Random Player Joined Even Though the Minecraft Whitelist Is Enabled

Direct answer

Check `server.properties` for `white-list=true` and verify the account is not returned by `whitelist list`. Keep `online-mode=true` on a standalone server. On a proxy network, secure the offline-mode backend so players cannot connect around the proxy, and check whether a proxy/plugin provides a separate whitelist layer.

What it means

If an unapproved account truly joins a private server, verify that the whitelist itself is enabled and that authentication/proxy routing cannot bypass the protection. `enforce-whitelist` is not a substitute for enabling `white-list`.

If you are a player

• If you are an invited player, send the owner your exact username and the time of the failed/successful join so they can match it to the log.
• Do not share server addresses, account tokens, passwords, or private network details in public troubleshooting posts.
• If you are the unexpected visitor, leave the server unless you have permission to be there.

If you run the server

1. Run `whitelist list` and verify the unexpected account is not actually present under a current or old username/account mapping.
2. Check `server.properties`: `white-list=true` is the switch that enables the whitelist. `enforce-whitelist` controls enforcement behavior but should not be mistaken for the enable switch.
3. For a standalone Java server, keep `online-mode=true` so usernames/UUIDs are authenticated by the normal account system.
4. If the backend is intentionally `online-mode=false` behind Velocity/BungeeCord, make sure it cannot be reached directly from the public internet and that player forwarding is configured correctly.
5. If a plugin or proxy manages access separately, inspect its logs/config so you know which layer admitted the player.
6. After correcting the setting, restart cleanly and test with an account that is definitely not whitelisted.

Important notes

• On proxy networks, an offline-mode backend can be safe only when the proxy/forwarding setup is correct and direct backend access is blocked.
• Test the final configuration with an account that is not allowed so you verify the access control rather than assuming it works.

References

Use the documentation for the exact software and release you run. These sources support the settings or security behavior used in this fix.

• PaperMC: server.properties reference
• PaperMC: Velocity player information forwarding
• PaperMC: Securing Velocity backend servers

Related fixes and guides