Symptoms: The whitelist is on but everyone can join, the whitelist is being bypassed, unauthorized players get onto the server

Possible Causes

  • The online-mode=false setting weakens whitelist checking
  • It can be bypassed through BungeeCord
  • No kick is applied because enforce-whitelist=false

Step-by-Step Fix

Step 1

Check the online-mode setting in the server.properties file

bash
grep online-mode server.properties

Step 2

If you use BungeeCord, close the backend servers to outside access — only accept connections from the proxy IP

bash
iptables -A INPUT -p tcp --dport 25565 ! -s 127.0.0.1 -j DROP

Step 3

Enable the whitelist and turn on enforce mode

bash
/whitelist on

Step 4

Set enforce-whitelist to true in the server.properties file

bash
enforce-whitelist=true