Minecraft server under attack: what to do right now

Is it really an attack?

Not every outage is an attack. It is worth a quick check first, because you fix lag very differently from a DDoS.

A DDoS attack (distributed denial of service) means many machines send so much junk traffic to your server at once that the connection clogs up. Real players can no longer get through.

• Typical for DDoS: every player drops with “Timed out” at the same time, but the console keeps running. Your host's panel shows a huge spike in incoming traffic.
• Typical for a bot attack: hundreds of unknown players join within seconds, spam the chat or spam commands. The server runs but is unusable.
• Probably not an attack: the server lags and TPS drops, but connections stay up. That is usually a plugin or too little RAM. Check with /spark tps or /tps.

The first 15 minutes

1. Stay calm, don't keep restarting

   A restart does nothing against a clogged connection. It only costs time and can corrupt world data if it happens mid-save.

2. Check with your host

   Many hosts show incoming traffic in their panel or send an email when they temporarily block your IP because of an attack (called a null route). Then you know for sure it is a DDoS.

3. Tell your players, but not the IP

   A short note on Discord (“We're under attack, we're on it”) prevents chaos. Never post the server IP, not even a new one.

4. Put protection in front of the server

   A DDoS protection service like BlackProtect sits between players and your server. Players connect to our filter servers, we drop the attack and only pass real connections on to you. Setup takes about five minutes: add your domain, set one DNS record, enter your server.

5. Lock down the real IP

   If the attacker already knows your real server IP, they will simply attack it directly, protection or not. How to prevent that: Hide your server IP.

During a bot attack

Bots are not a clogged connection but fake players joining in bulk. In the short term:

• Turn on the whitelist (/whitelist on) so only known players get in. Not pretty, but it works instantly.
• Use protection that understands the Minecraft protocol. BlackProtect detects bot waves and mass joins and limits how fast the same address may rejoin (in the dashboard under Rejoin delay).
• If the bots come through VPNs, turn on the VPN / proxy filter. It blocks connections from VPN and datacenter networks (Pro plan).

More on this: Stop a bot attack.

What you should never do

• Don't pay a ransom. Whoever pays gets attacked again, because it worked.
• Don't hit back or use “booters” or “stressers”. That is a crime itself and makes you a target.
• Don't share the new IP, not with friends and not in console screenshots.
• Don't switch IPs without protection in front. A new unprotected IP is found again quickly.

After the attack

Once everything runs again, close whatever made the attack possible:

• Find out how the attacker got your IP and close the leak (guide).
• Keep the protection on. Attackers often come back once they see it worked.
• DDoS attacks are illegal in most countries. You can report them to the police or your national cybercrime unit; keep timestamps, screenshots and your host's emails.