--- title: "Minecraft Join Spam and Bot Attacks: Defense Checklist | ZCS" description: "Practical guide to anti-bot and join protection: planning, compatibility, verification, troubleshooting and safer Minecraft server operations." url: "https://www.zcraftstudios.com/blog/minecraft-server-antibot-join-spam-defense" updated: "2026-10-20T07:22:11.764657+00:00" source: "ZCraft Studios" --- > Site index for AI agents: https://www.zcraftstudios.com/llms.txt (full reference: https://www.zcraftstudios.com/llms-full.txt). Every page is available as Markdown by adding `.md` to its URL or sending `Accept: text/markdown`. 1. [Home](https://www.zcraftstudios.com/) 2. [Blog](https://www.zcraftstudios.com/blog) 3. Minecraft Join Spam and Bot Attacks: Defense Checklist [ All posts](https://www.zcraftstudios.com/blog) # Minecraft Join Spam and Bot Attacks: Defense Checklist ZCraft StudiosOct 15, 2026Updated Oct 20, 2026 Practical guide to anti-bot and join protection: planning, compatibility, verification, troubleshooting and safer Minecraft server operations. ## In this guide - [What join spam looks like](#what-join-spam-looks-like) - [Defense layers](#defense-layers) - [Set the baseline first](#set-the-baseline-first) - [Add an anti-bot plugin](#add-an-anti-bot-plugin) - [Test like a real player](#test-like-a-real-player) - [Incident checklist](#incident-checklist) - [Mistakes to avoid](#mistakes-to-avoid) - [Related guides](#related-guides) ## Minecraft Join Spam and Bot Attacks: Defense Checklist _Join spam floods a public server with fake connections or fake accounts. It fills player slots, spams chat, lags the server and can take it offline. Most attacks are stopped by layers, not by one plugin._ ## What join spam looks like - Dozens of new names joining and leaving within seconds, often with random or patterned usernames - Chat or command spam from brand-new accounts - CPU or network spikes with few real players online - Console flooded with login and disconnect lines - Server list pings from one address range at very high rates Before blaming bots, rule out a real problem. Check [TPS vs Ping vs FPS](https://www.zcraftstudios.com/blog/minecraft-server-tps-vs-ping-vs-fps) and profile with [spark](https://www.zcraftstudios.com/blog/how-to-read-spark-profiler-minecraft). ## Defense layers | Layer | What it does | Notes | | --- | --- | --- | | Hosting and network | Absorbs volumetric attacks | Ask your host what DDoS protection is included | | Firewall rate limits | Drops excessive connections per address | See [Firewall Hardening](https://www.zcraftstudios.com/blog/minecraft-server-firewall-hardening) | | Proxy | One public entry point; backends stay private | See [Velocity Modern Forwarding](https://www.zcraftstudios.com/blog/velocity-modern-forwarding-setup-checklist) | | Online mode and whitelist | Blocks unverified or unapproved accounts | See [Authentication Models](https://www.zcraftstudios.com/blog/minecraft-server-authentication-methods) | | Connection throttle | Limits how fast one address can reconnect | A server setting; check your software docs | | Anti-bot plugin | Verifies new connections before they reach the game | Examples include Sonar; check current compatibility | | Login or limbo plugin | Holds unverified players in a lobby | For offline-mode networks, see [AuthMe](https://www.zcraftstudios.com/blog/authme-offline-mode-authentication-setup) | ## Set the baseline first 1. Keep `online-mode=true` unless you have a proxy or auth plugin designed for offline mode. Do not turn it off casually; it changes player identity. 2. Make backend servers reachable only from your proxy. A bot that finds a backend port bypasses every proxy protection. 3. Close every port you do not use. Only the proxy or main server port should be public. 4. Enable connection throttling and check the value suits real players who reconnect after crashes. 5. Put per-address connection limits in your firewall rather than in the game server. ## Add an anti-bot plugin Anti-bot plugins check new connections for patterns and can require a verification step before a player can join. Choose one that supports your server software and Minecraft version, install it on the proxy if you run one, and test it before an attack happens. Free authentication plugins for proxies, such as the ZCraft **[Z-Auth](https://www.zcraftstudios.com/products/z-auth-modern-authentication-plugin)** plugin for Velocity and BungeeCord, add login and session handling for networks that allow offline-mode players. ## Test like a real player 1. Join with a normal account and check how long verification takes. 2. Reconnect quickly several times and check you are not throttled. 3. Test from mobile, Bedrock through Geyser, and a different network. 4. Confirm staff can always join during an incident. 5. Check false positives in the plugin's logs. ## Incident checklist 1. Confirm it is an attack: look at the console, connection counts and your host's network graphs. 2. Enable the strictest mode your anti-bot plugin offers, or temporarily turn on the whitelist. 3. Block abusive address ranges at the firewall or the host's panel. 4. Contact your host if traffic is volumetric. 5. Keep logs, with timestamps and sample addresses. 6. Announce the issue to players on Discord. 7. After it ends, relax restrictions gradually and review what worked. Never retaliate against addresses or networks. Report abuse to your host and keep evidence. ## Mistakes to avoid - Exposing backend servers directly while using a proxy - Turning off `online-mode` to let bots through "temporarily" - Throttling so hard that normal players cannot rejoin after a crash - Installing three anti-bot plugins that conflict - Not having a backup, a staff contact route or a Discord announcement plan ## Related guides - [Dealing With Cheaters on a Minecraft Server](https://www.zcraftstudios.com/blog/minecraft-server-cheaters) - [Minecraft RCON Security Guide](https://www.zcraftstudios.com/blog/minecraft-server-rcon-security-guide) - [Port 25565 Not Working](https://www.zcraftstudios.com/blog/minecraft-server-port-25565-not-working) - [Minecraft Staff Training Checklist](https://www.zcraftstudios.com/blog/minecraft-server-staff-onboarding) ## Continue reading - [Velocity Modern Forwarding Setup and Security Checklist](https://www.zcraftstudios.com/blog/velocity-modern-forwarding-setup-checklist) - [Minecraft SMP Season Reset Checklist and Player Trust](https://www.zcraftstudios.com/blog/minecraft-server-season-reset-guide) - [Minecraft Staff Training Checklist: Permissions and Logs](https://www.zcraftstudios.com/blog/minecraft-server-staff-onboarding) - [Minecraft Server Event Checklist for Tournaments](https://www.zcraftstudios.com/blog/minecraft-server-event-checklist) [ Previous guide Find Minecraft Plugin Conflicts Without Losing Data](https://www.zcraftstudios.com/blog/minecraft-server-plugin-conflict-debugging)[ Next guide Pterodactyl Server Stuck Starting? Fix Wings and Ports](https://www.zcraftstudios.com/blog/minecraft-pterodactyl-panel-server-stuck-starting)