How to stop griefing on your Minecraft server

Griefing — someone breaking, stealing or burning what other players built — is the fastest way to kill a server. Players who lose a week of work rarely come back. No single setting prevents it; what works is a few layers, each covering what the others miss. This guide goes through them in the order that matters most for a small server.

1. Control who can join

The cheapest protection is not letting griefers in. For a server of friends, turn on the whitelist so only names you add can join. It is the one setting that prevents almost every problem below. See Controlling who can join.

Keep online-mode=true in server.properties. With online mode off, anyone can join using anyone’s name — including yours — and the whitelist only checks the name. Minecraft server offline mode explains the risk.

If the server is public, consider an application step: new players join a Discord, read the rules and ask to be whitelisted. It filters out nearly everyone who joins just to break things.

2. Do not hand out operator

An operator can do anything: change game mode, spawn items, teleport anywhere, and run commands that wipe areas. Giving a friend op so they can use one command is how many servers get destroyed — sometimes by the friend, often by someone who got into the friend’s account. Use a permissions plugin and give exactly the commands people need. See LuckPerms for beginners.

3. Protect builds with claims

A land-claim plugin lets players protect their own bases: nobody else can build, break or open chests inside. On Paper, GriefPrevention is the most common — players draw a claim with a golden shovel. On modded servers, Open Parties and Claims or FTB Chunks claim by chunk from a map. See GriefPrevention: land claims players set up themselves.

For shared areas — spawn, a market, a nether hub — admins can make an admin claim, or use WorldGuard regions: select the area with the WorldEdit wand (//wand), then /rg define spawn. Non-members can no longer build there, and flags like /rg flag spawn pvp deny or /rg flag spawn creeper-explosion deny fine-tune it.

Without plugins, spawn-protection in server.properties stops non-operators building within a radius of world spawn (16 blocks by default). It is blunt, but it is better than nothing on a Vanilla server.

4. Log everything

Claims prevent; logging lets you fix what slipped through. CoreProtect (Paper) or Ledger (Fabric) records every block and container change, so you can see who did what and roll back exactly that player’s actions — without undoing anyone else’s work. Install it before you need it: nothing from before it was installed can be rolled back. See CoreProtect: find out who did it, and roll it back.

5. Keep backups

Backups are the last line. A rollback plugin handles one griefer; a backup handles everything else — a broken plugin, a world corrupted by a crash, or griefing nobody noticed for a week. Keep automatic backups on and take a manual one before any big change. See How backups work.

Griefing you might not expect

• Lava and fire — often from outside a claim. Claims block flow across their edges; gamerule doFireTick false stops fire spreading anywhere.
• TNT and creepers near builds — admin regions or claims can block explosions; mobGriefing false also works but breaks villager and sheep farms. See Minecraft game rules.
• Killing pets and villagers — claims protect animals inside them. Logging plugins record kills.
• Lag machines — redstone clocks or item spam built to slow the server down. Logging shows who built it; Entity lag shows how to find it.
• Waking a sleeping server — on Cobbly, a stranger who knows your address could join to wake it. The whitelist is checked before waking, so a whitelisted server cannot be woken by people who are not on it.

When it happens anyway

1. Do not panic and do not restore straight away. A restore also undoes everything everyone else did since the backup.
2. Find out who did it — CoreProtect’s inspector, or ask what was seen.
3. Ban them: ban Name Griefing in the console. If you think they might return on another account, ban-ip Name as well — it can also hit innocent players on the same network, so use it carefully.
4. Roll back that player’s changes with CoreProtect.
5. Only if the damage cannot be rolled back, restore a backup — and tell everyone what will be lost before you do.

Then look at which layer they got through — usually an open whitelist or an op given too freely — and close it.