Securing your Minecraft server (and keeping it online)

A Minecraft server that crashes on a Saturday night loses its players within a week. Stability isn't luck: it's a checklist. Here's the one we recommend.

• Enable the whitelist and online mode while the community is being built.
• Set -Xms and -Xmx to the same value, and prefer Paper or Purpur over the vanilla server.
• Back up the world at least every 6 hours and test the restore every month.
• Choose hosting with permanent anti-DDoS protection.

Lock down access from day one

An open server attracts bots and griefers before your friends even arrive. Enable the whitelist while your community is growing, tie accounts to online mode (online-mode), and give operator rights to just one trusted person.

• Enable the whitelist and online mode to prevent fake accounts.
• Limit operators and log every sensitive command.
• Change the default port and filter external ping where possible.

Sizing Java like a pro

Minecraft runs on Java, and a poorly tuned JVM causes lag. Allocate RAM with -Xms equal to -Xmx to avoid garbage collector stutters, choose a modern garbage collector (G1GC or ZGC), and don't overload the server with plugins: each plugin is a permanent CPU cost.

• Set -Xms and -Xmx to the same value (e.g. 4G for 20 modded players).
• Use Paper or Purpur instead of the vanilla server for better performance.
• Audit your plugins: a single poorly written plugin can halve your TPS.

Back up your world, automatically

A Minecraft world represents hundreds of hours of building. Schedule backups of the world folder at least every 6 hours, keep them off the server and test a restore once a month. The golden rule: an untested backup doesn't exist.

• Automate backups of the world and player data.
• Keep at least 7 days of history off the server.
• Test the restore on a test server before game day.
• Apply the 3-2-1 backup rule to the world folder.

Standing up to attacks and spikes

DDoS attacks on game servers have become commonplace, often launched by a banned player with a €5 stresser. A host with always-on DDoS mitigation makes the difference between a ruined evening and an invisible incident. To host your server with anti-DDoS protection included, see the ACLClouds Minecraft plans.

• Choose hosting with permanent DDoS protection.
• Monitor TPS and RAM with a monitoring plugin.
• Plan a clean restart procedure in case of a crash (script + alerts).
• Before choosing a host, read what a free Minecraft server allows.