"How do I stop people wrecking my server?" doesn't have one answer — it has three plugins that each solve a different piece, and they work best together. This guide is the map: what each layer does, why you want all three, and how they fit without stepping on each other. The individual how-to guides live behind the links; this one is about composition.
| At a glance | |
|---|---|
| You need | A plugin-capable server (Purpur, PaperSpigot, Spigot family) |
| Foundation | LuckPerms for who can use these tools |
| Plan | Any |
Prevention vs recovery
The single most useful way to think about protection: some plugins prevent damage, and one plugin lets you recover from it. You want both, because prevention is never perfect.
- Prevention stops the bad action from happening — no block-breaking at spawn, no building in someone else's claim.
- Recovery is the safety net for everything prevention missed — a rogue op, a plugin gap, a clever exploit. It lets you undo the damage after the fact.
A server with only prevention is one exploit away from a ruined spawn with no way back. A server with only recovery lets grief happen freely and makes you clean it up constantly. Together they cover each other.
The three layers
| Layer | Plugin | Job | Type |
|---|---|---|---|
| Fixed-area protection | WorldGuard | Admin-defined regions — spawn, safe zones, event arenas — with flags controlling PvP, building, mob spawning, and more | Prevention |
| Player self-service claims | A claims plugin (e.g. GriefPrevention) | Players protect their own builds without asking staff — claim a chunk, trust friends, done | Prevention |
| Logging and rollback | CoreProtect | Records every block placed and broken so you can inspect who did what and roll it back | Recovery |
WorldGuard — the areas you control
WorldGuard is for the places you decide are special: spawn, a market district, a PvP arena. You mark a region (using WorldEdit selections — see WorldEdit basics) and set flags on it: pvp deny in the safe zone, build deny at spawn, and so on. It's the admin's tool for fixed, important areas. Start by protecting spawn — it's the space most likely to get hit.
A claims plugin — the areas players control
WorldGuard doesn't scale to "every player's house," and you don't want to hand-define a region for everyone. A claims plugin lets players protect their own land themselves. GriefPrevention is the classic, free, no-frills pick: players claim an area (traditionally with a golden shovel), trust their friends into it, and nobody else can build there. There are richer alternatives, but for most servers one solid claims plugin is plenty.
🎯 Good to know: Run one claims plugin, not two. WorldGuard (fixed admin regions) and a claims plugin (player self-service) do different jobs and coexist fine. But two competing claim systems fighting over the same land is a recipe for confusion and conflicts — pick one for player claims and stick with it.
CoreProtect — the undo button
CoreProtect quietly logs everything: who placed a block, who broke one, when. When grief happens anyway, you inspect the area (/co inspect, then punch blocks to see their history) and roll back the damage (/co rollback with a player and time window) as if it never happened. The one rule: install it early. It can only roll back what it recorded, so it has to be running before the grief, not installed in a panic afterward.
How the layers cover each other
Picture a griefer at spawn:
- WorldGuard stops them breaking blocks in the spawn region outright — most attempts die here.
- They wander to a player's house instead — the claims plugin stops them, because that land is claimed.
- They find a gap prevention didn't cover — maybe a flag you forgot, maybe an op mistake. CoreProtect logged it, so you roll it back in seconds.
Each layer catches what the one before missed. That's the whole point of a stack.
💡 Tip: All three lean on LuckPerms. Their admin commands — defining regions, running rollbacks — should be gated behind a staff rank so regular players can't protect the wrong things or undo legitimate builds. Set your rank ladder first (LuckPerms ranks).
The honest limits
- Protection is only as good as your ops. None of this stops a trusted operator with a grudge — CoreProtect can undo their damage, but nothing prevents someone you gave power to. Hand out op sparingly.
- Rollbacks have a horizon. CoreProtect keeps history for as long as its database holds; very old grief may age out. Roll back promptly.
- Flags and claim rules can conflict if you're careless — e.g. a WorldGuard
build denyregion overlapping a player claim. Keep admin regions and player-claim zones in different areas where you can.
Verify it works
Test each layer as a non-op: try to break a block at spawn (WorldGuard should stop you), try to build in a claimed area (the claims plugin should stop you), then break one of your own blocks and run /co inspect on it to confirm CoreProtect logged it. If all three behave, your stack is live.
Troubleshooting
- A plugin won't protect anything — check it loaded (
/plugins, green) and that the region/claim actually exists. WorldGuard regions need defining; claims need claiming. - CoreProtect has nothing to roll back — it was installed after the grief. It only records from the moment it's running. See CoreProtect usage.
- Players can't claim land — the claims plugin may need a permission granted or a claim tool; check its config and your LuckPerms setup.
- Regions and claims fighting each other — you may have overlapping systems on the same land, or two claims plugins. Separate their zones, and run only one claims plugin.