Right now, the whitelist (/whitelist on) or a maintenance mode that only lets you and your team in helps immediately.
Long term you need protection that detects bots before they reach your server – and on cracked servers, a login plugin as well.
Contents
How to recognise a bot attack
In a bot attack, someone uses a program to send lots of fake players to your server. The connection isn't clogged like in a DDoS, but your server is busy with fake players.
- Lots of unknown names appear in the console within seconds, often random letters or numbered (
Bot_001,Bot_002…). - The chat floods with ads, insults or links.
- The player count suddenly jumps, and real players get “Server is full”.
- The server lags, because every join loads the world and plugins.
What helps right now
- Turn on the whitelist
With
/whitelist ononly players you approved get in. Fine for a few hours. - Or: maintenance mode with exceptions
In BlackProtect, turn on maintenance mode for your route and add yourself and your team to the Maintenance bypass allowlist. Everyone else sees a maintenance message before they even reach your server.
- Block conspicuous addresses
If the bots come from a few addresses, block them in the Per-route IP blocklist. Under Blocked connections you see what is being rejected right now.
- Tell your players
A short note on Discord about why only approved players can join right now saves a lot of frustration.
Long-term protection
A whitelist is no permanent state for a public server. To let new players in and keep bots out, combine several layers:
- Protection in front of the server: BlackProtect slows connection floods down at the filter, reads the Minecraft protocol and drops fake connections before they reach your server.
- Rejoin delay: sets how fast the same address may join again. Bots reconnecting every second bounce off; real players notice nothing.
- VPN / proxy filter: many bot programs run through VPNs or rented servers. The filter blocks connections from such networks (Pro plan).
- An anti-bot plugin on the proxy: for Velocity and BungeeCord there are free plugins like Sonar that briefly verify new players. A good addition to the protection in front.
Hit hardest: cracked servers
On a cracked server (online-mode=false in server.properties), nobody checks whether a player really owns a Minecraft account. Bots can make up any number of names at no cost.
- A login plugin is a must: with a plugin like AuthMe or nLogin, every player has to log in with a password. Otherwise anyone can pretend to be you or your admin.
- Protection in front matters even more than on normal servers, because nothing stands in the bots' way.
- Switch to `online-mode=true` if you can. Then Mojang verifies every account, and bot attacks become much more expensive.
Bot attacks often come together with floods. How to recognise those: Minecraft server under attack.
Frequently asked questions
Is an anti-bot plugin enough on its own?
Against small bot waves, often yes. In bigger attacks your server already struggles with the sheer number of connections before the plugin can check anything. A filter in front takes that load off.
Why do the bots have such odd names?
Bot programs generate names automatically, often random or numbered. On cracked servers they can also copy real names, which is why a login plugin matters so much there.
Can I get rid of the spam?
Chat messages disappear for new players on their own. If a bot wrote on signs or books, a rollback with a plugin like CoreProtect helps.