Direct answer

Check the exact disconnect message and the value of enforce-secure-profile before changing security settings. Proxy or client compatibility should be fixed at the correct layer instead of disabling the check blindly.

What it means

Servers can require Mojang-signed profile keys; clients or proxy setups that do not provide what the server expects can be rejected.

If you are a player

  • Copy the exact connection/kick message and note the timestamp; similar-looking login errors can have different causes.
  • Check the address, port, Minecraft version, and whether other players can connect at the same time.
  • Tell the owner whether the problem follows your account/device/network or affects everyone.

If you run the server

Targeted diagnosis: Treat secure-profile errors as a profile/chat-signature policy mismatch; distinguish them from failed account verification or proxy connection failures. Record the Minecraft version and the precise disconnect line before changing enforcement.

  1. Confirm whether enforce-secure-profile is enabled in server.properties; Paper documents the current default as true.
  2. If the server is behind a proxy, verify the proxy and backend are using a supported forwarding setup before changing profile-security settings.
  3. Reproduce the kick and compare the backend and proxy logs at the same timestamp. Keep the exact disconnect text because different authentication and profile failures can look similar to players.
  4. Only change enforce-secure-profile if you understand the security/compatibility trade-off and actually intend to change that server policy.

Fix and verify: Confirm that your proxy/server software supports the relevant signed-chat/profile behavior for those versions. If adjusting enforce-secure-profile, explain and test the security consequences rather than treating the flag as a harmless universal fix.

References

References used to verify the settings and troubleshooting steps in this fix.

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000