Security Checklist Before Making a Minecraft Server Public

Direct answer

Before advertising a public IP, verify authentication, network isolation, access controls, backups and a working response plan for abuse or a crash.

Step-by-step procedure

Confirm online-mode=true on a standalone authenticated Java server; if using Velocity, follow its proxy-and-backend authentication/forwarding instructions rather than copying that setting blindly.
Expose only the public listener. Block direct internet access to proxy backends using a firewall or isolated network.
Test a fresh non-OP account: joining, building restrictions, permission boundaries and moderation commands.
Store off-server backups, verify a sample restore, and ensure updates can be rolled back safely.

Common mistakes and trade-offs

Forwarding secrets are a second layer and do not replace a firewall. An allowlist helps private testing but does not harden a publicly advertised network alone.

How to verify it worked

Ask a trusted tester outside your LAN to join by hostname, attempt an incorrect port, and confirm backend addresses are not reachable directly.

Version and platform differences

Bedrock access through Geyser typically adds a UDP port; do not expose RCON or SQL ports publicly.

Official references

These sources were checked for the current MSH revision. Version-sensitive details should always be confirmed against the project documentation for the release you run.

Was this article helpful?

Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.