Whitelist, permissions, anti-cheat: securing access to your server
A fully open server always ends up crossing paths with the wrong player at the wrong time. Three layers of protection, independent of each other, cover the essentials without turning your server into an unlivable fortress.
Layer 1 — The whitelist
The whitelist restricts connections to pseudonyms authorized in advance. It's the
simplest and most effective protection for a private or moderately sized community server:
no unknown player can even connect, so there's nothing to moderate for someone who never
got in. Enable it with a single command (/whitelist on) or from the panel.
Layer 2 — Permissions by rank
Once connected, not everyone should be able to do everything. A permissions plugin (LuckPerms is today's standard) lets you create ranks — player, moderator, admin — with precise rights over commands, areas, or game mode. This is what prevents a configuration mistake or a compromised account from granting access to the entire server.
Layer 3 — Anti-cheat
Fly hacks, kill aura, item duplication: an anti-cheat plugin detects behavior that's impossible in normal play and sanctions it automatically (kick, ban, or a simple alert to moderators depending on configuration). Useful even on a small server between friends, where nobody has time to watch for suspicious behavior manually at all times.
What these three layers don't replace
Land protection (see our 5 recommended anti-grief plugins) and regular backups (see backups) remain essential on top: access security prevents problems coming from the outside, but a safety net is still needed for everything else — a game bug, a mistake, or a simple accident.