How to stop griefing on your Minecraft server

• Whitelist: on a private server, the strongest protection there is. Only names you add can join. See whitelist and operator levels.
• Few operators: every op can undo all your protection. Give op to yourself; give everyone else a group with only the commands they need.
• Online mode on: online-mode=true in server.properties makes sure people are who they say they are. Turning it off lets anyone use any name, including yours.

On a server with more than a handful of players, claims are the answer. A claim is an area only its owner, and people they trust, can change.

With GriefPrevention, players claim land by clicking two corners with a golden shovel, and let friends build with /trust Name. They earn more claim area the longer they play, which rewards regulars and limits newcomers.

Right click the ground with a stick to see the edges of the claims near you. Players who know where a claim ends do not accidentally build half a house outside it.

CoreProtect keeps a diary of the world: who placed or broke which block, who opened which chest and took what, and at what time. When something goes wrong, you roll it back as if it never happened.

1. Install CoreProtect from the catalog in the Plugins tab and restart. It starts logging right away; it cannot see what happened before it was installed.
2. To see who changed a block, type /co inspect and click the block. Type it again to stop.
3. To undo everything one player did in the last day, anywhere: /co rollback u:Name t:1d r:#global.
4. Made a mistake? /co restore with the same options puts it back.

On Fabric, the mod Ledger does the same job with similar commands.

Keep backups as well. CoreProtect undoes the work of a few players; a backup in the Backups tab saves you when something bigger breaks, like a corrupted region.

Every CoreProtect command is built from the same parts: u: for a player, t: for how far back, r: for the radius around you, a: for the kind of action and b: for a block. Some useful combinations:

Give helpers only the lookup side, coreprotect.inspect and coreprotect.lookup, and keep rollbacks for staff you trust. Permissions with LuckPerms shows how to split that.

Not all damage comes from players. In the World tab under Game rules you can switch off:

• Mob griefing: creepers stop blowing holes and endermen stop picking up blocks. Note that villagers also stop farming with it off.
• TNT explodes: TNT no longer blows up builds when someone lights it, by accident or on purpose.

Fire spread is not one of those switches, so lightning and lava can still set wood alight. A protection plugin such as WorldGuard can turn fire spread off inside a region, so lightning and lava no longer burn down wooden builds there. Building with stone around lava helps as well.

Claims are for players. For the spawn, a shop street or an event area, a WorldGuard region is the tool. WorldGuard needs WorldEdit, so install both from the Plugins tab and restart.

1. Type //wand to get the selection tool, a wooden axe.
2. Left click one corner of the area and right click the opposite corner.
3. Type //expand vert so the selection reaches from the bottom of the world to the top.
4. Type /rg define spawn. Players who are not members of the region can no longer build or break there.
5. Add flags as needed, such as /rg flag spawn pvp deny, /rg flag spawn creeper-explosion deny or /rg flag spawn fire-spread deny.

Let builders in with /rg addmember spawn Name. Operators can build in every region by default.

1. Look up who did it with /co inspect or /co lookup u:Name t:2h.
2. Ban them from the Players tab so they cannot come back while you clean up.
3. Roll back their changes with CoreProtect.
4. Check chests: rollbacks also return taken items to their containers.

• X-ray: Paper has its own anti x-ray. Set enabled to true under anticheat and anti-xray in config/paper-world-defaults.yml and restart. Engine mode 1 hides ores behind stone; mode 2 also shows fake ores, which works better but costs more.
• Chest theft: there is no way to stop a trusted player from taking things, but /co inspect on a chest shows who took what and when.
• Fly and speed hacks: an anticheat plugin catches movement that is not possible in the game. On a crossplay server, pick one that knows Bedrock players, such as GrimAC.

Without CoreProtect there is no list of who broke what, but the server log still helps. The logs folder in Files holds a file for every day, with a line for each player who joined and left. Compare the times with when the damage was found, and you usually end up with a short list of names.

The damage itself can then only be fixed by rebuilding or with a backup from before. Install CoreProtect now, so the next time takes minutes.