Minecraft server security check, run by AI in your panel
Most Minecraft servers are not taken over through a clever exploit. They are taken over through an operator list nobody pruned, a plugin two releases behind, a panel account without a second step, or account checking that somebody switched off years ago and forgot. Those are all things you can see, if you know where to look and you actually go and look.
31 checks on your own server, not a general checklist
The security assistant is part of the AI Copilot that sits in the panel of every Astroworld server. It does not hand you an article about Minecraft security. It opens your server, reads the files that decide these things, and comes back with 31 checks in 6 groups, each one either critical, a warning, or passed.
The counts are measured, not written. Our own code does the checking and the counting, and the AI does what it is good at: explaining what a finding means for your server, in your language, and doing the parts of the repair it is allowed to do.
What it checks
| Group | Checks | What that covers |
|---|---|---|
| Who can get in and who can run commands | 10 checks | Minecraft still checks every player against Mojang. taking someone off the whitelist actually removes them. chat is still signed. another server may push players onto yours. how many people are operator. how much power an operator gets. Operators who are no longer on the whitelist. Operators who can join a full server. your ban list is being kept. Private keys or password files lying in the server folder. |
| Ports that are open | 5 checks | remote console is open, and whether it has a password. the query port is open. Java monitoring is exposed. the server is bound to an address that breaks your play address. anything actually connected over remote console. |
| Settings with a security consequence | 4 checks | command blocks can run commands. anyone can build at spawn. your resource pack is served over plain http. your resource pack has a checksum. |
| Plugins and mods | 4 checks | which plugins are behind on a release. The same plugin installed twice. Leftover and disabled plugin files. Plugins installed from outside our catalogue. |
| What actually happened on your server | 4 checks | Operator rights handed out recently. Recent commands that change rights or hand out items. Join attempts that failed the account check. Players the built in anti cheat kept kicking. |
| Access to your panel, outside the game | 4 checks | your panel account has a second step. Staff members with rights that can destroy or expose data. Invitations that were never accepted. Staff who have not opened the panel in three months. |
All 31 checks, and why each one is on the list
Nothing here is a secret. This is the whole list, in the order the assistant walks it, with the reason each check earns its place. If a check does not apply to your server, it does not turn up in your report at all: a server without remote console gets no remote console finding.
| Check | Why it matters |
|---|---|
| Whether Minecraft still checks every player against Mojang | With account checking off, anyone who knows the name of one of your operators can log in as that operator. |
| Whether taking someone off the whitelist actually removes them | Without enforcement, a player you just removed keeps playing until they log out by themselves. |
| Whether chat is still signed | Unsigned chat lets a modified client send messages as another player. |
| Whether another server may push players onto yours | Any server that knows your address can send players straight in, without them choosing to join. |
| How many people are operator | Every operator can run every command, including giving items, changing gamemodes and stopping the server. |
| How much power an operator gets | Level four is everything. It is the normal setting, and it is only safe while the list stays short. |
| Operators who are no longer on the whitelist | Somebody was taken off the list but kept their operator rights, so they are operator again the moment they get back in. |
| Operators who can join a full server | Normal for the owner, worth a second look on a name you do not recognise. |
| Whether your ban list is being kept | A ban list that quietly emptied means bans are not sticking. |
| Private keys or password files lying in the server folder | Everything in that folder can be downloaded by anyone with file rights and read by any plugin. |
| Check | Why it matters |
|---|---|
| Whether remote console is open, and whether it has a password | Remote console is full control of the server. We report whether a password is set and whether it is short, never what it is. |
| Whether the query port is open | It hands your player list, plugin list and version to anyone who asks, and it is a protocol used for reflection attacks. |
| Whether Java monitoring is exposed | Jmx exposes the Java process itself, in the default setup without authentication. Almost nobody switches it on deliberately. |
| Whether the server is bound to an address that breaks your play address | Filled in with a real address, your server stops answering on the address you hand out. |
| Whether anything actually connected over remote console | If you do not run a tool that uses it, someone else is using it. |
| Check | Why it matters |
|---|---|
| Whether command blocks can run commands | A command block runs at operator level, so build rights near spawn become operator rights. |
| Whether anyone can build at spawn | Spawn protection at zero is the most common way a public server gets defaced. |
| Whether your resource pack is served over plain http | Anyone between your player and that server can swap the file, and newer clients refuse it anyway. |
| Whether your resource pack has a checksum | Without one a client cannot tell it got the pack you meant, and it re-downloads on every join. |
| Check | Why it matters |
|---|---|
| Which plugins are behind on a release | Plugin updates are where security fixes land, and the hole is public the moment the fix is published. We compare your installed version against the project page. |
| The same plugin installed twice | The server loads one of the two jars and you cannot tell which, which is how an old version keeps running after an update. |
| Leftover and disabled plugin files | Not loaded, so not a hole, but they make it harder to see what is really running. |
| Plugins installed from outside our catalogue | Fine in itself, but a plugin jar runs any code it likes, so where you downloaded it matters. |
| Check | Why it matters |
|---|---|
| Operator rights handed out recently | Whoever received it can run every command. It is also the first thing an attacker does. |
| Recent commands that change rights or hand out items | Bans, whitelist changes, gamemode, give, economy and permission changes are the lines worth reading back. |
| Join attempts that failed the account check | Usually cracked clients trying their luck, sometimes someone probing whether account checking is off. |
| Players the built in anti cheat kept kicking | One name is a cheater, every name is a plugin of yours moving players in a way the server does not expect. |
| Check | Why it matters |
|---|---|
| Whether your panel account has a second step | Your panel account is files, console, backups and billing in one. A password on its own is one leak away from all of it. |
| Staff members with rights that can destroy or expose data | World resets the world, Delete files removes anything, Databases shows database passwords in plain text. |
| Invitations that were never accepted | An open invitation is access waiting to be claimed by whoever controls that email address. |
| Staff who have not opened the panel in three months | Access nobody is watching is not a hole today. It is one on the day that account is lost. |
Critical, warning, passed
A list of thirty findings is only useful if it tells you what to do first. Every check comes back in one of three states, and the number next to each state is counted by the check itself.
| Result | Colour | What it means |
|---|---|---|
| CriticalFix this today | red | Someone who wanted to could take your server or your account today. Account checking off, remote console open without a password, operator rights handed out in the log that you did not hand out. |
| WarningWorth a decision | orange | Not an open door, but wider than it needs to be. A plugin behind on a release, an open query port, four staff members who can delete files. |
| PassedSay so, do not hide it | green | The checks that came back clean, listed by name. A check you cannot see the result of is a check you have to take on faith. |
How to run a security check on your Minecraft server
Open your panel and press Check my security with AI
The button sits on the Staff, Players and Settings tabs, which is where the question comes up. If the panel already sees something (too many operators, a staff member who can delete files, remote console switched on) the strip says so before you click.
The assistant reads your actual server
Your server.properties, your operator list, your whitelist and ban list, every jar in your plugins or mods folder, the last 400 lines of console log, and the panel side: who you invited, what you gave them and whether your own account has a second step. It runs in one pass and finishes in seconds.
You get a count and a ranked list
Red, orange and green with the numbers next to them, then every critical finding in one line that says what was seen and what it lets someone do, then the warnings, then the passed checks in a sentence. The counts come from the check itself, not from the model writing the answer.
It fixes what it is allowed to fix
Each fix arrives as a card with the before and after on it, and applying it keeps an undo. The findings it may not touch are the ones that decide who gets in, and for those it names the tab and what to click there instead of doing it behind your back.
What the AI is never allowed to change
An assistant that could quietly switch off your whitelist would be worse than the problem it is looking for. So the 20 settings that decide who gets into your server are read only to it, permanently and in every mode. It reports on them, explains them, and then points at the tab where you do it yourself.
- Verify accounts (online-mode)
- Whitelist and enforce whitelist
- Remote console and its password
- The query port
- The server port and bind address
- Operator permission level
- Datapack function level
- Java monitoring
The same goes for your operator list, your whitelist and your ban lists: those live on the Players tab and are yours. What it will do on its own, in the modes where you allow it, is the rest: spawn protection, command blocks, plugin updates, config files, and taking a backup before it starts.
Why the panel side is on this list at all
Almost every Minecraft security guide stops at the game. That is the half you can see, and it is not the half that loses people their server. Your panel account is your files, your live console, your backups and your billing in one login, and no in game setting protects any of it.
So the check also looks at whether your account has a second step, which of the 14 panel rights you handed out to which staff member, which invitations were never accepted, and who has not opened the panel in three months. Access nobody is watching is not a problem today. It is one on the day that account is lost.
Questions about Minecraft server security
What does the Minecraft server security check actually look at?
31 checks in 6 groups: who can join and who can run commands, which extra ports are open, settings that carry a security consequence, your plugins and mods, the last 400 lines of your console log, and access to the panel itself. It reads the real files on your own server, so the answer is about your server and not about Minecraft in general.
How long does a security check take?
Seconds. Everything it needs is fetched in one pass rather than one file at a time, so the whole check finishes in under five seconds on a normal server, including looking up plugin versions against their project pages.
How do I know if my Minecraft server has been hacked?
The console log is where it shows first. The check reads your recent log for operator rights being handed out, bans and whitelist changes, permission commands, failed account checks and anything connecting over remote console. Operator rights you did not hand out yourself is the single clearest sign, and it is marked critical.
What stops players from griefing my server?
Three things the check looks at directly: spawn protection at zero means any player can break blocks at your spawn, command blocks being enabled turns build rights near spawn into operator rights, and an operator list longer than it needs to be means more people can do anything at all. Land claim plugins come after those three, not before.
How do I know if my plugins are out of date?
The check compares the version in each installed jar against the newest release for your Minecraft version and loader, for the 510 plugins in our catalogue. Plugin updates are where security fixes land, and the hole becomes public the moment the fix is published, so a plugin that is behind is the most common way a Minecraft server gets taken over.
Can the AI fix the problems it finds?
Some of them, and it is explicit about which. It prepares a card for what it may change, and each card keeps an undo. It never changes the 20 settings that decide who gets into your server, so for those it tells you which tab to open and what to click. An assistant that could switch off your whitelist on its own would be the security problem.
Does the check read my passwords?
No. It reports whether a remote console password is set and whether it is shorter than twelve characters, never what it is, and files that look like keys, tokens or credentials are refused rather than read. A check that puts your password in a chat window is itself the leak.
How do I check who has access to my Minecraft server?
Two lists, and most people only look at one. In game there is the operator list, and the check flags operators who are no longer on your whitelist. In the panel there are the people you invited, with 14 separate rights between them, and the check flags anyone who can reset the world, delete files or read database passwords, plus invitations that were never accepted and staff who have not logged in for three months.
What is the single most useful thing I can do for my server's security?
Turn on two step verification for your panel account. Your panel account is your files, your live console, your backups and your billing in one place, and no in game setting protects any of it. It is the finding that comes back critical most often, and it takes about a minute to fix.
What does a security check cost?
It runs on Copilot credits like any other message, and every server starts with credits included. A full check with the report is one message. The heavier engine, Quasar, is the one that picks it up, because reading a whole server and weighing what matters takes more than a one line answer: it may work for up to 30 steps in a single message.
Where to find it
The security check is in the panel of every Astroworld server, on the Staff, Players and Settings tabs and in the Copilot itself. There is nothing to install and nothing to order, and it works on the server you already have.
Everything the AI Copilot can do The AI performance optimizer, for lag instead of security The panel these checks run from What is included with every plan Paper servers, where most plugin findings turn up Staff permissions, the three checks on this list Setting up permissions by hand Installing plugins, and keeping them up to date Who runs Astroworld View plans and prices Ask us a question first
The 31 checks, the 6 groups, the count of settings the assistant may never change and the number of plugins whose versions can be verified are read from our own security check when this page is built, so they change with the product. Written 30 August 2026.