Every Minecraft server that has ever been seriously griefed from the inside has the same story: one staff account, one reused password, one night of cleanup. This guide exists to make that story harder to write. It covers two things that work together and are almost always deployed badly or not at all: real second-factor enforcement on every surface a staff member touches, and audit logs that survive long enough to answer the question “who did this, and when.”

It is written for owners, administrators, and the staff leads who hand out ranks. The recommendations below come from rebuilding access on a Paper 1.21 network with LuckPerms, CoreProtect, DiscordSRV, and a Pterodactyl panel, then simulating a stolen moderator account, a leaked Discord token, and a compromised panel password. Nothing here requires a paid service.

How Staff Ranks Actually Get Stolen

An admin rank is the crown jewel of a Minecraft server, and it is usually guarded worse than a player’s shop balance. It carries four things at once: world edit and region control, the ability to give items, the ability to ban or silence people, and often indirect access to the panel and the Discord. An attacker who takes a staff account does not need to find an exploit, because you handed them the exploit.

In practice, staff compromise comes through a short list of doors:

• Reused passwords. A staff member’s email shows up in a breach dump, and the same password opens their Minecraft account, their panel login, and their Discord.
• Discord account takeover. The most common entry point on networks. A fake “staff application” DM, a malicious OAuth app, or a stolen token gives an attacker your staff channel and whatever bot or link verification is trusted there.
• Session hijack. Session tokens are stolen by malware on a staff member’s PC. The attacker never needs the password, and the real owner sees no failed login.
• Plugin database dumps. Old auth or forum plugins store weak hashes. A leaked SQL dump becomes a password list within hours.
• Insider abuse. A staff member who was demoted but never fully de-permissioned, or a “temporary” helper who kept their group.

Layering 2FA Across Every Staff Surface

Second factors only help if they cover the surface an attacker actually reaches. That means four places, not one.

Discord: require 2FA for moderators

Discord has a built-in server setting that requires anyone with a moderation role to have 2FA enabled before they can use moderation actions. Turn it on under Server Settings, Safety Setup, and set the verification level high enough that new accounts cannot post in staff channels. Then link game accounts to Discord through DiscordSRV so a linked account is the only one that can claim a staff rank in game.

Panel and SSH: TOTP plus keys, never passwords

Pterodactyl supports per-account TOTP, and you should treat it as mandatory for every user with console access, not just owners. The official documentation covers enabling it per account and enforcing it at the panel level. For the host itself, disable password authentication entirely, require passphrase-protected SSH keys, and consider a hardware security key for the one or two accounts that can reach root. Our walkthrough in Secure Your Minecraft Server: SSH Keys & UFW Firewall Guide covers the key setup and firewall side, and Fail2ban adds a cheap blocking layer for anything still exposed.

In-game ranks

Minecraft itself has no strong second factor, so stop pretending an auth plugin solves this. Require staff to use premium accounts, never share logins, and tie promotions to a Discord-verified identity so a rank cannot be handed to an unknown alt.

Access surface	Protection	Failure mode if missing
Panel (Pterodactyl)	Per-user TOTP, subuser limits, no shared owner login	Full console and file access from one leaked password
SSH / host	Key-only auth, passphrase, hardware key for root	Root compromise, silent backdoor install
Discord	Moderator 2FA, high verification level, audit log	Staff channel takeover, social-engineered demotions
In-game rank	LuckPerms least privilege, timed promotions, linked accounts	Instant world edit, item spawning, mass bans

Building an Audit Trail You Can Actually Read

Logs are worthless if they are scattered across three console scrollbacks and a Discord channel that auto-deletes. Build one trail with four layers, each answering a different question.

• Command logs. A command spy plugin records every executed command with the sender, timestamp, and world. This answers “what did this account do” even for commands that leave no world trace.
• World evidence. CoreProtect records block and container changes and lets you roll back a specific player’s edits inside a time window. Our guide on Using CoreProtect for Grief Rollbacks and Investigations covers the lookup and restore workflow; the key point here is that CoreProtect is evidence, not just an undo button.
• Retention. Rotate and archive server logs off the host. Thirty days is the floor, ninety is better, and every log that predates your last backup is evidence you no longer have.
• High-risk mirrors. Send a Discord webhook copy of sensitive commands — op, deop, gamemode, give, ban, whitelist, stop, plugman — to a private channel that staff cannot delete from. If the network goes down, you still have a copy.

One ethical footnote: audit logs contain player IPs, private messages, and chat. Keep only what you need, restrict who can read the archive, and set a deletion date. Retaining everything forever is a privacy liability, not diligence, and in many jurisdictions it is a legal one.

Limiting Blast Radius with LuckPerms

Assume a rank will eventually be stolen, and design so the thief has minutes of damage, not hours. LuckPerms gives you three tools for that: negative permissions, contexts, and temporary groups.

Start by splitting the monolithic admin group. A moderator should not inherit luckperms.*, worldedit.*, coreprotect.restore, essentials.give, or plugman.*. Grant the narrow node instead of the wildcard, and use explicit negative nodes to strip the worst commands from every group below owner:

/lp group moderator permission set worldedit.* false
/lp group moderator permission set essentials.gamemode false
/lp group moderator permission set luckperms.* false

Contexts then scope what remains. Bind dangerous permissions to a specific server or world so a creative-mode shortcut cannot be used on survival, and use tracks for progression instead of one permanent promotion. A timed grant expires on its own:

/lp user Steve parent addtemp admin 7d
/lp user Steve parent addtemp moderator 30d server=survival

Finish with a two-person rule for irreversible actions. WorldEdit regeneration, CoreProtect restores, world deletion, and whitelist changes are the operations that end servers, so they belong to an account two people can reach and an action your webhook mirrors.

Quarterly Access Reviews and an Incident Playbook

Permissions rot. Staff leave, ranks linger, and subuser accounts from two years ago still work. A quarterly review takes under an hour and is the single highest-value security habit on this list.

• Export the member list of every staff group with /lp group <name> listmembers and compare it to the actual roster.
• Check the panel’s user list and last-activity column for accounts nobody recognizes.
• Review ~/.ssh/authorized_keys and remove keys belonging to former staff.
• Cross-check Discord roles against the roster and the audit log for role changes made outside process.
• Revoke first, ask later: remove the group, delete the panel subuser, revoke the key, rotate any shared secret they knew.

Then write the playbook while nothing is on fire:

1. Put the server in maintenance or whitelist-only mode and remove the suspect account’s group.
2. Kick the session, force a password reset, and revoke panel and Discord sessions.
3. Pull CoreProtect and command logs for the account’s last 72 hours.
4. Roll back unauthorized changes, then rotate panel, database, and bot tokens.
5. Notify players honestly and record what happened in a short post-mortem.

A proxy-level blocklist plus the rules in Setting Up a BungeeCord and Velocity Firewall stops the attacker from simply reconnecting through a backend port while you work.

Pros and Cons of Locking Down Staff Access

Pros: a stolen account becomes recoverable instead of fatal; you can prove what happened to players and to a host; staff know their actions are visible, which reduces casual abuse; and the whole stack costs nothing but setup time.

Cons: 2FA adds friction exactly when you need speed during an incident; log archives consume disk and create privacy obligations; timed promotions need calendar discipline; and none of it stops a determined insider with legitimate access, which is why the review matters more than the tooling.

Common Mistakes and Expert Tips

• Sharing the console owner account. The moment two people use one login, every log entry becomes useless. One account per person, always.
• One admin in ops.json. A single operator entry with full power is the whole server in one file. Keep ops empty and manage power through LuckPerms.
• Deleting trust instead of permissions. Removing someone from Discord is not a demotion. Strip the group, the panel subuser, and the SSH key in the same session.
• No log retention. A one-week log window means an attacker who waits two weeks is invisible. Archive off-host for at least a quarter.
• Staff passwords in one shared doc. A single document becomes a single point of failure with a friendly interface. Use a password manager with per-person vaults.

Frequently Asked Questions

Do This Before Your Next Staff Hire

You do not need every item on this list at once. Start with the two that fail catastrophically: TOTP on the panel and a private staff Discord with moderator 2FA enforced. Then add command logging, a CoreProtect retention setting, and a quarterly roster review. When the next account gets stolen, and one eventually will, you will spend an evening rolling back one player’s edits instead of explaining to your community why the world is gone.