition. On Bedrock Dedicated Server the whitelist is called the allow list: turn it on with allow-list=true in server.properties and add players with the allowlist add PlayerName command in the server console. The list is stored in the allowlist.json file. Unlike Java Edition, operators are not let in automatically: add yourself and the other operators to the list too.

The online-mode setting: checking players

The online-mode setting (true by default) makes the server check every player with Minecraft’s account service: that is how the server makes sure a nickname belongs to the person using it. On a server that is open to the internet, don’t turn it off: that makes sense only for a server that can’t be reached from the internet.

If online-mode=false, the server checks nobody: anyone can join under any nickname, including an operator’s, and get all of that person’s rights. In this mode the whitelist keeps out only those who don’t know a nickname from the list, and nicknames are easy to learn: the server list shows the names of players who are online.

With online-mode=true, players using cracked launchers can’t join: they have no account that can be checked. If your friends play that way, turning the mode off is at your own risk: don’t give anyone operator rights, keep the whitelist on, hide the player list (hide-online-players=true) and, if you can, do without an open port. A virtual network (it is described in the article about the public IP address) lets only the people you invited reach the server.

To check, make sure server.properties contains the line online-mode=true. If a player with a licensed account still sees “Failed to verify username!”, it is usually a broken login session: the details are in the article about ports, in the section about connection errors.

Operator rights

An operator (op) can run server commands. The /op PlayerName command gives a player the level that is set in server.properties by the op-permission-level option. By default it is 4, the highest level: such an operator can use every command, including stopping the server. The levels differ in what they allow:

• Level 2: game commands such as /gamemode, /tp, /give, /time and /summon.
• Level 3: player management commands such as /op, /deop, /ban, /kick and /whitelist.
• Level 4: everything, including /stop, /save-all and the other server management commands.

If a friend needs only game commands, open server.properties, set op-permission-level=2 and restart the server: new operators will get level 2. The level of operators who were already added is stored in the ops.json file (the level field).

• Give operator rights only to yourself and people you trust as much as yourself, and don’t hand them out “for a while”: a forgotten operator stays an operator.
• You can remove an operator with /deop PlayerName. Open ops.json and whitelist.json from time to time and check that they contain no nicknames you don’t know.
• Operator rights are tied to a player’s account. If the account is hacked, the attacker gets the rights on your server too, so turn on two-step verification for the Microsoft account you use to play Minecraft and ask the other operators to do the same.

Bedrock Edition. The rights of new players are set by the default-player-permission-level option (possible values are visitor, member and operator; the default is member): don’t set it to operator.

RCON, Query and other “remote controls”

The server has several optional network interfaces: two of them let you manage it remotely, and one gives out information about it. All of them are off by default, and it is better to keep it that way:

• RCON (enable-rcon, port 25575, TCP) is a remote console for the server. Its data is not encrypted, so the password can be intercepted, and exposing RCON to the internet is dangerous. If you need RCON, use it only inside your home network, don’t forward port 25575 on the router and set a long, unique password in rcon.password (the server won’t start RCON with an empty password).
• Query (enable-query, port 25565, UDP) is a protocol that monitoring programs use to get information about the server. If your router offers only “TCP/UDP” for the Minecraft rule, it also forwards UDP port 25565: while enable-query=false, this is harmless.
• The server management protocol (management-server-enabled) is a newer interface for managing the server over the network. It is also off by default. If you turn it on, by default it listens only on the local address (management-server-host=localhost), accepts only programs that know its secret key and requires encryption (management-server-tls-enabled=true): for that you have to provide a certificate file (keystore), otherwise the server won’t start. If you don’t need it, leave it as it is, and if you do need it, don’t expose it to the outside.

To check, open server.properties: it should contain enable-rcon=false and enable-query=false. The list of forwarding rules on the router shouldn’t contain port 25575.

The router

Behind the router there is not only the server computer but also phones, TVs, cameras and other devices, so the router’s settings matter as much as the server’s. If the router is not yours (a dorm, a rented apartment, the provider’s equipment), first check with whoever pays for the internet and is in charge of the network.

• Forward only the port you need. Don’t turn on “DMZ” (a mode that sends all incoming connections, on any port, to one computer) and don’t open ranges of ports “just in case”.
• Change the router’s factory admin password (it is printed on the sticker, and for many models it is published online) to a long, unique one. If the router allows it, change the username too.
• Turn off remote management (the option is called “Remote Management”, “Remote Access” or “Web Access from WAN”): otherwise the router’s settings page can be opened from the internet.
• Keep the router’s firmware up to date: old versions can have known vulnerabilities. Look for a new version in the firmware update section (Firmware Update) of the router’s settings or on the manufacturer’s website.
• Turn off UPnP unless other devices in your home need it (some game consoles do, for example). This feature lets programs on your network ask the router to open a port without your knowledge, and you create the rule for the server by hand anyway.
• Protect your Wi-Fi with WPA3 or WPA2 encryption and a strong password, and give guests and smart-home devices a separate guest network: that keeps those devices off the network the server is on.
• If you won’t need the server for a long time, turn off or delete the forwarding rule. Then the port is closed even if something unwanted starts on the computer by accident.

To check, open the list of forwarding rules on the router: only rules you recognize should be left. Then check remote management: turn off Wi-Fi on your phone (you need mobile data) and type the router’s external IP address into the browser’s address bar (how to find it is described in the article about ports). The router’s login page shouldn’t open. If it does, remote management is on. If it doesn’t, that is not proof yet: some routers use a separate port for remote access (ASUS and NETGEAR use 8443 by default), so also make sure remote management is turned off in the router’s settings.

The Windows firewall and your computer

The Windows firewall is the second line of defense: it decides which programs may accept incoming connections. You don’t need to turn it off; it is enough to allow one port.

• Don’t turn the firewall off just to make something “work”. If friends can’t connect, look for the closed door step by step, as in the article about ports.
• A rule with the Public profile selected also applies on other people’s networks. If you take your laptop with you (a coffee shop, a dorm, a station), turn the server or the rule itself off there: in wf.msc right-click it and choose “Disable Rule”.
• Start the server the usual way, not with “Run as administrator”: a program gets the rights of whoever started it, so a vulnerability or a malicious mod gets the same rights. The server itself never needs administrator rights: they are needed only for setup, for example to install Java or to create the firewall rule. If the server runs under a Windows account without administrator rights, Windows may create blocking rules for Java at the first start: how to delete them is described in the article about ports, in the section about the Windows firewall.
• Keep antivirus protection on (Windows Security or another antivirus you trust) and install Windows updates.

Your IP address

An IP address is not a home address: it can tell someone your provider and your approximate location (usually the region or the city, and sometimes it is wrong), but not your apartment. Even so, you shouldn’t spread it around: knowing the address, someone can scan your network and try to flood it with traffic (DDoS), which slows your internet down or cuts it off.

• Send the address to friends in private messages, and don’t publish it in open chats, on forums, in a stream description or in screenshots. During a stream, check that the address is not visible in the game’s server list or in the console.
• The server log (logs/latest.log) records players’ IP addresses whenever they join. If you ask someone for help, don’t send the log as it is: cut out or replace the addresses first. In newer versions of the game, recording addresses can be turned off with log-ips=false.
• A domain name you got from a DDNS service (how it works is described in the article about the public IP address) is more convenient than an address made of numbers, but not safer: a name is easily turned into an address.
• A different external port (for example 25570 instead of 25565) in the forwarding rule won’t stop a targeted attack, but it makes the server harder for simple automated scanners to find. Friends will have to enter the address with the port: 203.0.113.5:25570.
• The enable-status=false option stops the server from answering server-list requests (which makes it harder for scanners to find), and hide-online-players=true hides the player list in those answers. But if you turn the answers off (the first option), the server will appear offline in your friends’ server list (they can still connect by address), and status-checking sites such as mcsrvstat.us will no longer see it.
• If the address has nevertheless ended up in the wrong hands, turn off the forwarding rule on the router, restart the router (with some providers a dynamic address changes after that), and check the whitelist and ops.json.

The most reliable option is not to reveal your home IP address at all: a hosting service or a tunnel service accepts the connections for you, and your friends see the address of the host or the service, not yours. Tunnels and virtual networks are described in the article about the public IP address.

Updates

Most serious security holes are fixed by updates to the server, Java, Windows and the router. The best-known example for Minecraft is Log4Shell. On 10 December 2021 Mojang announced a vulnerability in the Log4j library, which Java Edition servers use: it could be used to run someone else’s program on the owner’s computer, for example by sending a special string in the chat. The fix arrived in Minecraft 1.18.1, and for older versions Mojang published workarounds (a Java launch argument, and for versions before 1.17 also a logging configuration file that this argument points to). Servers that were neither updated nor protected with the workarounds stayed vulnerable.

• Update the server when a new version comes out. Before that, stop the server and copy the folder (see the section about backups): a world that has been opened in a newer version usually can’t be opened in an older one again. Then download the new server.jar from minecraft.net and replace the old file with it.
• Update Java too: install the latest build of the version your server requires (the guide to making a server says which version that is).
• If you have mods or plugins, before updating the game make sure updates for the new version have come out for them too: otherwise the server may not start. A backup for this case is a must. Download a server for mods or plugins (for example Paper, Fabric or Forge) from its developers’ website, not from minecraft.net.
• Update Windows and the router too: Windows through Windows Update, and the router in the firmware update section of its settings.

To check, look at the start of the server log, logs/latest.log: it shows the version of your server. Compare it with the latest version on minecraft.net.

Mods, plugins and files from other people

A mod or plugin is a Java program that the server runs inside itself, with the same rights. A malicious mod can do anything on your computer that you can: read and change files, run other programs, send data to the internet. This is not theory: in June 2023 a malicious program called fractureiser spread through mods and plugins on CurseForge and BukkitDev, got into several popular modpacks and worked on Windows and Linux.

• Download mods and plugins from their authors’ pages and from large catalogs, not from archives sent to you in a chat or on Discord, or from links in a video description.
• Before installing, look at the project: how long it has existed, how many downloads and reviews it has, whether the author has other projects and whether the source code is open. A mod with no history that a stranger keeps urging you to install is a reason to be wary.
• Install only what you really need: every mod is one more program with access to your computer.
• Scan files with an antivirus before installing, but don’t rely on it completely: malicious code may be new and still unknown to the antivirus.
• Don’t run other people’s .jar, .bat and .exe files, even if someone you know sent them: friends’ accounts get hacked too.
• Don’t run the server as administrator (see the section about Windows) and keep backups: if something goes wrong, you can get the world back.

Backups

A backup protects you against many things at once: griefers, mistakes, a disk failure and a bad update. The easiest way is to copy the whole server folder: it holds the world (the world folder by default), the settings, and the whitelist.json and ops.json lists.

The most reliable way is to stop the server with the stop command in the console, copy the folder and start the server again. If you can’t stop the server, type these in the console, in order:

1. 1/save-off: the server stops writing the world to disk (changes are held back meanwhile).
2. 2/save-all flush: everything accumulated is written to disk, and the server freezes briefly.
3. 3Copy the server folder somewhere else (you can zip the copy afterward). If Windows says a file is in use, skip it: it is the world’s lock file, and the backup doesn’t need it.
4. 4/save-on: writing the world is turned on again. If you forget this command, autosave stays off until the server is restarted.

• Make a copy before updating the server and before installing a mod or plugin, and also regularly: every few days, or more often if people play a lot.
• Keep copies not only on the disk the server runs from: use another disk, a flash drive or cloud storage.
• From time to time check that a copy works: stop the main server, unpack the copy into another folder and start a server from it.
• To restore the world, stop the server, rename the old folder (don’t delete it, in case the copy turns out to be bad), put the copy in its place and start the server.

If something goes wrong

Signs of trouble: unfamiliar players or operators on the server, items and builds gone, files in the mods folder that you didn’t install, the internet or the computer slowing down for no clear reason. What to do depends on the case.

Strangers are causing trouble on the server

1. 1Turn off the forwarding rule on the router: while you sort things out, no new visitors can get in.
2. 2Kick the strangers with /kick PlayerName or stop the server with the stop command.
3. 3Check ops.json and whitelist.json. Remove players you don’t know with /deop PlayerName and /whitelist remove PlayerName, or delete their entries from the files while the server is stopped.
4. 4Restore the world from a copy made before the incident (see the section about backups).
5. 5Find the cause: was the whitelist or online-mode off, did you give operator rights to too many people, did your address end up in an open chat. Fix it before you open the port again.

You suspect a malicious mod or file

1. 1Stop the server and turn off the forwarding rule on the router.
2. 2Delete the suspicious file and run a full antivirus scan of the computer.
3. 3From another, clean device (for example a phone) change the passwords: for your Microsoft account, email, Discord and everything else that was saved in the browser on this computer. Then sign out of all other sessions.
4. 4Turn on two-step verification everywhere it is available.
5. 5If you are not sure the computer is clean, the most reliable way out is to reinstall Windows, saving only your personal files beforehand (not mods and not programs).

The internet drops or the server lags for no reason

Not every slowdown is an attack: more often the cause is too little memory for the server or limited upload bandwidth. But if the internet drops completely and strangers could have learned the server’s address, a flood of unwanted traffic (DDoS) may be aimed at your address. Restart the router: with some providers a dynamic address changes after that, and the flood will keep hitting the old address instead of yours. Turning off the forwarding rule won’t stop a flood that is already running (it clogs your connection before it reaches the router), but keep the rule off for now so that the server can’t be found at the new address. If that doesn’t help, contact the provider’s support.

You suspect the router was hacked

Signs: the router’s password or settings changed, unfamiliar forwarding rules appeared, the browser opens strange pages instead of websites. First, find the connection details in your contract with the provider (login, password or connection type): after the reset you will have to enter them again, along with the forwarding rules. Then reset the router to factory settings (there is usually a Reset button for this), set a new admin password and a new Wi-Fi password, set up the connection again and update the firmware.

Frequently asked questions

Is it dangerous to open a port for a Minecraft server?

A port by itself gives access only to the program that listens on it, that is, the server. The router’s other ports stay closed. So the risk depends on the server itself: its settings (the whitelist, online-mode), updates and the mods you installed. If you follow the checklist from this article, the risk for a server with friends is small, but it is never zero.

Can a player harm my computer through the server?

They shouldn’t be able to if the server is up to date and you haven’t installed dubious mods: the game doesn’t let players run programs on your computer. The real dangers are vulnerabilities in the game itself and its libraries, as with Log4Shell (updates fix them), and malicious mods, which you run yourself. An operator can change and wreck the world, so give these rights carefully, but in the vanilla game they don’t give access to your computer’s files.

Does a whitelist protect against a DDoS attack?

No. The whitelist checks a player after the connection is made, while a DDoS hits the address itself and clogs the channel before it reaches the server. What protects against such an attack is a hidden home IP address: a hosted server or a tunnel service. For a server with friends such an attack is unlikely, but not impossible if the address has ended up in the wrong hands.

What is safer: an open port, a virtual network or hosting?

For a server with just a few friends, the safest options are the ones with no open port on your router. Hosting: the server runs on someone else’s computer, and your home network stays closed. A virtual network: only the people you invited can reach the server (virtual networks and tunnel services are described in the article about the public IP address). An open port can also be made reasonably safe, but then you have to follow the whole checklist and keep up with updates.

What if the server has to be public?

Then the whitelist has to be turned off, and protection works differently. Don’t keep such a server on a home computer: hosting is better, because your home IP address stays hidden. Don’t give out operator rights unless absolutely necessary, make backups more often and be ready to ban offenders quickly with /ban PlayerName. To keep order, public servers usually install plugins that record and roll back other people’s changes, but choose them as carefully as any other mods and plugins.

What if the server runs on a hosting service?

Then the host protects the network and the computer: your home IP address stays unknown, and you don’t need to set up a router or ports. The whitelist, operator rights, mods and backups are usually up to you, so the sections about them are still useful.

What next

Once you have gone through the checklist, check everything again after updating the server, installing a new mod or changing the router. If you haven’t opened the port yet, go back to the article about ports, and if you would rather not deal with the router and the firewall, take a look at hosting: there you don’t need to set up the network.