A secure Minecraft server uses layers: keep account authentication enabled, allow only intended players, isolate proxy backends, run with minimal operating-system privileges, patch every component, control plugins, and maintain backups that can survive a host failure or account compromise. The exact settings differ between Java, Bedrock, and Velocity, but the order below gives you a defensible baseline without relying on a single plugin or password.
Prefer not to run the server on your own PC? Godlike.Host offers hosted Minecraft Java servers with free DDoS protection and up to three free backups a day.
Start with the architecture you actually run
Security decisions depend on whether players connect directly to one server or through a proxy network. A direct Java or Bedrock server has one public game endpoint. A Velocity deployment has a public proxy plus one or more backend servers. The proxy is the only component that should normally accept Internet traffic; a backend exposed to the same Internet can be contacted without passing through the proxy’s authentication and routing logic.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Minecraft | Java & Bedrock Deluxe Collection | Windows Digital Code | $39.99 | Buy on Amazon |
| 2 |
|
Minecraft | Java & Bedrock Ultimate Collection | Windows Digital Code | $49.99 | Buy on Amazon |
| 3 |
|
Minecraft | Standard Edition | XBOX Digital Code | $19.99 | Buy on Amazon |
| 4 |
|
Minecraft | $6.99 | Buy on Amazon |
| 5 |
|
Minecraft - Bedrock Edition PS4 | $42.98 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Security question | Direct server | Velocity network |
|---|---|---|
| Where should account authentication occur? | At the public Java or Bedrock server, with online mode enabled. | At the public proxy; backend servers are normally kept inaccessible from the Internet. |
| Can a player reach backend ports directly? | There is no separate backend. | No. Firewall the ports, bind same-host backends to 127.0.0.1, or carry traffic over a properly restricted encrypted tunnel between hosts. |
| Primary network control | Host firewall and a restricted management plane. | Proxy firewall rules plus backend isolation; forwarding protection does not replace a firewall. |
| Operational complexity | Lower: fewer moving parts and one server configuration. | Higher: proxy, forwarding settings, backend addressing, secrets, and inter-host networking all have to remain consistent. |
| Recovery requirement | Back up the world, configuration, and plugin data. | Back up the proxy configuration and every backend’s world and plugin data, with a copy independent of the host. |
Velocity’s documentation is explicit that “Velocity modern forwarding is not a replacement for a firewall.” Treat forwarding as an identity-and-routing feature, not as network access control. If you run a single server, you still need the same principles—authentication, membership control, least privilege, patching, and recovery—but without the proxy-specific forwarding risk.
Keep account authentication enabled
Java Edition and Paper
In a Java server’s server.properties, set online-mode=true. Paper documents this setting as checking connecting players against Minecraft’s account database. Players therefore need valid Minecraft accounts, and clients that rely on cracked or unauthenticated identities are rejected. This is the foundation for reliable player identity: names cannot simply be claimed by whoever connects first.
#1 Best Overall
- DELUXE COLLECTION — Includes Minecraft: Java & Bedrock Edition, three Bedrock add-ons, three exclusive Character Creator items, and 700 Minecoins.
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that’s unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world filled with surprises.
- SURVIVE THE ADVENTURE — Face mysterious foes, travel across exciting landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play cross-platform with friends in Bedrock Edition on console, mobile, and PC, or join community servers in Java Edition on PC, Mac, and Linux. Online console multiplayer requires a platform-specific subscription (sold separately).
After changing the file, stop and restart the server so the setting is loaded. Do not attempt to compensate for offline mode with an authentication plugin while leaving the server publicly reachable; the safer baseline is to let the official account check happen before a player receives access.
Bedrock Dedicated Server
For an Internet-facing Bedrock server, keep online-mode=true in the server configuration. Microsoft’s Bedrock guidance recommends online mode for public exposure because it requires the platform’s account authentication instead of trusting an unverified identity. Confirm the value after upgrades, because replacing a configuration file can silently restore defaults.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhat authentication does—and does not—solve
- It establishes that the connecting account is authenticated; it does not decide whether that account belongs on your private server.
- It does not protect an exposed Velocity backend from direct connections that bypass the proxy.
- It does not remove the need to patch the server, review plugins, limit operator rights, or maintain backups.
Restrict who is allowed to join
Private Java server: whitelist and enforce it
Set white-list=true in server.properties when only selected players should join. For a private server, also set enforce-whitelist=true. The whitelist allows only named users; enforcement ensures that a player who is not on the list is removed when the list is applied, rather than merely being blocked on a future connection.
Paper’s documentation says the list can be managed from the server console or through whitelist.json. A safe administrative sequence is:
Rank #2
- ULTIMATE COLLECTION — Includes Minecraft: Java & Bedrock Edition, five Bedrock add-ons, five exclusive Character Creator items, and 1000 Minecoins.
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that’s unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world filled with surprises.
- SURVIVE THE ADVENTURE — Face mysterious foes, travel across exciting landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play cross-platform with friends in Bedrock Edition on console, mobile, and PC, or join community servers in Java Edition on PC, Mac, and Linux. Online console multiplayer requires a platform-specific subscription (sold separately).
- Stop the server before hand-editing
whitelist.json; preserve valid JSON syntax and make a backup of the file. - Add only the accounts you recognize, using their exact current Minecraft names or the server’s normal whitelist-management command.
- Reload the list from the console after a controlled change, or restart if you changed
server.properties. - Test with one approved account and one unapproved account before announcing the address.
Keep operator access separate from membership. A trusted player does not automatically need administrative privileges, and an operator account should not be used casually for everyday play.
Private Bedrock server: allow-list
Set allow-list=true and manage the permitted accounts in allowlist.json. Bedrock’s allow-list serves the same membership purpose as Java’s whitelist: authentication proves which account connected, while the list decides whether that account may enter. Apply changes through the server’s supported console or configuration workflow, then verify the result with a test account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When not to use a list
A public community server may intentionally accept any authenticated account. In that case, leave the membership list disabled but still retain online mode, strict operator controls, patching, plugin review, and backups. Do not enable an allow-list or whitelist merely as a substitute for fixing an exposed proxy backend; those controls address different paths.
Isolate Velocity backends from the Internet
Same host: bind the backend locally
If the Velocity proxy and a backend run on the same machine, bind the backend’s listening address to 127.0.0.1. The proxy can reach the local port, while a remote Internet host cannot connect directly to that loopback address. This is usually the simplest arrangement because it avoids an additional tunnel and limits the backend to the host that runs the proxy.
Rank #3
- CREATE YOUR WORLD — Build whatever you imagine in an infinite world that is unique in every playthrough.
- EXPLORE AND CRAFT — Discover biomes, resources, and mobs, then craft your way through a sandbox world full of surprises.
- SURVIVAL ADVENTURES — Face mysterious foes, travel across varied landscapes, and venture into perilous dimensions.
- PLAY TOGETHER — Play solo or join friends in local split-screen and cross-platform play across console, mobile, and PC. Online multiplayer supports up to 8 players.
- COMMUNITY PLAY — Connect with players on community servers, or subscribe to Realms Plus (sold separately) to play with up to 10 friends on a private server.
Separate hosts: firewall or encrypted tunnel
When proxy and backend are on different machines, create an operating-system firewall rule that permits the backend port only from the proxy host’s address. If the network path requires more protection, carry the connection through a properly restricted encrypted tunnel and allow only the tunnel endpoints. Document which addresses and ports are intentional; broad “allow any source” rules defeat the isolation.
Keep forwarding secrets private
Velocity forwarding settings and secrets must match the backend configuration and must not be published in a repository, screenshot, or support message. Rotate a secret if it has been exposed, then update every dependent backend in a planned maintenance window. Modern forwarding helps the backend receive trustworthy player data from the proxy, but it cannot stop an attacker who can reach the backend port directly.
Recommended Free Tools
Why an IP-whitelist plugin is not the primary control
Velocity’s guidance treats IP-whitelist plugins as a last line of defense. A host firewall is stronger because unwanted traffic is rejected before the Minecraft process handles it. A plugin can still be useful as an additional check, but it should not be the only barrier protecting an offline-mode backend.
Run the server with the fewest privileges possible
Operating-system account
Create a dedicated, unprivileged operating-system account for the Minecraft process. Do not run the server as root on Linux or as SYSTEM on Windows unless a narrowly documented requirement leaves no alternative. The service account should own only the directories it needs, such as the server jar, world data, logs, and backups. It should not have permission to alter unrelated applications or system configuration.
Rank #4
- Skins! We have biome settlers, city folk, town folk, and more!
- The Nether and all its inhabitants. Fight Ghasts and make friends with Pigmen
- Cross platform play for up to five players between Pocket Edition and Windows 10
- Revamped touch controls, controller support, and a controller mapping screen
- Enhanced Weather effects! Accumulating snow and more
Administrative Minecraft permissions
Review op-permission-level on Java/Paper and avoid granting operator status when a narrower permission is sufficient. Use a permissions manager such as LuckPerms to assign plugin capabilities by role rather than handing every moderator full operator powers. On Bedrock, review the default player and operator permissions in the server configuration and give administrative status only to named, trusted accounts.
Separate play from administration
- Use a dedicated administrator account for console or high-impact commands.
- Keep credentials out of shared chat, public issue trackers, and launcher screenshots.
- Restrict file-system access to the service account and the small group that maintains the host.
- Protect the management plane—SSH, remote desktop, control panels, and RCON—with their own authentication and firewall rules.
RCON is not magically safe because it is associated with Minecraft. If you enable it, expose it only to a trusted management network, use a strong unique password, and firewall the port. Otherwise leave it disabled.
Patch the whole stack and review every plugin
What belongs in the update cycle
Keep the operating system, Java runtime where applicable, server jar, Velocity proxy, and every plugin or add-on on supported versions. Security fixes in one layer do not protect an outdated layer elsewhere. Subscribe to the maintainers’ release and security notices, and record the version currently running so an emergency rollback is possible.
A controlled update procedure
- Make a verified backup of the world, configuration, and plugin data before changing anything.
- Read the release notes for breaking configuration changes, migration steps, and minimum runtime versions.
- Stage the update on a copy of the server when the world or plugin set is important.
- Stop the live process cleanly, replace the jar or plugin, and start it while watching the console for errors.
- Test authentication, whitelist or allow-list behavior, player movement, permissions, and proxy-to-backend forwarding before reopening access.
- Record the versions and retain the previous files until the new release has operated normally.
Evaluate software before installation
A plugin has the same practical trust level as code running inside your server process. Check who maintains it, what permissions it requests, whether it is still receiving updates, what network destinations it contacts, and whether it modifies player or world data. Remove abandoned or redundant plugins rather than accumulating features you cannot monitor. Secure other services on the same host as well; a vulnerable web panel, database, or file share can become the route into an otherwise well-configured Minecraft process.
Best Value
- Play and share with friends on console, mobile and Windows 10
- discover community creations in the new in-game store
- access new mini games and game modes through servers
Reduce network exposure
Protect the home network
Minecraft Help strongly urges owners not to publish a home network’s public IP as an advertisement, warning that doing so is a security risk to the home network. Prefer a properly secured hosting or network arrangement. If you must host at home, place the server on an isolated network segment where practical, forward only the required game port, and keep router administration off the public Internet.
Free tools Windows power users keep installed
One-click scans. No signup required.
Firewall the management plane
Players need the game endpoint, not your SSH, remote-desktop, database, panel, or RCON ports. Use the host firewall and, where available, the provider’s network firewall to allow the game port and explicitly permitted proxy-to-backend traffic while denying unsolicited management connections. Restrict administration to a trusted source network or private tunnel and review the rule set after every topology change.
Do not confuse hiding with security
Changing a port, obscuring a hostname, or relying on a dynamic DNS address may reduce casual scanning but does not authenticate a player or stop a determined connection. Treat those measures as convenience choices; the controls that matter are account verification, membership restriction, least privilege, patched software, network isolation, and recoverable data.
Build backups that can actually recover the server
What to copy
- All world directories, including player data and dimensions.
server.properties, whitelist or allow-list files, permissions data, and proxy configuration.- Plugin jars plus their configuration and data directories.
- Scripts, service definitions, forwarding configuration, and any documented firewall or tunnel settings needed to rebuild the deployment.
Keep an independent second copy
Paper recommends frequent backups because they let an owner restore after something goes wrong. Keep at least one additional copy outside the failure domain of the live host and its primary account. An external SSD is a practical physical option; choose its capacity and interface for the amount of data your backups actually require. Disconnect or otherwise protect that copy when it is not being updated so ransomware or an account compromise cannot overwrite every version.
Verify restoration, not just file creation
- Schedule backups during a controlled save or stop the server so world files are consistent.
- Give each backup a timestamp and retain enough versions to cover accidental deletion discovered later.
- Periodically restore a copy to a separate test directory or machine.
- Start the restored server privately and confirm that worlds load, player inventories exist, permissions work, and proxy settings are complete.
- Document the restore order and the credentials or keys required, then store that procedure separately from the live host.
Use a deployment checklist before opening the address
- Create the unprivileged service account and place the server files in a directory it owns.
- Set Java or Bedrock online mode to
true, then restart and confirm the effective value. - For a private server, enable Java
white-list=trueandenforce-whitelist=true, or Bedrockallow-list=true; add only intended accounts. - Set a conservative operator policy: review Java
op-permission-level, remove unnecessary operators, and audit Bedrock operator permissions. - For Velocity, expose only the proxy, bind same-host backends to
127.0.0.1, or restrict cross-host traffic to the proxy through firewall rules or an encrypted tunnel. - Keep forwarding secrets private and test that a direct connection to a backend is impossible from an untrusted network.
- Firewall SSH, remote desktop, panels, databases, and RCON separately from the game endpoint.
- Install only reviewed, maintained plugins and record their versions.
- Create a backup, copy it to independent storage, and complete a test restore before inviting players.
Common failures and the fastest diagnosis
| Symptom | Likely cause | Check first |
|---|---|---|
| Players with valid accounts are rejected | Authentication or membership settings were changed, or a whitelist file is invalid. | Read the effective online-mode value, validate the whitelist or allow-list file, and inspect the console for the exact rejection reason. |
| An unapproved player joins a private server | The list is disabled, not enforced, or the player was added unintentionally. | Confirm Java white-list and enforce-whitelist, or Bedrock allow-list, then review the list and operator audit trail. |
| A backend can be reached without the proxy | The backend is listening on a public interface or its firewall rule is too broad. | Test from an outside network, inspect the listening address, and allow only loopback or the proxy host. |
| Players appear under the wrong identity behind Velocity | Forwarding settings or secrets are inconsistent, or the backend is accepting direct offline-mode connections. | Synchronize the proxy/backend forwarding configuration, rotate exposed secrets, and close the direct backend port. |
| A plugin breaks after an update | The plugin is incompatible with the new server or runtime version. | Use the pre-update backup, read the plugin’s compatibility notes, and roll back the single change rather than disabling unrelated security controls. |
| The world cannot be restored | Backups were incomplete, stored on the same host, or never tested. | Compare the backup contents with the required file list and perform a restore from the independent copy in a separate environment. |
How the layers fit together
Online mode answers “Which authenticated account is this?” A whitelist or allow-list answers “Is that account invited?” Operator and plugin permissions answer “What may this trusted player do?” Firewalls and proxy isolation answer “Which process may receive the connection at all?” Patching reduces known software exposure, while independent backups limit the damage when prevention fails. Removing any one layer leaves a distinct path open, so secure operation is the combination rather than a single magic setting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
