A Minecraft server does not need to be famous to get hit. Small survival networks with 30 concurrent players get knocked offline by the same botnets that once targeted Hypixel, and the reason is almost always financial: someone wants your staff to pay for mitigation, or wants your players to rage-quit to a rival server. Add in a wave of 2025-2026 CVEs against RCON tools and popular plugins, plus a steady drip of malware hidden inside cracked plugin downloads, and “just host it and hope” stopped being a viable security posture a long time ago. This tutorial walks through hardening a Minecraft server end to end, using TCPShield as the anti-DDoS layer, then locking down RCON, permissions, plugins, and backups so a single leaked IP or a bad plugin update cannot take the whole thing down. The same layered thinking underpins most of our cybersecurity coverage: assume any single control will eventually fail, and design so that failure is survivable.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Why Minecraft Servers Are Under Attack in 2026
Minecraft’s networking stack was never designed with today’s botnet scale in mind, and the numbers from the last two years show it. Global Secure Layer documented what it called the largest DDoS attack ever recorded against a game server: a “carpet bombing” campaign that hit a Minecraft server with 3.15 billion packets per second, with traffic originating from Russia and 17 other countries. Cloudflare’s own 2025 report puts network-layer DDoS attacks at 34.4 million for the year, roughly triple the prior year’s volume, out of 47.1 million total DDoS attacks Cloudflare mitigated across all traffic types. Krebs on Security reported in October 2025 that a botnet dubbed Aisuru was blanketing US internet service providers with record-setting DDoS traffic, and several of the affected ISPs serve residential gaming communities, meaning Minecraft players and hosts absorb collateral damage even when they are not the direct target.
The attacks are not limited to raw bandwidth floods, either. Minecraft-specific botnets like MCCrash were built to send crafted packets that abuse the Minecraft protocol itself rather than simply flooding a pipe, targeting private servers running versions from 1.7.2 through 1.18.2 in Microsoft’s original research, and security teams still reference the technique because newer variants keep resurfacing against unpatched server versions years later. Layered on top of that is a fresh batch of vulnerabilities discovered in 2025 and 2026: a plaintext password bug in a popular RCON tool, a remote code execution flaw in a widely used mod, and a privilege escalation bug in an auction plugin that let players duplicate items. None of these require a nation-state attacker. A bored teenager with a booter subscription and a Discord grudge is enough, which is exactly why baseline hardening matters more for a 40-player server than it does for a data center that already has a security team.
This is not a new phenomenon so much as an escalating one. Hypixel, still the largest Minecraft server network by player count, shut down for emergency maintenance back in June 2021 after a large-scale DDoS attack, an incident later linked by security researchers to a Mirai botnet operator who reportedly bragged about being paid to knock the network offline over a server dispute. Five years on, the attack surface has only grown: more servers accept crossplay traffic, more communities run a companion website alongside the game server, and more admins install third-party plugins without a formal review process. Every one of those additions is a door, and gcore’s research into the motivations behind Minecraft DDoS campaigns notes that financial extortion, both from staff and from rival server operators, remains the leading driver behind why bad actors specifically target Minecraft infrastructure over other game genres.
Prerequisites: Software, Versions, and Accounts You Need
This guide assumes you already have a Minecraft server running, or are close to launching one, on a Linux VPS or dedicated box. You do not need root-level networking expertise, but you do need shell access and the patience to edit a handful of config files carefully. Here is what to have ready before you start.
| Component | Minimum version (Sept 2026) | Notes |
|---|---|---|
| Minecraft Java Edition | 26.2 (released June 16, 2026) | Requires Java 25 or newer to run server-side |
| PaperMC | Paper 26.2, build 123 or later | Published September 9, 2026; use the latest build for your Minecraft version |
| Velocity proxy | 4.1.1-24 (stable) | Released August 26, 2026; avoid the 4.1.2-SNAPSHOT preview on production |
| Java runtime | OpenJDK 25 LTS | Required by Minecraft 26.2 server binaries |
| OS-level firewall | ufw or iptables/nftables | Any current Debian, Ubuntu, or Rocky Linux release works |
| TCPShield account | Free tier or paid | Free tier covers roughly 20-30 concurrent players |
| Permissions plugin | LuckPerms (latest) | Replaces global OP with granular ranks |
You will also want a domain name you control (so you can point DNS at TCPShield’s edge network), SSH access with key-based login already working, and a second machine or cloud storage bucket for off-server backups. If you are running a proxy setup with Velocity or BungeeCord in front of one or more Paper backends, keep the IP addresses and internal hostnames of every backend server handy, since you will be editing config on each one. If your server currently runs on a managed panel like Pterodactyl, most of the firewall guidance in this tutorial still applies at the host level, though you will want to check your panel’s own network isolation settings before assuming ports are closed by default.
Finally, this guide focuses specifically on the Minecraft server layer. If your admin team’s own accounts, Discord, email, or the control panel login itself are not protected with strong two-factor authentication, fix that first; a hardened Minecraft server behind a compromised admin account is still a compromised server. General account security practices, the kind covered in a Steam Guard and Discord 2FA setup guide, apply just as much to your hosting provider login and your Velocity secret storage as they do to a gaming account.
Step 1: Patch Your Server Stack First
Before touching any DDoS proxy or firewall rule, get every piece of software current. This sounds obvious, but it is the step people skip because it means downtime, and downtime feels worse than an attack that has not happened yet. In September 2026 that means Minecraft Java 26.2 with the matching Paper 26.2 build (build 123 or newer, published September 9, 2026), Velocity 4.1.1-24 if you run a proxy network, and OpenJDK 25, which 26.2 requires server-side. Do not run the 26.3 Pre-Release 2 test build (dated September 4, 2026) in production. Pre-releases exist to catch bugs, not to host your player base.
Patching matters here because several of the vulnerabilities covered later in this guide, including the Integrated Scripting remote code execution bug tracked as CVE-2025-27107, only affect specific version ranges of a mod or plugin, and the fix is simply upgrading past the vulnerable build. If you are still running anything from the 1.20 or 1.21 line for compatibility reasons, check every mod and plugin’s changelog against the National Vulnerability Database before you assume you are safe just because “it still works.” A server that has not been restarted in three months to apply updates is a server running with known, published exploits.
Step 2: Compare TCPShield, NeoProtect, MineGuard, and OVH Game
Before you sign up for anything, understand what kind of protection you are buying. Minecraft-specific proxy networks like TCPShield, NeoProtect, and MineGuard sit in front of your server and absorb attack traffic at the edge, hiding your real IP address so attackers cannot bypass the shield by hitting your host directly. Host-level protection, like OVH’s Game anti-DDoS profiles, is bundled into the price of a dedicated server but only works if that server is hosted with OVH, and it stops protecting you the moment you migrate elsewhere. Generic Layer 4 providers, such as reseller VPS plans built on Path.net’s network, offer strong raw mitigation but were not built with Minecraft’s protocol quirks in mind the way a purpose-built proxy is.
| Provider | Free tier | Cheapest paid plan | Top plan | Best for |
|---|---|---|---|---|
| TCPShield | 1 TB/month, 1 network, 3 domains | Pro, $25/month, 5 TB | Enterprise, $250/month, unlimited bandwidth | Java servers needing a Minecraft-native proxy |
| NeoProtect GameShield | Basic, permanently free, 1 TB, 2 domains, ~20 players | Universal, €15/month, 3 TB | Company, €90/month, unlimited backends | Networks that also need Bedrock backend support |
| MineGuard | Free forever, 1 TB, basic L3/L4 | Basic, ~390 RUB/month (roughly $4-5) | Professional, ~8,600 RUB/month, ML filtering | Budget-focused operators comfortable with a Moscow-region PoP |
| OVH Game | Bundled free with Game dedicated servers | Included in server price, roughly €50-60/month | N/A, tied to server tier | Operators willing to host exclusively on OVH hardware |
For most small-to-midsize survival, SMP, or minigame servers, TCPShield’s free tier is the sane starting point: it covers roughly 20-30 concurrent players on 1 TB of monthly traffic, which is more than enough headroom before you would need the $25/month Pro plan’s 5 TB allowance. If your server regularly clears 100 concurrent players, budget for Premium at $100/month, which is where TCPShield’s unlimited bandwidth kicks in, since metered plans can throttle or interrupt service if you blow through the cap during a sustained attack. If you are also weighing enterprise-scale mitigation providers for a larger network, our breakdown of Cloudflare, AWS Shield, and Akamai’s DDoS protection tiers covers pricing at a scale well beyond what a single Minecraft community typically needs, but it is useful context if your network also runs a web store or API alongside the game servers.
Step 3: Set Up TCPShield and Point Your Domain
Create a free account at tcpshield.com and add a new network from the dashboard. TCPShield will give you a set of edge hostnames or an anycast IP to point your domain’s DNS A record and SRV record at. This is the step that actually hides your server: once DNS resolves to TCPShield’s edge instead of your host’s IP, attackers who scan your domain never see your real address, only find the shield. If your domain currently points straight at your host, change the A record now, and expect DNS propagation to take anywhere from a few minutes to a few hours depending on your registrar’s TTL settings.
Add up to three domains on the free plan, which is plenty if you are only running a single network with a vanity domain and maybe a backup or test domain. Under the hood, TCPShield operates an anycast network: incoming connections land at whichever edge point is geographically closest to the player, and TCPShield’s infrastructure absorbs SYN floods, UDP reflection attacks, and other network-layer garbage before forwarding only clean traffic on to your backend.
Step 4: Install the TCPShield Plugin for IP Masking
DNS pointing at TCPShield only helps if your server also refuses connections that did not come through the shield. Download the official TCPShield plugin from your dashboard and drop it into your proxy’s (or standalone server’s) plugins folder. The plugin authorizes only connections that originate from TCPShield’s known IP ranges, which closes the obvious bypass where an attacker who already knows your old IP just keeps hammering it directly, ignoring your shiny new DNS record entirely.
# On your Velocity or Paper server, install the plugin and restart:
cd /opt/minecraft/plugins
wget https://tcpshield.com/download/plugin/latest.jar -O TCPShield.jar
systemctl restart minecraft-proxy
# Check the plugin logged a successful handshake:
tail -f /opt/minecraft/logs/latest.log | grep -i tcpshieldA successful install produces a log line similar to this the first time a real player connects through the shield:
[TCPShield] Verified connection from TCPShield edge node (proxy-fra-03)
[TCPShield] Real client IP forwarded via Proxy Protocol v2: 203.0.113.44
[Velocity] Player Notch (203.0.113.44) connected successfullyIf instead you see connection attempts logged from IPs that are not TCPShield edge nodes, and they are getting through, your firewall is still exposing the backend directly and step 6 below has not been applied yet.
Step 5: Configure Velocity’s Forwarding Secret
If you run a proxy network rather than a single standalone server, Velocity needs to prove to each backend that player data (username, UUID, real IP) is authentic and has not been forged by someone connecting directly to the backend and lying about who they are. This is what modern forwarding with a shared secret solves. Velocity generates a forwarding.secret file the first time it starts. That file is effectively an HMAC key: anyone who has it can impersonate any player on your network, so treat it the way you would treat a database root password. Never commit it to a public repository and never paste it into a support ticket.
# velocity.toml
[servers]
lobby = "10.0.0.11:25566"
survival = "10.0.0.12:25566"
player-info-forwarding-mode = "modern"
forwarding-secret-file = "forwarding.secret"Full technical detail on modern forwarding, including how the signature is verified, is documented in PaperMC’s official Velocity documentation. Note the internal, private IP addresses in the config above: backends should never be assigned a public-facing address once a proxy sits in front of them, which brings us to the next two steps.
Step 6: Lock Down Paper’s Proxy Config and Firewall
Every backend Paper server needs to know it is sitting behind Velocity and trust the same secret. Open config/paper-global.yml on each backend and set the proxy block to match:
proxies:
velocity:
enabled: true
online-mode: true
secret: "paste-the-exact-secret-from-forwarding.secret"Guides on this configuration are explicit on one point: a forwarding secret is not a substitute for a firewall, it only stops forged player data. It does nothing to stop someone from connecting directly to the backend’s port and sending garbage packets at it. Close that door with OS-level firewall rules that only allow traffic from your proxy’s internal IP and your own admin IP for SSH:
# ufw example on the Paper backend
ufw default deny incoming
ufw allow from 10.0.0.5 to any port 25566 proto tcp # proxy only, not the public internet
ufw allow from 203.0.113.50 to any port 22 proto tcp # admin SSH from one known IP
ufw enableIf your Paper backends are on the same cloud provider as your proxy, use the provider’s internal/private networking instead of the public internet for the proxy-to-backend hop entirely; that way port 25566 never needs to be reachable from outside your VPC at all, and a misconfigured firewall rule cannot accidentally expose it.
Step 7: Fix RCON Before It Fixes You
RCON (Remote Console) lets you run admin commands over the network without a game client, which makes it enormously convenient and enormously dangerous if the password leaks. In October 2025, security researchers disclosed CVE-2025-61680, affecting the “Minecraft RCON Terminal” VS Code extension. Versions 0.1.0 through 2.0.6 stored the RCON password in plaintext inside the extension’s settings.json file, meaning anyone with local file access, or access to a synced settings backup, could read the password straight out and take full admin control of the server. The fix landed in version 2.1.0, which migrates storage to VS Code’s encrypted SecretStorage API.
If you or anyone on your admin team used that extension, upgrade it immediately, then rotate the RCON password regardless of which tool you use to connect, since a plaintext copy may already be sitting in a git history, a Dropbox sync folder, or a Discord DM from months ago. Beyond the specific CVE, treat RCON the same way you treat SSH: bind it to localhost or your internal network only, never expose port 25575 to the public internet, and set a long randomly generated password rather than something reused from another service.
# server.properties
enable-rcon=true
rcon.port=25575
rcon.password=REPLACE-WITH-A-32-CHAR-RANDOM-STRING
# Then firewall it exactly like SSH: internal or single-admin-IP only
ufw allow from 10.0.0.5 to any port 25575 proto tcp
ufw deny 25575Step 8: Replace OP With LuckPerms and Enforce a Whitelist
Global operator status is an all-or-nothing switch: one compromised staff account with OP can grief the entire map, spawn unlimited items, or ban every other player. Replace it with a permissions plugin like LuckPerms and hand out only the specific commands each rank actually needs.
/lp creategroup moderator
/lp group moderator permission set minecraft.command.kick true
/lp group moderator permission set minecraft.command.mute true
/lp user Notch parent add moderator
/lp user Notch parent remove defaultPair granular permissions with a whitelist for any server that is not explicitly meant to be open to the public. Set white-list=true and enforce-whitelist=true in server.properties, then manage entries directly:
/whitelist add Notch
/whitelist reload
/whitelist list
# Output:
# There are 47 whitelisted players: Notch, jeb_, Dinnerbone, ...Also leave online-mode=true unless you have a specific, well-understood reason to disable it. Offline mode skips Mojang’s account verification entirely, which means anyone can log in under any username they type, including impersonating your own staff. If you must run offline mode for a proxy setup with custom auth, deploy an authentication plugin such as AuthMe Reloaded to require a password on login, and understand that this is strictly weaker than online-mode verification.
Step 9: Vet Every Plugin and Scan for Malware
Plugins and mods are the most consistently abused supply chain in the Minecraft ecosystem. Bitdefender’s research documented the Fractureiser campaign, a multi-stage infostealer distributed through compromised developer accounts on CurseForge and Bukkit. Attackers pushed malware-laced updates to previously legitimate mods and plugins, and the “Better Minecraft” modpack alone, which bundled several affected mods, had racked up more than 4.6 million downloads by the time the compromise was discovered. This was not a shady, unofficial site; it happened on platforms most server owners already trusted by default.
The PaperMC team’s own malware announcement thread describes a related pattern: compromised Spigot plugin-author accounts distributing JARs that quietly drop a file called plugin-config.bin alongside the plugin, then install a persistent system service outside of Minecraft entirely, one that a plugin removal alone will not clean up. If you find that file anywhere in your plugins directory, PaperMC’s guidance is blunt: assume the whole machine is compromised and reinstall the OS rather than trying to surgically remove the infection.
Reduce this risk with a short checklist applied to every plugin before it touches a production server: install only from SpigotMC, Modrinth, Hangar, or Polymart, never from a “cracked” or unofficial reupload site; check the developer’s account age and download history for anything that looks freshly created; run new JARs through a scanner such as Spigot Anti-Malware or PluginScan before deployment; and treat every plugin update, not just first installs, as a fresh event worth a quick look at the changelog. Even reputable platforms have had multi-month clean streaks broken by a single compromised account, so “it’s from Modrinth” is a good sign, not a guarantee.
Two more recent, narrower bugs worth knowing about if you run the affected software: CVE-2025-27107 is a remote code execution flaw in the Integrated Scripting mod, where a player with access to a Variable Card could abuse Java reflection to escape the scripting sandbox and execute arbitrary native code on the server; it is fixed in build 1.21.1-1.0.17 and equivalent patched versions for 1.21.4, 1.20.1, and 1.19.2. And CVE-2026-55624 is a privilege escalation bug in the MintyItanium Lost-Auction plugin that let players obtain restricted items and duplicate items through GUI manipulation, fixed in a specific patched commit. Neither is exotic to exploit once known, which is exactly why staying current on plugin advisories matters as much as staying current on Minecraft itself.
Keep a running list of every CVE that touches your stack, since Minecraft’s ecosystem now spans the game server, the proxy, the plugins, and often a separate community website. If your server runs a NamelessMC panel for forum posts, tickets, or store integration, know that it carried four distinct CVEs disclosed in 2025 alone, from SQL injection to stored cross-site scripting, all patched between versions 2.1.3 and 2.2.0. And if you support Bedrock crossplay, OpenCVE lists a critical, 9.8-severity vulnerability against Minecraft Bedrock Dedicated Server, published July 14, 2026, as a reminder that Bedrock’s server binary is not automatically safer just because it gets less security research attention than Java Edition.
| CVE ID | Component affected | Impact | Fixed in |
|---|---|---|---|
| CVE-2025-61680 | Minecraft RCON Terminal (VS Code extension) | Plaintext RCON password disclosure | Version 2.1.0 |
| CVE-2025-27107 | Integrated Scripting mod | Sandbox escape, arbitrary code execution | 1.21.1-1.0.17 and equivalent builds |
| CVE-2026-55624 | MintyItanium Lost-Auction plugin | Privilege escalation, item duplication | Patched commit 88c920b |
| CVE-2025-32389 | NamelessMC (community panel) | SQL injection via GET parameters | Version 2.1.4 |
| CVE-2026-55010 | Minecraft Bedrock Dedicated Server | Critical, severity 9.8 (details limited) | Check vendor advisory for patch status |
Step 10: Automate Backups, Monitoring, and Load Testing
Every hardening step above reduces the odds of an incident. None of them reduce the odds to zero, which is why backups are not optional. Automate a daily world and plugin-data backup, store a copy off the server entirely (a separate VPS, S3-compatible object storage, or even a scheduled download to your own machine), and actually test a restore at least once, since a backup you have never restored is a hypothesis, not a plan.
#!/bin/bash
# /opt/minecraft/backup.sh — run nightly via cron
TIMESTAMP=$(date +%F)
tar -czf /backups/world-$TIMESTAMP.tar.gz /opt/minecraft/world /opt/minecraft/plugins
rclone copy /backups/world-$TIMESTAMP.tar.gz remote:minecraft-backups/
find /backups -mtime +14 -delete
# crontab -e
# 0 4 * * * /opt/minecraft/backup.shOn the monitoring side, watch connection and packet-per-second rates for abnormal spikes, which is usually the earliest visible sign of a join-flood or a volumetric attack starting to ramp up, well before players notice lag. Fail2ban rules that watch your server log for repeated failed login or RCON attempts from the same IP and temporarily ban it at the firewall level add a cheap extra layer against brute-force attempts. Finally, once your shield and firewall rules are in place, run a controlled load test from a second machine (never against someone else’s server, and never using a real booter service) to confirm that direct connection attempts to your backend’s real IP actually get refused, and that only traffic through TCPShield’s edge gets through. If you have ever dealt with players sharing “IP grabber” links in chat to deanonymize each other or your server, the same underlying defenses covered in a general guide to stopping IP pullers and booter services reinforce everything above: never expose a real IP anywhere a player-facing tool can capture it, including in error messages, plugin logs, or a status page.
What a TCPShield-Protected Attack Actually Looks Like
It helps to know what normal versus under-attack traffic looks like once the shield is active, so you are not guessing during an actual incident. TCPShield’s dashboard reports bandwidth and connection counts per domain in near real time. A quiet night on a small survival server produces a flat, low graph with maybe a handful of megabits per second during peak hours. An attack in progress looks abrupt rather than gradual: a vertical spike in blocked connections at the edge, while your backend’s own connection count and player list stay completely normal, because the shield absorbed the flood before it ever reached your server.
# Example of a healthy TCPShield status check via the dashboard API
$ curl -s https://api.tcpshield.com/v1/network/status \
-H "Authorization: Bearer $TCPSHIELD_API_KEY"
{
"network": "survival-network",
"status": "protected",
"active_attack": false,
"bandwidth_24h_gb": 42.7,
"connections_blocked_24h": 1180
}
# During an active volumetric attack, the same call typically shows:
{
"network": "survival-network",
"status": "protected",
"active_attack": true,
"bandwidth_24h_gb": 891.3,
"connections_blocked_24h": 2140873
}The important number in that second response is not the bandwidth figure, it is that your backend never saw those 2.1 million blocked connection attempts at all. That is the entire point of putting a proxy network in front of the game server rather than trying to absorb the flood on the host itself: your Paper server’s own logs, CPU, and player experience stay untouched while the edge network does the filtering.
Common Pitfalls When Hardening a Minecraft Server
- Leaving the old IP reachable. Pointing DNS at TCPShield does nothing if the backend’s real IP still accepts direct connections. Attackers who scraped your IP before you added the shield will keep hitting it directly, bypassing your protection entirely.
- Sharing the Velocity forwarding secret in a support ticket or public repo. Anyone with that string can impersonate any player on your network under any username, no password needed.
- Trusting a plugin because “everyone uses it.” The Fractureiser campaign compromised mods with millions of combined downloads. Popularity is not the same as safety, and it never has been.
- Running offline-mode without an auth plugin. Skipping Mojang account verification means literally anyone can log in as your admin’s username and start issuing commands, if OP or elevated permissions were ever assigned by username instead of UUID.
- Never testing the backup restore. A corrupted or incomplete backup file only gets discovered during an actual emergency, which is the single worst time to discover it.
Troubleshooting Guide
- Players can’t connect after switching DNS to TCPShield. DNS propagation can take up to 24-48 hours depending on your registrar’s TTL. Lower the TTL to 300 seconds before making the change next time, and verify propagation with a DNS lookup tool from multiple regions.
- TCPShield plugin loads but players still connect from unexpected IPs. Confirm Proxy Protocol v2 is enabled on both the TCPShield dashboard and your proxy config; without it, the proxy sees TCPShield’s IP for every player instead of the real client IP, breaking IP-based bans and geolocation.
- Velocity rejects all backend connections after adding the forwarding secret. The secret in
forwarding.secretand the secret in each backend’spaper-global.ymlmust match exactly, including whitespace. Copy-paste it directly rather than retyping it. - RCON connection times out. Check that
enable-rcon=trueis set and the server was restarted (not just reloaded) after editingserver.properties, and confirm the firewall rule allows your admin IP on port 25575. - LuckPerms permissions aren’t applying to a player. Run
/lp user PlayerName infoto confirm the correct group is assigned, and check for a conflicting permissions plugin still installed from before the migration. - Whitelist enforcement locks out staff during an emergency. Keep console or RCON access available as a fallback, since
enforce-whitelist=trueblocks even operators who are not on the list. - Backup script runs but the archive is empty or tiny. Check that the cron job runs as the same user that owns the Minecraft process directory, and that the world folder path in the script matches your actual server.properties
level-namevalue. - Server lags heavily even though TCPShield reports no active attack. Not every performance problem is a DDoS. Check for plugin memory leaks, an oversized world border generating too many new chunks, or a redstone contraption running an excessive number of tick-consuming operations before assuming it is network-related.
Advanced Tips for Multi-Node Networks and a Complete Working Project
Once a network grows past a single backend, a few additional practices pay off. Separate every service into its own container or VM: proxy, each game backend, database, and web panel (if you run one like NamelessMC) should not share a filesystem or process space, so a compromise on one does not automatically hand over the rest. Keep backend containers on an internal Docker network with no published ports to the host, and only expose the proxy container’s port to TCPShield’s edge ranges. If you run a community website alongside your server, patch it as aggressively as the game server itself: NamelessMC, a widely used option for Minecraft community sites, had four separate CVEs disclosed in 2025 covering SQL injection, stored cross-site scripting, and denial-of-service issues, all fixed in versions 2.1.3 through 2.2.0, and a web panel breach is just as damaging to a community as a game-server breach. The underlying host-hardening principles here are not Minecraft-specific either; the same baseline covered in a general CIS Benchmarks server hardening walkthrough (disabling unused services, enforcing kernel-level restrictions, auditing default accounts) applies directly to whatever Linux box your Minecraft stack runs on.
For teams running several backends behind one Velocity proxy, here is a minimal but complete Docker Compose stack that ties together everything covered in this tutorial: an internal-only network, a Velocity proxy with the forwarding secret mounted as a file (not baked into the image), and a Paper backend that only the proxy can reach.
version: "3.9"
networks:
mc-internal:
driver: bridge
internal: true
mc-edge:
driver: bridge
services:
velocity:
image: itzg/mc-proxy:latest
environment:
TYPE: "VELOCITY"
ports:
- "25577:25577" # only this port faces TCPShield's edge ranges via firewall
volumes:
- ./velocity.toml:/server/velocity.toml
- ./forwarding.secret:/server/forwarding.secret:ro
- ./plugins:/server/plugins
networks:
- mc-edge
- mc-internal
restart: unless-stopped
survival:
image: itzg/minecraft-server:latest
environment:
EULA: "TRUE"
VERSION: "26.2"
TYPE: "PAPER"
ONLINE_MODE: "TRUE"
volumes:
- ./survival-data:/data
- ./paper-global.yml:/data/config/paper-global.yml
networks:
- mc-internal # no mc-edge network, no public port — proxy-only access
restart: unless-stopped
backup:
image: alpine:latest
volumes:
- ./survival-data:/data:ro
- ./backups:/backups
entrypoint: ["/bin/sh", "-c", "while true; do tar -czf /backups/world-$(date +%F).tar.gz /data/world; sleep 86400; done"]
restart: unless-stoppedNotice that the survival service has no entry in the mc-edge network and publishes no ports at all. It is reachable only through the internal Docker network from the Velocity container, which is the containerized equivalent of the firewall rule from step 6. Combine this compose file with the firewall rules, RCON hardening, and plugin-vetting checklist above, and you have a defense-in-depth setup: TCPShield stops volumetric traffic at the edge, the forwarding secret stops forged player data, the internal-only network stops direct backend access, LuckPerms and a whitelist limit blast radius if an account is compromised, and automated off-server backups mean a worst-case incident costs you a restore, not your entire world.
Frequently Asked Questions
Is TCPShield free to use for a small Minecraft server?
Yes. TCPShield’s free tier includes 1 TB of monthly traffic, one network, and three domains, which comfortably covers a server with roughly 20-30 concurrent players. Larger networks need the $25/month Pro plan for 5 TB of traffic, or Premium at $100/month for unlimited bandwidth.
Does TCPShield work with Bedrock Edition servers?
TCPShield is built primarily around Java Edition traffic. If you need Bedrock backend support specifically, NeoProtect’s Universal plan at €15/month explicitly includes it, which is worth checking before committing to a Java-only proxy for a cross-play network.
Can I use TCPShield and still see players’ real IP addresses?
Yes, TCPShield has supported Proxy Protocol v2 since February 2022, which forwards the real client IP to your backend instead of showing TCPShield’s own edge IP for every connection. This needs to be enabled on both the TCPShield dashboard and your proxy configuration to work correctly.
What is the Velocity forwarding secret and why does it matter?
It is a shared key that lets your Velocity proxy cryptographically sign player data (username, UUID, real IP) so backend servers can trust it came from the real proxy and was not forged by someone connecting directly. Anyone who obtains the secret can impersonate any player on the network, so it should never be shared, committed to a repository, or logged anywhere.
Should I disable online-mode to allow cracked clients?
Only with a clear understanding of the tradeoff. Disabling online-mode skips Mojang’s account verification, meaning anyone can connect under any username, including impersonating staff accounts. If offline mode is required for a custom authentication setup, pair it with a login plugin such as AuthMe Reloaded, which is strictly weaker security than Mojang’s own verification.
How do I know if a plugin download is safe?
Install only from SpigotMC, Modrinth, Hangar, or Polymart, never from cracked or unofficial reuploads. Scan new JARs with a tool like Spigot Anti-Malware or PluginScan before deployment, and watch for a file named plugin-config.bin appearing in your plugins directory, which PaperMC’s forum has flagged as a strong indicator of a known malware strain that requires a full OS reinstall to remove cleanly.
What should I do if I suspect my RCON password has leaked?
Rotate the password immediately, restart the server to apply the change, and check the firewall to confirm port 25575 is only reachable from your internal network or a single admin IP, never the public internet. If you used the Minecraft RCON Terminal VS Code extension before version 2.1.0, assume the old password is compromised, since CVE-2025-61680 confirms it was stored in plaintext in earlier versions.
Related Coverage
- Astrix vs Oasis vs Entro: NHI Security After 2 Buyouts [2026]
- Roblox Exploit Malware Removal: 12 Steps, 90 Min [2026]
- Secure Windows RDP: Stop Brute-Force in 12 Steps [2026]
- How to Use Shodan for OSINT: Attack Surface Recon in 12 Steps [2026]
- osquery Endpoint Monitoring Setup: 13 Steps, 60 Min [2026]
