CoreProtect: find out who did it, and roll it back

Inspect blocks, look up what a player changed, roll back griefing in one command, and keep the database from filling your disk.

By the Cobbly team · Updated October 14, 2026

Sooner or later someone breaks something they should not have. CoreProtect records every block placed and broken, every chest opened and every item taken, and can undo any of it for one player, one area or one time window — without rolling back everything else that happened since. On any server where people you do not know well can build, it is the most useful plugin you can install.

CoreProtect runs on Paper, Purpur and Spigot. On Fabric, Ledger does the same job with similar commands.

Install

Upload the CoreProtect jar to the plugins folder and restart. Make sure the version you download supports your Minecraft version — CoreProtect hooks deeply into the game, and an old build on a new server will not load. It starts logging immediately; nothing that happened before you installed it can be looked up or rolled back.

All commands start with /co (or /coreprotect). Operators can use everything; give moderators coreprotect.inspect and coreprotect.lookup through your permissions plugin (see LuckPerms for beginners), and keep rollback for admins.

Inspect a block

/co i toggles inspector mode. While it is on:

Left-click a block to see who placed or broke it, and when.
Right-click a block face to see what happened at the spot next to it — useful for a block that is no longer there.
Right-click a chest to see who put in or took out what.

Type /co i again to turn it off. This is the fastest way to answer “who broke my wall?”.

Look things up

Lookups use parameters, in any order:

u: — user. u:Steve, or several: u:Steve,Alex.
t: — time back from now. t:30m, t:2h, t:3d, or combined: t:1d6h.
r: — radius around you, in blocks. r:20. r:#global for the whole server, r:#world_nether for one world.
a: — action. a:block (placed and broken), a:-block (broken only), a:+block (placed only), a:container, a:-container (items taken), a:chat, a:command, a:kill, a:session (logins).
i: and e: — include or exclude block types. i:diamond_block, e:stone,dirt.

Examples:

/co lookup u:Steve t:2h r:30 — everything Steve did nearby in the last two hours.
/co lookup a:-container t:1d r:10 — who took items from containers near you today.
/co lookup a:chat u:Steve t:1h — what Steve said.

Results come in pages; /co lookup 2 shows the next one.

Roll back griefing

A rollback takes the same parameters and undoes everything that matches. The usual griefing fix:

/co rollback u:Griefer t:3h r:#global

That reverses every block the player placed or broke, and every item they took from containers, in the last three hours, everywhere. Changes by anyone else are untouched. Narrow it when you can — a radius and a time window that just cover the damage are safer than global.

To check before committing, add #preview: /co rollback u:Griefer t:3h r:50 #preview shows the result to you alone. /co cancel throws the preview away; run it again without #preview to apply it.

/co restore with the same parameters puts back what a rollback removed, and /co undo reverses the last rollback or restore you ran. If you rolled back too much, either one fixes it.

What it cannot undo

Anything before it was installed. Install it before you need it.
Items carried away. A rollback puts items back in the chest; it does not take them out of the griefer’s inventory. Clear that yourself, or ban them before they log off.
Some entities. Blocks and containers roll back reliably. Animals that were killed, and item frames and armour stands, are less certain — check the results.
World edits from outside the game. A world upload or reset is not a player action.

For those cases, a backup is the safety net. CoreProtect is for surgical fixes; backups are for “put everything back”.

Keep the database small

CoreProtect logs everything, and on an active server the database grows by tens of megabytes a week. It lives in plugins/CoreProtect/ and counts against your storage. Purge old data now and then:

/co purge t:30d — deletes every record older than 30 days. Griefing is almost always noticed within a few days, so a month of history is plenty for a small server.

Purging from the console is allowed while players are online, but it is heavy; run it when the server is quiet.

Make it part of your routine

The pattern most small servers settle into: inspect with /co i when someone reports damage, look up the player to see how far it goes, roll it back with a radius and time window, and ban if it was deliberate. The rest of the anti-griefing toolkit is in How to stop griefing on your Minecraft server.