How was my server accessed without authorization / can you find who?

If someone got into your server without permission, your in-game logs hold most of the answers. This article walks through where to look, the usual causes, and how to lock things down.

Where to look

Start by gathering evidence before you change anything.

• Check your in-game logs: CoreProtect (if installed) for block/inventory history, and the raw logs/ folder from the Files tab for connections and commands.

Together these show what happened, even when they cannot always show who by name.

Common causes and fixes

Unauthorized access almost always traces back to one of these.

1. A shared or leaked panel password — change your password immediately.
2. A subuser with too many permissions — review the Sub-users page and trim access to only what each person needs.
3. OP handed to the wrong person — audit your operators and de-op anyone who should not have it.
4. An offline-mode ("cracked") server without auth — anyone can log in using any username, so enable an auth/login plugin or a whitelist.

Tip: On cracked servers, a whitelist plus a login-auth plugin is the single biggest security upgrade you can make.

Frequently asked questions

Can you tell me exactly who did it? Not always. We cannot reliably identify a specific individual, but your in-game logs (and CoreProtect, if installed) show the actions that were taken, which usually points to the cause.

What should I do first? Change your panel password, then review the Sub-users page and your OP list. Most incidents come from access that was broader than it needed to be.

How do I stop name impersonation? If you run an offline-mode server, add a whitelist and an authentication plugin so a username alone is not enough to get in.