Minecraft whitelist and operator levels explained

With the whitelist on, only players on the list can join. Everyone else sees a message that they are not whitelisted. For a server among friends, turn it on before you share the address.

In the panel

1. Open the Players tab.
2. Add each friend's exact Minecraft username to the whitelist.
3. Switch the whitelist on in the whitelist settings.

With commands

whitelist on
whitelist add Sam
whitelist remove Sam
whitelist list

Type these in the Console without a slash, or in the game with a slash if you are an operator.

A new server has no operators, not even its owner. Give yourself op once, from the panel:

1. Open the Console tab while the server runs.
2. Type op followed by your exact Minecraft name, without a slash, and press Enter.
3. The console answers with a line that you were made a server operator. In the game you can now use commands with a slash.

The Operators tab under Players does the same with a field and a button. Either way, it works for your own name and for anyone you trust.

The whitelist is stored in whitelist.json in the top folder of the server. Each entry holds the account ID (UUID) and the name of one player. The ID is what counts: a name typed into the file without the right ID lets nobody in.

So add players with the command or in the Players tab, which look up the ID for you. If you did edit the file, type whitelist reload in the console so the server reads it again without a restart.

Removing someone from the whitelist does not throw them out while they are online. The setting enforce-whitelist=true in server.properties does: with it on, anyone not on the list is removed as soon as the whitelist is reloaded or turned on.

A Bedrock server does the same job under another name. Since 2022 it is called the allowlist: allow-list=true in server.properties switches it on, the names are kept in allowlist.json, and the console commands are allowlist add, allowlist remove and allowlist list. Operators on Bedrock are kept in permissions.json with the roles visitor, member and operator.

On a crossplay server you do not need any of this: the server is Java, so it uses the normal whitelist for Java players and fwhitelist for Bedrock players.

An operator, or op, can use admin commands. Add one in the Players tab under operators, or with op Sam in the console. deop Sam takes it away.

Operators are stored in ops.json, each with a level from 1 to 4. The level decides how far their power goes.

The Bans tab next to it lists banned players and lets you ban or pardon one without a command.

1. Open the Players tab and find the player in the list.
2. Open the menu next to the name and choose Ban player.
3. Type a reason, for example Griefing at spawn.
4. Click Ban player. A player who is online is kicked and cannot connect again until you unban them.

To let them back in, open the Bans tab, open the menu next to the name and choose Unban player.

Each operator is one entry in ops.json with four fields:

There is no command that lists the operators, so this file is the place to check who has op. Change a level or remove an entry with Edit in the Files tab while the server is stopped, then start it again.

New ops get the level set by op-permission-level in server.properties, which is 4 unless you change it. To give someone a lower level, change their level in ops.json in the Files tab and restart, or lower op-permission-level before you op them.

A rule of thumb for a server among friends: keep level 4 for yourself, and give the lowest level that still lets someone do their job.

• A friend who builds at spawn: level 1 is enough, or switch spawn protection off.
• Someone who runs events with teleports, items or weather: level 2. They can also give themselves anything, so pick someone you trust with that.
• A moderator who handles griefers: level 3, or better a rank in a permissions plugin, so they can ban without being able to cheat.
• A co owner who should restart the server or change files: give them access to the panel rather than op, see give someone access to your server.

Op in the game and access to the panel are two separate things. An operator cannot touch files, backups or billing, and a panel user is not an operator in the game until someone ops their Minecraft name.

By default, players who are not ops cannot break or place blocks within 16 blocks of the world spawn. That protects the spawn on public servers but confuses friends on a private one. Set spawn-protection=0 in server.properties to switch it off.

The number in spawn-protection is the distance from the spawn point in each direction. The protected area is a square of twice that number plus one block: the default 16 protects a square of 33 by 33 blocks around spawn, over the full height of the world.

• Without a single operator on the server, spawn protection does nothing: everyone can build at spawn, whatever the setting says.
• It only protects the overworld spawn. The Nether and the End have no spawn protection.
• It only stops breaking and placing blocks and using some blocks. Mobs, explosions and fire still do damage, so on a public server a claim plugin protects spawn better.

Op levels are coarse. A level 2 op can give themselves any item. If you want a helper who can mute and kick but not cheat, use a permissions plugin instead. Set up permissions with LuckPerms walks through it.

Bans are in the Players tab as well, or with ban Sam and pardon Sam. A ban by IP (ban-ip) also catches a second account on the same connection, but it can hit innocent people who share a home connection.

For the last one, Minecraft server maintenance mode shows how to close the server without touching your whitelist. Against griefers on an open server, see stop griefing on your server.