Direct answer

A private Minecraft server still needs authentication, account restrictions and safe network exposure.

Recommended procedure

  1. Keep online-mode=true for a standalone Java server unless a correctly secured proxy setup requires backend offline mode.
  2. Enable and test the whitelist, keep Java and plugins updated from trusted sources, and restrict SSH/panel/RCON credentials.
  3. Expose only necessary Minecraft listeners through the firewall. On Velocity, restrict direct backend access even when using modern forwarding.

Why this matters

Treat console access, operator status, remote-control credentials, and proxy secrets as privileged access. Limit them to people and systems that actually need them.

Important limitation: A whitelist does not defend against a stolen operator account, vulnerable plugin or exposed admin panel.

How to verify the result

  • Attempt a login with an unlisted test account and confirm backend ports cannot be reached directly from outside the trusted network.

Version and compatibility notes

  • When a setting, command, or file name differs from this guide, stop and check the documentation for your exact Minecraft/server-software version instead of forcing an old example.

Official references

These sources were checked for the current MSH revision. Version-sensitive details should always be confirmed against the project documentation for the release you run.

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000