Protect your Minecraft server against griefingPrevent, log, restore

Published on October 20, 2026

Level 1: Who gets in at all?

The most effective protection is the one where the griefer never gets onto the server in the first place. Two built-in tools without any plugin:

• Whitelist - only listed names get in. For a group of friends, the simplest and best solution, see Set up a whitelist.
• online-mode=true - the default setting verifies players against Mojang authentication. If you switch it off, you open the server to any name; a banned player then comes back under a new name.

Both values are in server.properties. For a public server, the whitelist is naturally not an option - then levels 2 and 3 apply.

Level 2: Logging

On a public server, the decisive question is not "if", but "who and when". That is what logging plugins are for - CoreProtect is the common standard on Paper servers.

Such a plugin records who placed or broke which block, opened which chest and started which fire. This lets you trace exactly what happened afterwards.

• Inspect: click a block with a tool and see its history.
• Search: list all actions of a player in a time period.
• Roll back: undo a player's actions in the affected area.

Important: a logging plugin only works from the moment it is installed. It belongs on a community server before something happens - afterwards, it is worthless.

Level 3: Protect areas

Instead of repairing damage, you can prevent it. Area protection plugins define regions in which only authorized players may build.

• Protect the spawn area - the single most important measure on any public server.
• Player claims that players claim themselves and can share with friends.
• Global rules - such as switching off fire spread and explosion damage.

The last two points can partly be covered even without a plugin: with the game rules mob_griefing and fire_spread_radius_around_player, you switch off mob destruction and fire spread via /gamerule directly in vanilla. This takes away a large part of the destructive potential of creepers and fire.

What vanilla already brings

Before you install plugins - these built-in tools take effect immediately:

/gamerule mob_griefing false                    // creepers and endermen change nothing
/gamerule fire_spread_radius_around_player 0    // fire does not spread
/gamerule keep_inventory true                   // defuses revenge campaigns after death

These names apply from Java Edition 1.21.11 - since then, all game rules use snake_case, and the former rule doFireTick has been replaced by fire_spread_radius_around_player (0 = no spread). On older versions and in the Bedrock Edition, they are still called mobGriefing, doFireTick and keepInventory.

On top of that come the classic administration commands: /ban, /ban-ip and /kick. They require operator rights, see Become OP & admin rights.

A note on OP: grant it sparingly. An operator can do everything - including destroying everything. On community servers, a permissions plugin with finely graded roles is a much safer choice than OP for several people.

If it has happened anyway

1. Stop the server or ban the culprit so that no further damage is done.
2. Evaluate the log, if one is running - determine scope and time period.
3. Roll back selectively instead of restoring the whole world.
4. Only if nothing else helps: restore a backup - but then everyone else's progress since the backup is lost too.

This is exactly why the combination of logging and regular backups is so valuable: it allows a surgical intervention instead of a full rollback. Backups are self-service with us, see Create backups.

Frequently asked questions