Minecraft Grief Protection and Rollback

Someone logs in, hollows out your base, empties the chests and logs off. This is the most common reason a Minecraft server owner installs their first plugin, and it is the one problem where reacting well matters more than reacting fast — a panicked world restore can cost you more than the griefer did.

There are three separate jobs here, and the tools that do them are not interchangeable.

This guide covers all three on a Java Edition server. Plugin installation itself is covered in How to install plugins for Minecraft Java Edition. Who is allowed on the server at all is a separate question, covered in Minecraft Whitelist and Ban Management.

Start With What Vanilla Already Gives You

Two vanilla levers cost nothing and are worth setting on day one.

Spawn Protection

spawn-protection=16

spawn-protection defines a square around world spawn that only operators can edit. The number is a radius, not a side length — the protected square is 2x+1 blocks across, so the default 16 covers 33×33. 1 protects 3×3, and 0 disables it entirely.

Spawn protection turns itself off if you have no ops

If there are no operators in ops.json, the server disables spawn protection automatically — otherwise nobody could build there at all. That surprises people who set it on a brand-new server and find it doing nothing: op yourself first. Bypassing spawn protection is granted at operator permission level 1, so even a junior moderator can build inside it. See Minecraft Op Permission Levels.

Game Rules That Limit Damage

Game rules live in the world save rather than a config file, so they apply immediately and persist across restarts. Four matter for grief control:

gamerule mob_griefing false
gamerule tnt_explodes false
gamerule fire_spread_radius_around_player 0

These are the current, post-1.21.11 names

Java Edition 1.21.11 moved every game rule into a registry and renamed them from camelCase to snake_case. fire_spread_radius_around_player in particular replaced the old doFireTick rule rather than being renamed from it, so a find-and-replace on an old guide will not get you there. On 1.21.10 and earlier the old names still apply. The full mapping is in Minecraft Server Commands.

Vanilla gives you one protected square at spawn and a handful of world-wide switches. It cannot protect a player's base, cannot tell you who broke a block, and has no undo at all. That is the gap the next two plugins fill.

CoreProtect: Logging and Rollback

CoreProtect is the de-facto standard block logger for Paper, Spigot and Purpur. It records block placements and breaks, container transactions, chat, commands, kills, spawns and logins, and can replay any slice of that log backwards. Install it, restart, and it logs from that moment — there is nothing to configure first.

Step One: Inspect

Turn the inspector on with /co i. The plugin's own help lists what each action tells you:

/co i again turns it off. For most incidents this is the whole investigation: right-click into the hole where your wall used to be and read the name.

Step Two: Look Up

/co lookup takes the same parameters as /co rollback, which is why it is worth learning once.

Actions are block, container, inventory, item, click, kill, spawn, session, chat, command, sign and username. Several take a prefix — + for added, - for removed — so a:-block is breaks only, a:+container is items put into chests.

/co lookup i:diamond_ore t:1h a:-block

/co lookup u:Steve t:3d a:container

Results are paginated: /co l <page> moves between pages and /co l 1:10 returns ten lines starting at page one. Adding #count returns just the number of matching rows, which is the fastest way to size an incident before touching anything.

Step Three: Roll Back

Rollbacks and lookups have different default radii

This is the mistake that turns a small incident into a big one. A lookup with no r: searches the entire server. A rollback with no r: uses a radius of 10 blocks around you. The command you just ran to survey damage across the whole map will, if you swap lookup for rollback, fix only the 10 blocks nearest your feet — and you will believe the job is done. Always state the radius on a rollback.

Preview first. #preview runs the rollback visually for you alone without changing the world:

/co rollback u:Griefer t:2h r:#global #preview
/co rollback u:Griefer t:2h r:#global

If the result is wrong, /co undo reverses your last rollback or restore. Two refinements are worth knowing: a:-block rolls back only what they broke, leaving their placements alone, and e:stone,dirt excludes block types you would rather keep. With WorldEdit installed, r:#worldedit (or r:#we) limits the rollback to your current selection — the cleanest way to repair one building without touching its neighbours.

Every CoreProtect command has its own permission, all defaulting to op: coreprotect.inspect, coreprotect.lookup, coreprotect.rollback and so on. There are also per-action child permissions such as coreprotect.lookup.chat and coreprotect.lookup.command, designed to be set negative so a junior moderator can investigate block damage without being able to read everyone's chat. Setting a negative node on a rank is a LuckPerms job rather than a CoreProtect one — see How to Set Up LuckPerms Permissions for Minecraft.

Retention: Your Rollback Window Is Finite

/co purge t:30d

From the console, /co purge can delete anything older than 24 hours. In-game it will only delete data older than 30 days — a guard rail against someone purging the evidence of their own griefing. You can scope it to a world (r:#world_nether) or to block types (i:stone,dirt). CoreProtect 24.0 and later can also purge on a daily schedule via auto-purge in config.yml, though that feature is exclusive to the project's Patreon builds; otherwise put a /co purge on the panel's Schedules tab.

Retention is the real limit on what you can undo

Whatever t: value you purge at is your rollback window. A griefer who plants a trap and triggers it two months later is past the end of a 30-day log, and CoreProtect will have nothing to replay. Pick a retention period you can live with, and remember it is the number that decides whether an old incident is recoverable at all.

The database lives in plugins/CoreProtect/, selected by database-type in config.yml. Version 25.0 and later default new installs to an embedded DuckDB file; earlier builds use SQLite, or MySQL if you point them at one — create one from the Databases tab, per How to create a Database via your panel. As of August 2026 the current public Community Edition release is v24.0, which added Minecraft 26.1 support and sets its minimum at 1.16.5. A separate Fabric version exists, distributed through the project's Patreon rather than the main download page.

WorldGuard: Stop It Happening Again

CoreProtect tells you what happened. WorldGuard stops it, by letting you draw named 3D regions and say who may build in them.

WorldGuard needs WorldEdit, and a Bukkit-family server

WorldGuard requires a server implementing the Bukkit API — Paper, Spigot or Purpur. The vanilla jar cannot run plugins at all, and Forge, Fabric and Sponge are explicitly unsupported. It also requires the Bukkit build of WorldEdit, which is what selects the area a region covers. Install both jars together; WorldGuard will not start without WorldEdit.

Selecting an Area

A region can be a cuboid or a 2D polygon with a height. //wand gives you a wooden axe: left-click a block for position 1, right-click for position 2. If you would rather not carry an axe, //pos1 and //pos2 use where you are standing and //hpos1 / //hpos2 use the block you are looking at. //expand 10 up and //contract 10 down adjust the box afterwards — most people select the footprint at ground level, then expand up and down to cover the whole build.

Creating a Region

/rg define spawn
/rg addmember spawn g:builders

/region and /rg are the same command. A newly defined region already prevents building — you do not need to set any flag to protect it. Owners and members are who is allowed in; prefix a name with g: to add a permission group rather than a player.

Region IDs are case-insensitive and unique per world, and changes save automatically shortly after you make them. Regions may overlap, and when they do a player must be allowed to build in every overlapping region; a higher-priority region overrides a lower one.

Flags

/rg flag town pvp deny
/rg flag town greeting Welcome to town!

Omit the value to remove a flag: /rg flag town pvp. /rg flags <id> lists them all with their defaults. A useful subset:

Flags can be scoped to a group of players with -g, where the groups are all, members, owners, nonmembers and nonowners:

/rg flag mall pvp -g nonmembers deny

Do not use the build flag to protect or unprotect a region

This is WorldGuard's own strongest advice and it catches almost everyone. build is set implicitly by membership and it overrides other regions, so setting it by hand produces confusing results — and build deny stops members building too, and breaks pistons, because WorldGuard treats a piston as a region member like any other player. Use membership to allow building, and the passthrough flag to make a region stop protecting its area.

Protecting the Whole World

Every world has an implicit region called __global__ at the lowest possible priority. It does not exist until you touch it.

/rg flag __global__ passthrough deny

passthrough is short for "passthrough build permissions" and has nothing to do with movement. By default the global region lets build checks pass through; set it to deny and the world is protected by default, with normal regions above it granting access where you want it. That one command turns a free-for-all map into a claim-only one.

-g nonmembers does not work on __global__

Regions do not inherit from the global region, so "non-members" on __global__ means non-members of specifically the global region — which includes the members of every plot you have made. To apply a flag to non-members across many regions, create a template region and set it as their parent instead.

What WorldGuard Actually Blocks

Protection is comprehensive: breaking and placing blocks, opening inventories, TNT and gravel cannons fired from outside, tree-growth grief, pistons crossing the boundary, sign-change exploits, crop trampling, vehicles, paintings and item frames, doors, buttons, plates and levers, animal leashing, taming and shearing, and unauthorised projectiles. Water and lava flow protection exists but is off by default. Item drops, pickups and XP drops are deliberately allowed for non-members; change that with the item-drop, item-pickup and exp-drops flags.

Diagnostics

/wg debug testbreak is the one to reach for when a player insists they cannot build somewhere and you cannot see why. It runs a fake block break and lists the plugins that objected, most recent first — only the first entry matters.

Do not use WorldGuard's chest protection

WorldGuard has an old sign-based [Lock] chest protection feature. Its own documentation recommends against it for new setups, notes that it does not support UUIDs — so users lose access to their own chests if they change their name — and states that it will be removed in a future version. Use regions for area ownership, a claims plugin such as GriefPrevention if you want players protecting their own plots, or a single-block protection plugin such as LWC Extended, which is what WorldGuard's docs point you at.

Rollback Is Not a Backup

CoreProtect looks like a backup and is not one. A backup stores state: the world exactly as it was at 05:00. A rollback replays events: it walks a log of block changes backwards. That is what makes rollbacks surgical — one player, one time window, one area, with everyone else's work untouched. It also gives them four hard limits:

1. It can only undo what it logged. A world that will not load, a corrupted region file, a botched version upgrade, a world folder someone deleted — none of these fired a block-change event, so there is nothing to replay. Only a backup fixes those.
2. The log is bounded by your retention. Anything older than your last purge is gone.
3. It sits on the same volume as the server. CoreProtect's database is a file in plugins/CoreProtect/. A volume-level failure takes the world and the log together — which is exactly why plugin-side backups are not a substitute either.
4. It only covers blocks and inventories. Player data, permissions, plugin configs and datapacks are not in the log.

Backups have the opposite trade-off: they always work, and they are blunt. Restoring one loses everything every player did since the snapshot. That is why the right move on a griefing incident is almost always a targeted rollback, with the backup held in reserve.

Take a backup before you roll back

The rollback is the risky step — a wrong radius or time window can do more damage than the griefer. Trigger a manual backup from the Backups tab first. If the rollback goes wrong, /co undo is your first option and the fresh backup is your second. Scheduling is covered in Managing your Minecraft server and How to create a backup.

Incident Runbook

1. Stop the bleeding. If the griefer is still online, kick or ban them — see Minecraft Whitelist and Ban Management. If fire is spreading, /stopfire.
2. Take a manual backup, before you change anything.
3. Identify. /co i, then click a damaged block. Or /co lookup u:<suspect> t:6h r:#global #count to size it up.
4. Scope it. t: must reach back past the first damaged block; r: must cover all of it.
5. Preview. /co rollback u:<griefer> t:<window> r:#global #preview.
6. Commit the same command without #preview, then check the result. /co undo if it is wrong.
7. Prevent. Region the rebuilt area with /rg define, add the owners, and consider /rg flag __global__ passthrough deny if the map should not be open ground.

Common Issues

• /co rollback only fixed a small area. No r: was given, so it used the default radius of 10. Re-run with r:#global or a number.
• /co lookup returns nothing for an old incident. It is past your purge retention, or predates the CoreProtect install. Nothing logged before install exists.
• WorldGuard will not load. WorldEdit is missing, or you are on a server type that cannot run Bukkit plugins.
• A region does not protect anything. Its passthrough flag is allow, or a higher-priority overlapping region is overriding it. /rg info and /rg flags show both.
• Members cannot build in their own region. Look for an overlapping region they are not a member of — a player must be permitted in all of them. Or build has been set to deny, which blocks members too.
• Creepers still blow holes despite a region. creeper-explosion covers the region; mob_griefing false covers the whole world. Pick the scope you want.

FAQ

Can I roll back griefing that happened before I installed CoreProtect?

No. CoreProtect can only replay what it logged, and it starts logging when it starts running. For anything earlier, a world backup from before the incident is the only option.

How far back can CoreProtect roll back?

As far as your data goes, which is set by how often you purge — /co purge t:30d leaves a 30-day window. The log grows continuously, so the window is a deliberate trade against disk usage.

Will a rollback undo stolen items?

Container transactions are logged, so a:container rollbacks restore items taken from chests. Items already carried away in a player's own inventory are a different matter — a:inventory records those movements, but a rollback acts on the world, not on hunting items down across the map.

Do I need both?

They do different jobs and most established servers run both. CoreProtect is the higher priority: without it an incident is unrecoverable, whereas without WorldGuard it is merely repeatable.

Does WorldGuard work on a Forge or Fabric server?

No. WorldGuard requires the Bukkit API, meaning Paper, Spigot or Purpur. Forge, Fabric and Sponge are explicitly unsupported.

How do I let players claim land themselves?

WorldGuard has a /rg claim mode for self-serve regions, and GriefPrevention is the long-standing alternative built entirely around that idea — the self-service anti-griefing plugin since 2011, supporting Spigot, Paper and Purpur.

Does CoreProtect slow the server down?

It writes through a background consumer queue rather than on the main thread, and the busiest servers in the game run it. Profile before assuming — see Diagnosing Minecraft Server Lag.

What to Read Next

• How to install plugins for Minecraft Java Edition for installing CoreProtect, WorldGuard and WorldEdit
• Managing your Minecraft server for backup scheduling — the layer neither plugin replaces
• Minecraft Whitelist and Ban Management for keeping the griefer out afterwards
• Minecraft Server Commands for game rules and the safe manual backup sequence
• Minecraft server.properties: The Complete Reference for spawn-protection and the rest of the file
• How to create a backup for the panel backup workflow in detail

Made with 💜 by GameServerKings