Whitelist and operator levels explained

The whitelist

With the whitelist on, only players on the list can join. Everyone else sees a message that they are not whitelisted. For a server among friends, turn it on before you share the address.

In the panel

1. Open the Players tab.
2. Add each friend's exact Minecraft username to the whitelist.
3. Switch the whitelist on in the whitelist settings.

With commands

whitelist on
whitelist add Sam
whitelist remove Sam
whitelist list

Type these in the Console without a slash, or in the game with a slash if you are an operator.

Kick people who are no longer on the list

Removing someone from the whitelist does not throw them out while they are online. The setting enforce-whitelist=true in server.properties does: with it on, anyone not on the list is removed as soon as the whitelist is reloaded or turned on.

Operators

An operator, or op, can use admin commands. Add one in the Players tab under operators, or with op Sam in the console. deop Sam takes it away.

Operators are stored in ops.json, each with a level from 1 to 4. The level decides how far their power goes.

The four levels

New ops get the level set by op-permission-level in server.properties, which is 4 unless you change it. To give someone a lower level, change their level in ops.json in the Files tab and restart, or lower op-permission-level before you op them.

Spawn protection

By default, players who are not ops cannot break or place blocks within 16 blocks of the world spawn. That protects the spawn on public servers but confuses friends on a private one. Set spawn-protection=0 in server.properties to switch it off.

When the built in tools are not enough

Op levels are coarse. A level 2 op can give themselves any item. If you want a helper who can mute and kick but not cheat, use a permissions plugin instead. Set up permissions with LuckPerms walks through it.

Bans are in the Players tab as well, or with ban Sam and pardon Sam. A ban by IP (ban-ip) also catches a second account on the same connection, but it can hit innocent people who share a home connection.