Updated 2026-10-27 · All guides
Whitelist, operators and permissions: who can do what on your server
A server with nobody in charge is fine until someone joins who shouldn't, or a friend accidentally runs a command that wipes a build. Minecraft gives you three tools to control this: the whitelist decides who can join, operators decide who can use commands, and permission plugins let you fine-tune it all on Paper servers.
All the commands below can be typed into the server console without a slash, or in-game with a slash (/whitelist add …) by an operator.
The whitelist: who can join
With the whitelist on, only players on the list can join. Anyone else sees "You are not white-listed on this server". For a server for friends, it should almost always be on. Server addresses get shared further than you expect, and there are bots that scan the internet for open Minecraft servers.
| Command | What it does |
|---|---|
whitelist on | Turns the whitelist on (same as white-list=true in server.properties). |
whitelist add Name | Lets a player join. Use their exact Java Edition username. |
whitelist remove Name | Takes them off the list. |
whitelist list | Shows everyone on it. |
whitelist reload | Re-reads whitelist.json if it was changed by hand. |
Turn on enforce-whitelist=true in server.properties too, so anyone you remove is kicked straight away instead of at their next login.
The whitelist stores each player's account ID as well as their name, so it keeps working when someone changes their username. It relies on the server checking accounts with Mojang, which is why online-mode must stay true. In offline mode anyone can join as any name on the list.
Operators: who can use commands
An operator ("op") can use admin commands. Give yourself op first: in the server console, type op YourName. To remove it, deop Name. The list is stored in ops.json.
Operators have a level from 1 to 4. The default for new ops is set by op-permission-level in server.properties, and it's 4, which is everything.
| Level | What they can do |
|---|---|
| 1 | Build inside spawn protection. No commands. |
| 2 | Gameplay commands: /gamemode, /give, /tp, /time, /weather, /gamerule, /difficulty, command blocks. |
| 3 | Moderation: /kick, /ban, /pardon, /whitelist, /op and /deop. |
| 4 | Server control: /stop, /save-all, /save-off and everything else. |
To give a friend a lower level, op them, then stop the server, change their "level" in ops.json and start it again. Op is all-or-nothing in practice: a level 2 op can give themselves any item, fly in creative and teleport anywhere. Only op people you'd trust with your world. For "can kick people but not cheat", you need a permissions plugin (below).
Kicking and banning
| Command | What it does |
|---|---|
kick Name reason | Disconnects them. They can rejoin straight away. |
ban Name reason | Stops that account joining. Stored in banned-players.json. |
ban-ip Name | Bans their internet address. Careful: it also blocks anyone else on the same connection, such as family members or a whole school. |
pardon Name / pardon-ip address | Removes a ban. |
banlist | Shows current bans. |
On a whitelisted server, removing someone from the whitelist is usually enough. Bans are for public servers, where anyone can join.
Permission plugins: more control on Paper
On Paper and Purpur, plugins check permission nodes rather than op levels. For example, a homes plugin might check essentials.home. A permissions plugin lets you put players into groups and grant exactly the nodes you want.
LuckPerms is the standard choice. It's free, works on Paper, Purpur and Fabric, and has a web editor so you don't have to type every node. A typical setup for friends:
- default group: what everyone gets, such as setting homes and using
/spawn. - trusted group: friends who can also kick players or use a few helper commands.
- admin group: you, with everything (or just op).
Some commands for LuckPerms, typed in the console:
lp creategroup trusted
lp group trusted parent add default
lp group trusted permission set minecraft.command.kick true
lp user FriendName parent add trusted
lp editorlp editor prints a link to the web editor, where you can tick permissions instead of typing them. Each plugin's documentation lists its permission nodes.
A simple, safe setup for friends
- Whitelist on, enforce-whitelist on, online-mode on.
- Op yourself at level 4.
- Op nobody else, or one co-owner you fully trust.
- If friends need specific abilities, give them through LuckPerms groups instead of op.
- Install a protection or rollback plugin such as CoreProtect on Paper, so if something does get griefed you can see who did it and undo it.
- Keep regular backups as a last resort.
Common questions
Why can't my friend break blocks near spawn? That's spawn protection: only ops can build within 16 blocks of the world spawn by default. Set spawn-protection=0 in server.properties to turn it off.
I opped myself, but commands say I don't have permission. Check that you're on the account you opped, that the name is spelled exactly, and on Paper, that a permissions plugin isn't overriding op. In LuckPerms, lp user YourName permission check node explains why a check passes or fails.
Can I whitelist Bedrock players joining through Geyser? Yes. With Floodgate, Bedrock players get a name with a prefix (often a dot, like .Steve), and Floodgate has its own fwhitelist add command for them. See the crossplay guide.
HostCraft's Players tab does the whitelist, op, kick and ban commands with buttons, and the wizard asks for your admins when you create a server, but the files and commands underneath are exactly the ones on this page.