The only thing that works against DDoS is protection that stops attacks before they reach your server. For Minecraft, a service that understands the Minecraft protocol and also detects bots is best.
Just as important: nobody may know your real server IP, or the attacker can bypass any protection.
Contents
How attacks work
There are two kinds of attacks on Minecraft servers, and good protection has to handle both:
- Floods: huge amounts of packets clog the connection to your server. Nothing running on the server itself can cope with that volume.
- Bot attacks: fake players join in bulk, spam or try passwords. The connection is fine, but your server is busy with fake players.
Both need a target: the IP address your server is reachable on.
Your options
1. Your host's DDoS protection
Many hosts include basic protection. It often absorbs large floods but usually doesn't understand the Minecraft protocol, so it misses bots. Some hosts temporarily block your IP entirely during a big attack to protect their network. Then you are offline even though the attack was “mitigated”.
2. A specialised Minecraft protection service
Services like BlackProtect, TCPShield and others sit in front of your server: players connect to the service, it filters and passes on only real connections. Your real IP stays hidden, and the filter knows what a genuine Minecraft connection looks like. For most servers this is the best option.
3. Your own firewall and plugins
A firewall and anti-bot plugins help against small bot waves. They don't help against a real flood, because the connection is clogged before your firewall even sees anything. They are still a good addition, especially a firewall that only lets the protection service through.
What to look for in a protection service
- Location: the closer the filter servers are to your players, the less ping is added. BlackProtect filters in Germany, which suits servers with mostly European players.
- Java and Bedrock: if people play on phones or consoles (via Geyser), the protection has to forward Bedrock connections too.
- Real player IPs: behind a protection service your server would otherwise only see the service's IP, so bans and logs break. Look for PROXY protocol support.
- No plugin needed: ideally protection works through one DNS record, without a plugin on your server.
- Support that answers: when you are under attack, you don't want to wait three days for a ticket.
- Data protection: your players' IP addresses pass through the service. A provider in the EU that signs a data processing agreement makes GDPR compliance easier.
Setting up BlackProtect
To show how little effort this is, here is the full flow. You need your own domain (e.g. play.yourserver.com) and your server's IP and port.
- Create a free account
Every new account gets 30 days of all features, no credit card.
- Add your domain
For example
play.yourserver.com. You get a personal target for the DNS record. - Set the DNS record
At your domain provider, set a CNAME record to that target. If your domain is on Cloudflare, we can do it for you in one click.
- Enter your server
The IP and port of your actual server, e.g.
203.0.113.10:25565. While you look it up, the DNS record is already spreading worldwide. - Done, with proof
We ping your server through the protection and show version, player count and MOTD the way the server list shows them.
Make sure your real server IP doesn't show up anywhere, and only let the protection through to the server: Hide your server IP.
Frequently asked questions
Will protection increase my ping?
Barely. The filtering itself takes less than a millisecond. What matters is where the filter servers are: for players and servers in Europe there is practically no difference.
Do I need a plugin?
No. Protection works through a DNS record. If you want to see your players' real IPs, you enable PROXY protocol in your proxy or server – a setting, not a plugin.
How much does Minecraft DDoS protection cost?
It depends on the provider. With BlackProtect you can start for free with one domain; more domains and the VPN filter are in the paid plans. All prices are listed openly on the pricing page.