Whitelist, OPs and permissions
Updated September 2026 · Whitelist on, OP only for people you would give your house keys to, and a permissions plugin for everyone in between.
The whitelist: who can join
A whitelist means only players on the list can join. Every private server should have one. Bots scan the internet for open Minecraft servers, and an open server with no protection will get visitors.
Commands (in game as OP, or without the slash in the console):
| Command | What it does |
|---|---|
/whitelist on |
Turns the whitelist on |
/whitelist add <name> |
Adds a player |
/whitelist remove <name> |
Removes a player |
/whitelist list |
Shows everyone on it |
/whitelist reload |
Reloads whitelist.json after you edited it by hand |
/whitelist off |
Turns it off again |
Set enforce-whitelist=true in server.properties so removed players get kicked right away instead of staying online. The list itself is saved in whitelist.json.
Players on the whitelist need the exact Java username. Bedrock players joining through Floodgate have a prefix (a dot by default) and are added with /fwhitelist add <name> — see crossplay with Geyser and Floodgate.
OPs: full control
An operator (OP) can run admin commands: change game mode, teleport, give items, ban players, stop the server.
/op <name>— makes someone an operator./deop <name>— takes it away.- The list is saved in
ops.json.
To make yourself OP the first time, type op YourName in the server console (no slash). Nobody is OP on a fresh server.
OP levels
OPs have a permission level from 1 to 4. The default for /op is set by op-permission-level in server.properties (4 unless you change it).
| Level | Can do |
|---|---|
| 1 | Build inside spawn protection |
| 2 | Cheat commands like /gamemode, /give, /tp, command blocks |
| 3 | Moderation: /kick, /ban, /op |
| 4 | Everything, including /stop |
You can give a single player a different level by editing their level value in ops.json while the server is stopped.
Rule of thumb: only people who could restore the server from a backup should be OP. OP is all or nothing for most players. For anything in between, use permissions.
Permissions: exactly the powers someone needs
On Paper (and Spigot) the standard is LuckPerms. It also exists for Fabric, Forge, NeoForge and Velocity. Install it like any plugin — see install plugins on Paper and Spigot.
LuckPerms thinks in groups. You give permissions to a group, then put players in groups.
A simple setup
- Create a moderator group:
/lp creategroup mod - Give it the permissions it needs, for example kicking players:
/lp group mod permission set minecraft.command.kick true - Add a player to the group:
/lp user Alex parent add mod - Check what a player has:
/lp user Alex info
Every player is in the default group automatically. Anything you set there applies to everyone.
The web editor
Typing permission nodes gets tedious. Run /lp editor, open the link, click through groups and permissions in your browser, then save. LuckPerms gives you a command to apply the changes.
Where to find permission nodes
Each plugin lists its permissions on its download page or wiki. Vanilla commands follow the pattern minecraft.command.<name>, for example minecraft.command.gamemode.
A setup that works for most friend servers
- Whitelist on,
enforce-whitelist=true. - One or two OPs: you and one trusted friend.
- LuckPerms groups:
defaultfor everyone,modfor people who can kick and use a few moderation commands,builderif you run a creative area. - Protection: a land claim plugin so players cannot break each other’s builds, or CoreProtect so you can roll back damage.
If you share admin with a host panel
The server console in your panel has full access, like level 4. Only share panel access with people you would also make OP.
Keeping it safe
- Never set
online-mode=falseon a public server. Without it anyone can join with your name — and your OP rights. - Remove OP from people who stop playing.
- Keep a backup before giving anyone new rights. See backups and restores.