Set up a Minecraft whitelistOnly let approved players onto your server

Published on October 20, 2026

Enable the whitelist

The easiest way to enable the whitelist is via the server console in the panel:

whitelist on

Alternatively, set the value white-list=true in server.properties and restart the server. After that, only approved players can get onto the server.

Add and remove players

You maintain players directly via the console:

• whitelist add PlayerName - approve a player
• whitelist remove PlayerName - revoke approval
• whitelist list - show all approved players
• whitelist reload - reload the list after manual editing

Internally, the entries are stored in the file whitelist.json. You can also edit it directly via WebFTP or SFTP - then run whitelist reload.

Whitelist and OPs

By default, operators do not bypass the whitelist automatically - so add yourself to the whitelist as an OP too, or enable the corresponding option. That way, you do not accidentally lock yourself out. How to become OP is explained in our guide Become OP/admin.

For a public server without a whitelist, you protect yourself instead with DDoS protection, anti-cheat plugins and a sensible permissions concept.

Edit whitelist.json directly

The whitelist is stored as a JSON file in the server directory. For individual players, the in-game command is more convenient; for a larger group, the direct route via WebFTP or SFTP is worth it:

[
  {
    "uuid": "069a79f4-44e9-4726-a5be-fca90e38aaf5",
    "name": "Notch"
  }
]

What matters is the UUID, not the name. Minecraft identifies players by this ID - a name change does not change it. This is why an entry stays valid after a rename, while a name entered by hand without a matching UUID does not work.

So add players via /whitelist add where possible - the server then fetches the UUID itself. After direct changes to the file, reload the list with /whitelist reload; a server restart is not necessary.

When the whitelist does not take effect

Four causes cover practically all cases:

1. The whitelist is not active at all. An entry in the list does nothing as long as it is not switched on. These are two separate steps.
2. The server was not reloaded. After changes to the file, /whitelist reload is needed.
3. Wrong spelling. Minecraft names must be copied exactly. A typo leads to an entry that belongs to nobody.
4. Bedrock players on a crossplay server. They carry a prefix in their name, which has to be entered as well - see Set up crossplay.

If you have locked yourself out, you get back in via the server console in the web interface: there, you issue the command without being in the game.

Whitelist, password or open server?

Minecraft has no server password - the whitelist is the only built-in protection. In practice, this results in three modes of operation:

• Whitelist on. The normal case for a fixed group. Nobody gets in whom you do not know - and you practically do not have to worry about griefing.
• Open with protection plugins. For public servers. Then you need a permissions concept and protection against griefing, see Griefing protection.
• Open with applications. A middle way: the whitelist stays on, new players apply via Discord and are added after a brief check. For growing communities, the best compromise between openness and control.

Regardless of that: backups remain your job. They are self-service with us throughout, via WebFTP or SFTP, see Create backups.

Frequently asked questions