Keep your Minecraft server private: whitelist and operators

The whitelist

Think of it as a guest list. If a name isn’t on it, the server turns that player away at the door with a short message.

Switch it on from the console, or set white-list to true in server.properties, and then add your people one at a time:

whitelist on
whitelist add FriendName
whitelist list

It lives in whitelist.json. The file keeps each player’s account ID next to their name, so someone who renames their account doesn’t lose their spot.

A second setting, enforce-whitelist, decides what happens to people who are already online. On, and anyone not on the list gets booted at the next reload. Off, and they stay put until they log out.

Why online-mode matters

The whitelist is only as strong as the check behind it. With online-mode switched on, the server asks Mojang’s servers to confirm that each player really owns the account they claim. That is the default.

If you switch online-mode off, anyone can join under any name, including the name of someone on your whitelist or of an operator. At that point the whitelist protects nothing. There are good reasons to switch it off, such as a proxy in front of the server that does the check instead. Fine. But decide it on purpose, and never do it just to dodge a login error.

Operators

Ops are the people who get the big commands. Game modes, teleporting, handing out items, bans, even stopping the server. Hand that list out the way you’d hand out house keys.

op PlayerName
deop PlayerName

ops.json holds them, and each one has a permission level between 1 and 4. The default for a new op is level 4, the top. That is far more than most helpers need.

A good habit is to op nobody for everyday play, including yourself on a public server. Use the console, which always has full power, for admin work.

Permissions for everyone else

Most servers need something in between “can do nothing” and “can do anything”. Plugin servers solve this with a permissions plugin such as LuckPerms, which lets you give a moderator the power to kick and mute without letting them stop the server or change the world.

Vanilla servers don’t have this, which is one reason communities usually move to a plugin server when they grow.

A short checklist

• Whitelist on, with enforce-whitelist on as well.
• online-mode left on unless something else is doing the check.
• Few or no ops, and no op for people you met last week.
• The server address shared only with people you trust.
• A backup, because sooner or later someone with the right access makes a mistake.

In Mineshire the Players tab handles the whitelist and ops with buttons, so you don’t have to remember the commands.

Quick answers

Even if the address only goes to friends, keep the whitelist on. Addresses leak, bots scan for open ports, and the list costs you nothing.

When a friend gets “You are not whitelisted on this server”, add their exact name with whitelist add and check the spelling. One wrong letter means no match.