Whitelists, admins, and keeping strangers off a private server

A friend server should be for friends. Here's how to keep it that way.

Minecraft: whitelist

A whitelist means only listed players can join. Run these in the panel console (no slash needed there):

• whitelist on — turn it on
• whitelist add PlayerName — let someone in
• whitelist remove PlayerName — take someone off
• whitelist list — see who's on it

Also set enforce-whitelist=true in server.properties. That kicks anyone online who isn't on the list when the whitelist reloads.

Bedrock players via Geyser/Floodgate have names with a prefix (often a dot, like .PlayerName). Use the name exactly as it appears in the console when they try to join.

Minecraft: admins (ops)

• op PlayerName gives full admin. Only give it to people you'd trust with the whole world.
• deop PlayerName takes it away.
• On Paper, a permissions plugin like LuckPerms lets you give people some powers without full op.

Valheim: password and lists

• Password: set one in the panel's startup settings. Only share it with your group. It must be at least 5 characters and can't contain the server name.
• adminlist.txt: player IDs that get admin (they can use the dev console's admin commands).
• permittedlist.txt: if it has any IDs in it, only those players can join. That's Valheim's whitelist.
• bannedlist.txt: IDs that can never join.

These files are in the server's save folder in the Files tab. Put one ID per line, then restart.

Finding a player's ID: when someone connects, the server console logs the ID it sees for them. With crossplay on, IDs can look different from a plain Steam ID, so copy the one from the console rather than guessing.

Other good habits

• Don't post your server address publicly if you want it private.
• Keep backups. If someone griefs, you can roll back.
• Need a hand? Tell us on Discord who should be in. We'll set it up.