For a private Minecraft Java server, enable the Minecraft server whitelist in the server console with whitelist on, then add each invited player with whitelist add PseudoAmi. Replace PseudoAmi with their actual Java profile name. On a standalone server, keep online-mode=true so the server authenticates accounts as well as checking invitations.
Watch the animated explanation (English audio)
Keeping the address between friends is not access control. A reachable server can be discovered without appearing on a public server list. The Minecraft server whitelist decides who may join; it does not hide the listening port.
How scanners find a server without joining it
Discovery, service identification and login are separate steps. A scanner can find a reachable port, another check can identify Minecraft, and a player can then attempt to log in. None of those earlier observations proves that someone entered your world. A status request or unfamiliar connection in a log is not, by itself, evidence of a compromise.
Java normally uses TCP port 25565, but a port number does not prove which service is listening. Bedrock uses a different, UDP-based game protocol. Changing a port or hiding a server-list entry does not replace an admission rule.
If Nmap is already installed, this optional example checks only TCP port 25565 on the machine where you run it:
nmap -p 25565 127.0.0.1
It assumes your own server is running on that same machine and port. In a container, localhost refers to that container, not necessarily the host. This does not check your public Internet exposure or identify Minecraft by itself. An open result means the TCP port accepts connections, not that the whitelist is disabled. A closed or filtered result does not diagnose whitelist behavior. You do not need Nmap to follow the setup below.
Nmap's service detection documentation explains why port-based labels and actual service identification differ. Nmap is one audit tool, not necessarily the tool a particular Minecraft scanner uses.
Enable a Minecraft server whitelist in five steps
These instructions cover the built-in Java dedicated-server whitelist, including Vanilla and Paper. Check your exact server version and any fork or plugin overrides. They are not Bedrock commands. You need access to the correct server console, invited players' Java profile names, and a backup before configuration changes.
1. Confirm authentication and server scope
On an Internet-facing standalone Java server, check this existing setting in server.properties:
online-mode=true
Authentication verifies the account; it does not mean that every authenticated player is invited. Do not disable authentication to resolve an invitation problem.
If your server is a backend behind a proxy, stop before changing this setting. Authentication, secure identity forwarding and restricted backend access must match the proxy's documented design. Blindly switching backend settings can break connections or leave identities unprotected; ask the network administrator to verify the whole configuration.
2. Enable the Minecraft server whitelist
In the server console, enter:
whitelist on
Console commands do not start with a slash. In in-game chat, an authorized administrator uses /whitelist on. An ordinary player cannot administer the list.
3. Add invited profiles and inspect the list
Run these commands separately, replacing the example name:
whitelist add PseudoAmi
whitelist list
Repeat the add command for each friend. Use the Java profile name, not a Discord nickname or an assumed Bedrock gamertag. Read the real console response and confirm the expected profiles appear. The Minecraft Wiki whitelist command reference documents the syntax and the Java operator exception.
4. Verify new connections with non-operator accounts
Ask an invited non-OP player to disconnect and reconnect. Then verify that a non-OP account absent from the list cannot join. Use accounts you control or willing participants, not strangers' servers. Java operators can bypass the Minecraft server whitelist, so your administrator account alone cannot prove the filter works.
Check actual admission or rejection and the server logs. A working server-list ping is not a failed whitelist: the service can remain visible while rejecting an uninvited login.
5. Remove access when an invitation ends
To remove a profile from the invitation list:
whitelist remove PseudoAmi
Check the list again. Treat new connections and existing sessions separately: enabling the Minecraft server whitelist or removing a name is not a promise that an already connected player is immediately disconnected. The separate enforce-whitelist setting and server implementation affect enforcement. Do not change it casually as part of this tutorial. If access must end now, explicitly disconnect the player through your administration tools and verify a new login is denied.
If editing properties instead of using console commands, back up the configuration and world, stop cleanly, edit the correct instance, then perform a planned restart. Recheck admission afterward. Do not assume a file edit takes effect immediately or use a restart without warning active players.
Troubleshooting: a friend is blocked, or a stranger still joins
If a friend is rejected, confirm the exact Java profile name, inspect the list, and check that you changed the console for the address they actually use. Read the rejection reason: account authentication, incompatible versions and modpack mismatches are different problems. Do not turn the whitelist off just to conceal the error.
If an unlisted player joins, check operator status, whether this is a new login rather than an existing session, and whether a proxy or plugin changes admission. Confirm the Minecraft server whitelist is enabled on the correct server. Protect administrative credentials and grant OP only where necessary.
Paper's server properties reference describes authentication, the whitelist and enforcement settings; fork-specific documentation does not establish every other server's behavior.
Bedrock Dedicated Server uses an allowlist
For Microsoft's Bedrock Dedicated Server, the documented property is allow-list=true in server.properties, with invited players in allowlist.json. Follow Microsoft's Bedrock server properties documentation and the administration instructions for your version. Do not paste the Java commands above into Bedrock or assume the Java OP exception applies. Back up before editing and plan any required restart.
What the Minecraft server whitelist cannot protect
A whitelist does not prevent network discovery or DDoS attacks. It cannot stop an invited player from misbehaving, secure a compromised invited account, or replace updates and recoverable backups.
A permissions plugin does not automatically prove that guests cannot join or build. On a deliberately public server, new players are welcome: verify guest restrictions, region protection and moderation rather than applying a friends-only admission policy to everyone.
Frequently asked questions
Does online mode make a server private?
No. It authenticates accounts. A private server also needs an explicit invitation policy, such as a whitelist, with operator access kept under control.
Should port 25565 close after enabling the whitelist?
No. The game service must remain reachable for invited players. The Minecraft server whitelist filters admission to the game, not the network port.
Is renting a server enough to control who joins?
No. Home hosting and rented hosting both need appropriate access settings. Compare the operational choices in our guide to hosting Minecraft with friends at home or on a rented server. If you choose rented hosting, review SharpHeberg's Minecraft hosting offers, then configure and verify your invitation list before the next session.