Whitelist

The whitelist is Minecraft’s built-in access control. When it is enabled, the server only lets in players whose accounts are on the list. Everyone else sees a message that they are not whitelisted.

Turning it on

You can enable it in server.properties with white-list=true, or in game or on the console with /whitelist on. The list itself is stored in whitelist.json in the server folder.

Useful commands (operators only):

• /whitelist add <name> and /whitelist remove <name>
• /whitelist list shows everyone on the list.
• /whitelist reload reloads whitelist.json after you edited the file by hand.
• /whitelist off opens the server again.

enforce-whitelist=true makes the server kick players who are online but not on the list whenever the whitelist is reloaded. Without it, removing someone only stops their next join.

Why it matters for server owners

For a private server among friends, a whitelist is the simplest and most effective protection. Public server lists and scanners find open servers quickly, and an unprotected world can be griefed within hours.

Entries are stored with the player’s UUID, not only the name. That means name changes do not break the list, but it also depends on online-mode=true or correct proxy forwarding so that UUIDs are real.

Crossplay

Bedrock players joining through Geyser and Floodgate have their own accounts and, by default, a name prefix. Adding them to the vanilla whitelist may need the prefixed name or Floodgate’s own whitelist command; check the Floodgate documentation.

Practical tip

Enable the whitelist before you share the address, not after something goes wrong. For finer control than “may join or not”, combine it with op levels or a permissions plugin such as LuckPerms.