How to check a server for a backdoor
Signs of hidden access in plugins and server setups: what to look for in logs and files, and what to do if confirmed.
Updated August 13, 2026
A backdoor is a hidden capability to control the server, built into a plugin or mod. It arrives along with "leaked" premium plugins and modpacks from untrusted sources.
Signs
| Sign | Comment |
|---|---|
Unknown operators in ops.json | Direct confirmation — ops.json |
| Commands in the log that nobody entered | Look for issued server command |
| Outbound connections at startup | The plugin is "phoning home" |
New .jar files | Especially with unclear names |
| Permissions you never granted | Permission audit |
| Players with unexplained items | Possibly handed out through a backdoor |
What to check
- Plugin list: did you install everything yourself — Plugin review.
- The source of every suspicious file — Where to get plugins.
- Logs from the past weeks for strange commands.
ops.json,whitelist.json, LuckPerms groups.
If confirmed
- Stop the server.
- Take a copy for analysis — Backups.
- Delete the suspicious plugins completely, along with their folders.
- Change all passwords and keys: panel, SFTP, database, RCON, bot tokens.
- Check the world for changes — CoreProtect.
- Rebuild your plugin set from official sources.
Prevention
Install only from the panel catalog and official platforms. Saving money on a paid plugin through a "leaked" version costs you your server.
Minecraft hostingYour server runs while you are offlineCreate server
