secure your server

If someone you did not invite got in, anyone who finds the server may be able to join. Secure it first, then check what happened while it was open.

Secure the server

Open your server console, either in your hosting panel or in the window where the server is running. If an unknown player is still online, remove and block that account with ban PlayerName. On an offline-mode server, they can return under a different name, so the authentication step below still matters.

1. Turn on the whitelist

Add your own account first, turn the whitelist on, and then add everyone else who should have access.

# server console
whitelist add YourJavaName
whitelist on
whitelist add FriendJavaName
whitelist list

Replace the examples with each player's Java Edition username. Commands entered in the console do not need a leading slash. To enter them in game, you need operator permission and a leading slash.

2. Check player authentication

A normal Java server should have online-mode=true in server.properties. This verifies that players own the names they use. Without it, someone can impersonate a player on your whitelist.

If the setting is already true, do not change it. If it is false, back up the whole server before changing it. Switching authentication modes changes player identity data, so inventories, whitelist entries, operator status, and plugin permissions may need to be migrated or added again.

Do not change this setting on a backend behind Velocity or BungeeCord. Follow your host's proxy guide instead. The proxy must authenticate players, and a firewall must stop players from connecting to the backend directly. Modern forwarding does not replace that firewall. Paper's Velocity security guide explains how to keep a backend from being reached directly.

If you intentionally allow players without verified Minecraft accounts, use a maintained authentication plugin, keep the whitelist on, and follow your platform's instructions for restricting direct network access.

The console should now say that the whitelist is on and show the names you added. If you have another Java account, you can also confirm that an unlisted account is refused.

Check what happened

Keep the whitelist on while you check the server. If blocks or items are missing, stop the server before repairing anything and save a copy of its whole directory, including the world, configuration, and logs. If your host has a snapshot tool, you can use that instead. The logs can show when a player joined and which name they used, and may record commands or plugin activity. In offline mode, that name does not identify the person who used it.

If you have a clean backup, restore one from before the damage. Check ops.json for unfamiliar operators too, and use deop PlayerName to remove one. Servers with permissions plugins may keep their staff access somewhere else, so review that plugin's users and groups as well.

How the server was found

Your server does not have to be advertised to be found. Anyone can scan public internet addresses for ports used by Minecraft. What Lucky scanning looks like explains the status traffic, where it comes from, and how to identify it.

Our bot joins as LuckySystems, posts the warning, and disconnects. It does not break or place blocks, take items, or run commands.

You do not need to pay us, share a password, grant operator permissions, give us access to an account, or install anything.

Anyone asking for those things is not from Lucky. If you are unsure whether a message came from us, email contact@lucky.systems.