Server Security and Anti-Grief Essentials

Securing your Minecraft server against malicious griefing, rogue operators, unauthorized access, and offline account hijacking is vital for maintaining a healthy multiplayer community.

1. Online Mode vs Offline / Cracked Mode Security

In server.properties, the online-mode parameter controls how Minecraft authenticates connecting players:

online-mode=true

Online Mode (true): The server queries Mojang session servers to verify each player's official UUID and skin. Players cannot impersonate administrators or join as someone else.
Offline Mode (false): Allows unofficial or cracked Minecraft clients to join. High Risk: Anyone who knows the administrator's username can join as the server owner with full /op access unless an authentication plugin (such as AuthMeReloaded) is installed with password hashing.

Security Rule: Keep online-mode=true unless you have explicitly configured an authentication plugin and firewall protections.

2. Eliminate Direct Operator (/op) Privileges

Granting players raw /op access bypasses all server security constraints. Instead of running /op player:

Use LuckPerms: Create permission groups (such as moderator, builder, admin).
Grant Granular Nodes: Assign only the exact commands required (e.g., minecraft.command.kick, minecraft.command.teleport, coreprotect.inspect).
Prevent Staff Hijacking: Do not give staff members minecraft.command.stop or luckperms.* permission nodes unless they are trusted co-owners.

3. Recommended Anti-Grief Protection Plugins

Equip your Paper or Purpur server with industry-standard security tools:

Protection Tool	Purpose	Performance Impact
CoreProtect	Fast block, chest, and container action logging with full 1-click rollback	Low
GriefPrevention	Player self-service land claims with golden shovel claiming tool	Very Low
WorldGuard	Define server-wide protected regions for spawn areas and shops	Low
GrimAC	Modern open-source packet-level anti-cheat for movement and combat exploits	Very Low

4. Emergency Incident Response Protocol

If your server suffers griefing or unauthorized damage:

Do Not Panic: Avoid issuing immediate restarts or clearing files.
Kick and Whitelist: Run /whitelist on to prevent unauthorized players from joining.
Execute CoreProtect Rollback:

/co rollback u:<griefer_name> t:2h r:global

This command restores all modified blocks, chest inventories, item frames, and lava placements created by the specified user in the last two hours.

Permanent Ban: Use /ban <player> Malicious griefing to lock them out by username.

5. Node Architecture and IP Banning (NL0 vs UK1)

All FreeMcHosting nodes are completely self-hosted and operated directly by our team. Understanding how network traffic is routed is critical when managing player bans:

Free Tier (NL0 - 45.13.237.208): To protect our self-hosted infrastructure and keep servers free, we proxy traffic into the NL0 cluster. Because connections flow through our proxy layer, your server container sees the proxy IP rather than each player's individual external IP. For this reason, NL0 has no IP banning capabilities. Executing /ban-ip will either fail or accidentally ban the proxy layer. On NL0, you must ban players by username (/ban <player>), use whitelist access control, or enforce authentication plugins.
Donation Tier (UK1 - 57.128.180.78): The UK1 donation tier operates with direct IP visibility. That way, community owners on UK1 have full IP banning capabilities (/ban-ip <player> or /ban-ip <ip>) to block persistent griefers and alternate accounts at the network level.

FreeMcHosting runs entirely on a nonprofit basis. We put our resources into providing free Minecraft servers, helping more people build, explore and connect. Support through the donation tier funds our hardware upkeep and direct operations.