How the whitelist works
Set white-list=true in server.properties and restart. From then on the server checks each connecting player against whitelist.json and disconnects anyone who is missing, before they ever reach the world.
Names are added with whitelist add PlayerName and removed with whitelist remove. The whitelist command itself requires operator level 3, so moderators can manage the guest list without full control.
What it does not protect
The whitelist is an access gate, not a security system. It does not stop an authorised player from griefing, and it depends entirely on online mode to be meaningful: with online-mode=false, names are self-declared, so anyone can claim to be a whitelisted player.
It also says nothing about what players do once inside, which is what land claims and logging plugins are for.
Other access gates and how they differ
An IP ban blocks an address rather than a name, which is harder to evade but risks hitting everyone behind the same home connection. A player ban blocks the account, and a whitelist blocks everyone you have not invited.
In practice a small private server wants a whitelist plus a handful of trusted operators. Public servers want the opposite trade-off: an open door with layered protection inside.
FAQ
Common questions
Does the whitelist work if a server address leaks?
Yes, and that is its main value. Even if strangers discover your address, the server refuses them at login unless you have added their name. Fewer unauthorised attempts also keeps your logs readable.
Can I whitelist someone who is offline or has never played?
Yes — you add a name, not an account session. The name must be spelled exactly as the player’s Minecraft username, since that is what online mode reports to the server.
