Whitelist, ops and permissions

Wispdock’s control panel isn’t built yet. Where a step says “in your control panel”, use whatever your host gives you for files, the console and start/stop. The Minecraft side works the same everywhere.

For finer command access, plan a permissions plugin alongside your plugin server setup rather than granting every helper operator status.

Two lists do most of the work. The whitelist decides who can join. The op list decides who can run admin commands. Both are plain JSON files in the server folder, and both are managed with commands you can type in game (as an op) or in the console in your control panel. In the console, leave out the leading slash.

Add players to the whitelist

Add people before you switch the whitelist on, starting with yourself. Otherwise the first thing the whitelist does is keep you out.

/whitelist add Steve
/whitelist add Alex
/whitelist list

Use each player’s Java username, exactly as spelled. The server looks the name up and stores the account’s UUID next to it in whitelist.json. That means a player who changes their name later stays on the list. It also means the player doesn’t need to have joined before: you can add your whole group in advance.

To take someone off:

/whitelist remove Steve

You can also edit whitelist.json directly. It’s a list of entries like this:

[
  {
    "uuid": "069a79f4-44e9-4726-a5be-fca90e38aaf5",
    "name": "Notch"
  }
]

The UUID is what counts, so copying a name without the right UUID doesn’t work. After editing the file, run /whitelist reload so the running server reads it again. Commands are easier and get the UUID right for you.

Turn the whitelist on

/whitelist on

This also writes white-list=true to server.properties, so the whitelist stays on after a restart. /whitelist off turns it off again and keeps the list, so you can switch back later without re-adding anyone. The server.properties guide covers the file’s other settings.

Players who aren’t on the list see “You are not white-listed on this server!” when they try to join.

Kick players who aren’t on it

Turning the whitelist on doesn’t remove anyone already online. Neither does /whitelist remove on its own, by default. For that, set this in server.properties while the server is stopped:

enforce-whitelist=true

With it on, players who are online but not on the list are kicked whenever the server reloads the whitelist. Without it, they stay until they log out and then can’t get back in. For a friends-only server, turn it on: when you remove someone, you usually want them gone now.

Give op to the people who run the server

/op Steve
/deop Steve

Op status is saved in ops.json. The console always has full access, so you can op yourself from there the first time.

Be stingy with it. An op at the default level can stop the server, change game rules, give themselves anything and op other people. On a server for a group of friends, that’s usually one or two people. Everyone else who needs a specific command should get it through permissions, covered below.

Ops can also join a whitelisted server without being on the whitelist. Add them to it anyway, so they can still get in if you deop them.

Set the right op level

Op comes in four levels. Each includes the ones below it.

The level /op hands out comes from op-permission-level in server.properties, which is 4 by default. The level is written into each person’s entry in ops.json when you op them, so changing the setting later doesn’t change existing ops.

To give one person a different level, stop the server, edit their entry and start it again:

[
  {
    "uuid": "069a79f4-44e9-4726-a5be-fca90e38aaf5",
    "name": "Notch",
    "level": 2,
    "bypassesPlayerLimit": false
  }
]

bypassesPlayerLimit lets that op join even when the server is at max-players. Level 3 is the one to think about: it can op other people, and they get the default level, so a level 3 op can effectively make a level 4 one.

One quirk while you’re here: spawn-protection (16 blocks by default) only applies when at least one op exists. On a server with an empty op list, anyone can build at spawn.

Use LuckPerms for everyone else

On Paper, install LuckPerms and stop handing out op for small jobs. You create groups, give each group only the permissions it needs and put players in them. The plugin install guide covers getting it onto the server.

A moderator group that can kick and ban, but nothing else:

/lp creategroup mod
/lp group mod permission set minecraft.command.kick true
/lp group mod permission set minecraft.command.ban true
/lp user Steve parent add mod

Vanilla commands use nodes of the form minecraft.command.<name>. Plugins list their own nodes in their documentation. Every player is in LuckPerms’ default group, which is the place for things everyone should have, like setting a home if you run a plugin that adds homes.

/lp editor opens a web editor and gives you a link. Once you have more than a couple of groups, it beats typing nodes one at a time.

LuckPerms also runs on Fabric, Forge and NeoForge, though mods differ in how much they check permissions. Plenty of mod commands just check the op level. For other plugins worth running alongside it, see the best Minecraft server plugins.

Bedrock players through Floodgate

If Bedrock players join through Geyser and Floodgate, their names get a prefix so they can’t clash with Java names. It’s a dot by default, so the gamertag Steve shows up as .Steve.

/whitelist add looks names up as Java accounts, so it can’t find a Bedrock gamertag. Floodgate has its own command for that:

/fwhitelist add Steve

For /op, /ban and LuckPerms, use the prefixed name once the player has joined. The Geyser guide covers the setup.

Kicks and bans

/kick Steve Take a break
/ban Steve Griefing spawn
/pardon Steve
/banlist

A kick disconnects the player and they can rejoin straight away. A ban stays until you /pardon them and is saved in banned-players.json. /ban-ip and /pardon-ip work on IP addresses instead and save to banned-ips.json. IP bans are blunt: they also block anyone else on the same connection, like a sibling on the same home network.

On a whitelisted server, removing someone from the whitelist does most of what a ban does. A ban also covers the case where you switch the whitelist off later.

Keep online-mode on

With online-mode=true, the server checks every player against Mojang’s login servers. With online-mode=false it doesn’t check anything, so anyone can join under any name, including an op’s name, and get that op’s powers.

It also breaks your lists. In offline mode, UUIDs are worked out from the name instead of the account, so whitelist and op entries made in online mode don’t match the same players in offline mode, and the other way round.

The one normal reason to turn it off is a proxy such as Velocity, where the proxy checks accounts and passes them to the server behind it. That only stays safe if the server is set up to accept player info from the proxy and can’t be reached directly. If you don’t run a proxy, leave it on.

Wispdock’s draft plans are 4 GB for vanilla and plugins and 8 GB for modpacks. The pricing page has the details; prices are drafts and ordering isn’t open yet.

Still stuck? Send us the details and your latest.log.