: Specifically the sections on "Security" and "Common Attacks."
If using BungeeCord, use a firewall (like UFW or iptables) to ensure the backend servers accept connections from the proxy's IP. Enable IP Forwarding: ip_forward in BungeeCord and bungeecord: true spigot.yml to prevent UUID spoofing. Update Regularly:
Check your logs for these signs:
Do not run AuthMe 2.x or 4.x. You need (or the fork AuthMeReloaded ). Check GitHub commits weekly.
AuthMeReloaded is a primary security layer for Minecraft servers that operate in offline mode (where online-mode=false in the server properties). Since offline servers do not verify accounts with Mojang's official servers, anyone can join using any username. AuthMe fixes this by requiring players to: with a password upon their first join.
If you're aiming to develop a plugin or a feature related to AuthMe or authentication in general: