---
title: "Velocity Modern Forwarding Setup and Security Checklist | ZCS"
description: "Understand how Velocity forwards player identity to Paper backends, why matching secrets matter, and how to validate proxy security and UUID consistency."
url: "https://www.zcraftstudios.com/blog/velocity-modern-forwarding-setup-checklist"
updated: "2026-10-20T07:16:50.972429+00:00"
source: "ZCraft Studios"
---

> Site index for AI agents: https://www.zcraftstudios.com/llms.txt (full reference: https://www.zcraftstudios.com/llms-full.txt). Every page is available as Markdown by adding `.md` to its URL or sending `Accept: text/markdown`.

1. [Home](https://www.zcraftstudios.com/)
2. [Blog](https://www.zcraftstudios.com/blog)
3. Velocity Modern Forwarding Setup and Security Checklist

[ All posts](https://www.zcraftstudios.com/blog)

# Velocity Modern Forwarding Setup and Security Checklist

ZCraft StudiosOct 15, 2026Updated Oct 20, 2026

Understand how Velocity forwards player identity to Paper backends, why matching secrets matter, and how to validate proxy security and UUID consistency.

## In this guide

- [Why forwarding needs attention](#why-forwarding-needs-attention)
- [Compare forwarding modes](#compare-forwarding-modes)
- [Plan the public and private endpoints](#plan-the-public-and-private-endpoints)
- [Prepare a staging network](#prepare-a-staging-network)
- [Test identity continuity](#test-identity-continuity)
- [Troubleshoot by symptom](#troubleshoot-by-symptom)
- [Security reminders](#security-reminders)
- [Related reading](#related-reading)

## Velocity Modern Forwarding: Setup and Verification

Velocity proxies can pass player IP addresses, UUIDs and skins to backend Minecraft servers. Correct player information forwarding is essential for consistent identity, inventories, permissions and punishments.

The exact configuration depends on your Velocity release, backend server implementation and Minecraft version. Treat this as a verification checklist alongside the [official Velocity forwarding guide](https://docs.papermc.io/velocity/player-information-forwarding/).

## Why forwarding needs attention

A proxy sits between players and backend servers. If the proxy and backend disagree about how player identity is forwarded, the same user may appear with inconsistent identity data. This can look like missing inventory or suddenly changed permissions after a migration.

## Compare forwarding modes

| Mode | General use | Important consideration |

| --- | --- | --- |

| Modern forwarding | Supported newer clients and compatible backends | Preferred for supported environments |

| Legacy forwarding | Older compatibility requirements | Requires careful network protection |

| BungeeGuard | Some legacy-compatible setups | Secret-based additional protection, not equivalent to modern forwarding |

These modes should not be mixed indiscriminately. Official documentation explains which implementations support each mode.

## Plan the public and private endpoints

```
Minecraft players
       |
  public Velocity proxy
       |
  trusted private network
       |
  Paper backend servers
```

The backend should not accept arbitrary public client connections. Modern forwarding provides identity information protection but **does not replace network-level access controls**. PaperMC explicitly recommends using a firewall or other appropriate isolation.

## Prepare a staging network

Create one proxy and one backend outside production. Record game, proxy and Java versions. Set the forwarding mode supported by both implementations, and configure the shared secret using the documented project settings. Never place that secret in screenshots, chat or frontend files.

Test with an authorized player account. Make sure the public proxy is the only intended route to the backend.

## Test identity continuity

1. Join through the proxy with a normal account.
2. Confirm the expected UUID and skin are preserved.
3. Verify permissions and inventory.
4. Disconnect and reconnect.
5. Restart the backend and reconnect.
6. Switch between backends if using multiple servers.
7. Ensure the backend rejects unwanted direct connections.

A successful proxy login is not enough if inventory, claims or moderation records are tied to the wrong user identity.

## Troubleshoot by symptom

| Symptom | Investigation |

| --- | --- |

| Backend rejects login | Mode and forwarding-secret consistency |

| Player appears with empty inventory | UUID/identity mismatch and existing backups |

| Works on one backend only | Backend-specific configuration |

| Proxy cannot reach server | Addressing, firewall and listener configuration |

| Direct public access still succeeds | Missing network isolation |

When restoring identity-related data, preserve the matching world and plugin databases. Random renaming of playerdata files can cause further data loss.

## Security reminders

Never expose backend ports simply to test connectivity. If the provider does not offer private networking, use its officially supported access-control design. Do not weaken authentication when diagnosing identity failures.

## Related reading

- [Official Velocity forwarding guide](https://docs.papermc.io/velocity/player-information-forwarding/)
- [Official Velocity security guide](https://docs.papermc.io/velocity/security/)
- [Velocity Network Setup](https://www.zcraftstudios.com/blog/velocity-proxy-network-setup)
- [Missing Player Inventory](https://www.zcraftstudios.com/blog/minecraft-server-join-but-inventory-gone)
- [Firewall Hardening](https://www.zcraftstudios.com/blog/minecraft-server-firewall-hardening)

**Takeaway:** Secure the backend network, keep forwarding settings consistent and verify identity-sensitive features before public migration.

## Continue reading

- [Minecraft RCON Explained: Errors and Security Checklist](https://www.zcraftstudios.com/blog/minecraft-server-rcon-security-guide)
- [Minecraft SMP Season Reset Checklist and Player Trust](https://www.zcraftstudios.com/blog/minecraft-server-season-reset-guide)
- [Minecraft Staff Training Checklist: Permissions and Logs](https://www.zcraftstudios.com/blog/minecraft-server-staff-onboarding)
- [Minecraft Join Spam and Bot Attacks: Defense Checklist](https://www.zcraftstudios.com/blog/minecraft-server-antibot-join-spam-defense)

[ Previous guide PaperMC Config Files Explained: Global and Per-World](https://www.zcraftstudios.com/blog/minecraft-paper-configuration-files-explained)[ Next guide Paper Reload vs Restart: Why Plugins Break After /reload](https://www.zcraftstudios.com/blog/paper-reload-versus-restart-explained)