Protect your Minecraft server from griefers and hackers with land claims, CoreProtect rollbacks, a whitelist, anti-cheat and clear staff rules.
Decide what kind of server you are
The right protection depends on the server you want. A friendly survival or SMP server needs protection against griefers. A PvP or factions server expects fighting and needs strong cheat prevention. An anarchy server deliberately has almost none. Be clear about your rules and say so on your listing, so players know what to expect.
Layer 1: Protect builds with land claims
A claim plugin lets players mark an area that only they and people they trust can build in. Popular choices include GriefPrevention, Lands and WorldGuard. Pick one, set a sensible starting claim size, and let players claim with a golden shovel or a command. Players who can protect their base are less afraid of losing it, so they build more and stay longer.
- Set limits so one player cannot claim half the map.
- Decide what happens to claims of players who leave for months.
- Protect the spawn area so only staff can build there.
Layer 2: Log everything and roll it back
CoreProtect logs block changes, container access and kills, and it can reverse them. When griefing happens, you can find out who did it and undo it:
Inspect (click a block to see its history)
/co inspectUndo a player's changes from the last 3 hours within 30 blocks
/co rollback user:PlayerName time:3h radius:30Restore if you rolled back too much
/co restore user:PlayerName time:3h radius:30Rollbacks make griefing pointless, because the damage is gone in seconds. Make sure the CoreProtect version supports your Minecraft version.
Layer 3: Control who joins
- Whitelist: only approved names can join. Best for small, close communities.
- Application: players apply, for example on Discord, before they are whitelisted. List your server with the Application required tag so people know.
- A short trust period: new players start with fewer permissions and earn more over time. LuckPerms makes this easy.
- Keep online-mode on, unless you run behind a properly secured proxy. With it off, anyone can join under any name.
Layer 4: Anti-cheat
Cheaters ruin PvP and competitive modes quickly. An anti-cheat plugin watches for impossible movement and combat, such as flying, speed hacks and killaura. Free options such as Grim exist, and there are paid ones. Whichever you choose:
- Use one that is maintained for your Minecraft version.
- Start with the default settings and watch alerts for a few days before turning on automatic punishments, because false positives happen, especially with lag.
- Have staff review alerts rather than banning on a single flag.
- Remember cheat clients adapt. Anti-cheat helps, but active moderators matter more.
Layer 5: Staff and rules
- Write short, clear rules and put them in a book, on Discord and on your listing.
- Give moderators only the permissions they need. Never give out operator status.
- Have a simple appeals process, so a wrongly punished player has somewhere to go.
- Log punishments, so a new moderator can see a player's history.
When it happens anyway
- Ban the player and note the evidence (screenshots, the CoreProtect log).
- Roll the damage back with CoreProtect.
- If the damage is large or unclear, restore from a backup. See the backup guide.
- Tell the affected players what happened and what you did. Honest communication keeps a community together.
- Look for the hole: a missing claim rule, a permission that was too generous, or a plugin exploit that needs an update.
Frequently asked questions
How do I stop griefing on a Minecraft server?
Use a land-claim plugin such as GriefPrevention or Lands, log changes with CoreProtect so you can roll them back, and control who joins with a whitelist or application.
How do I roll back griefing with CoreProtect?
Use /co rollback user:PlayerName time:3h radius:30. Use /co inspect to see a block's history, and /co restore to undo a rollback.
What is the best anti-cheat for Minecraft?
It depends on your version and mode. Free options such as Grim exist, and there are paid ones. Use one maintained for your version, review alerts before punishing and expect to tune it.
Should I keep online-mode on?
Yes, unless you run behind a properly secured proxy. With online-mode off anyone can join under any username, including an operator's.