Whitelisting a Minecraft server locks it to an approved list of players, so anyone not on that list can't connect even if they know the server address. Turn it on with the white-list setting in server.properties or the /whitelist on console command, then add each player by name with /whitelist add <player>. This guide covers a Java Edition server, vanilla, Paper, or Spigot; Bedrock dedicated servers use a similar allowlist system with different file and command names, covered near the end.
Turn on whitelist mode
Every Java server ships with a white-list line in server.properties, set to false by default, so a freshly set up server accepts anyone. Open server.properties in the server's root folder, find white-list=false, and change it to white-list=true. The server only reads this file at startup, so a change here needs a restart before it applies.
If the server is already running and you don't want to restart it, use /whitelist on instead, from the console or as an operator in-game. It does the same thing as the server.properties setting but takes effect immediately. /whitelist off turns enforcement back off without clearing the saved list, and operators can always connect while the whitelist is active on Java, even if their own name isn't on it.
Add players with /whitelist add
- 1.Type /whitelist add <player> in the console or as an operator in-game, using the player's exact Java Edition username.
- 2.The player doesn't need to be online, or to have ever joined the server before, for the command to work.
- 3.List more than one username in the same command, separated by spaces, to add several players at once.
See who's on the list and reload it after manual edits
/whitelist list prints every player currently on the whitelist to the console. whitelist.json itself lives in the server's root folder, next to server.properties and the server jar, not inside the world folder. It's a plain JSON array with one entry per player, each holding that player's UUID and current username.
You can edit whitelist.json directly while the server is stopped, or edit it while the server keeps running and follow up with /whitelist reload, which re-reads the file from disk. Without that reload, a manual edit to the file has no effect on a server that's already running.
Remove a player from the whitelist
/whitelist remove <player> takes a player off the list the same way /whitelist add puts them on it, by exact username, and the player doesn't need to be online. Removing someone doesn't kick them if they're already connected; it only stops them from joining again next time. Turn on the separate enforce-whitelist setting in server.properties if you also want the server to kick a player who falls off the list the next time the whitelist file is reloaded.
Let a co-admin manage it without full operator access
The /whitelist commands default to operator-level permission, which normally hands out full server control. If you want a co-admin to manage the whitelist without making them a full operator, a permissions plugin like LuckPerms can grant just the whitelist command instead. A general admin plugin such as EssentialsX is also worth running on a whitelisted server for everyday moderation once the player list is locked down.
Does this work on Paper, Spigot, and Bedrock servers
Vanilla, Paper, and Spigot Java servers all use the same white-list setting, whitelist.json file, and /whitelist commands described above, since Paper and Spigot build on top of the vanilla server rather than replacing its whitelist system. If you're setting up plugins on Paper or Spigot too, see our guide on installing plugins on a Minecraft server for how the plugins folder and restarts interact with server config changes like this one.
Bedrock Dedicated Server has a comparable feature called the allowlist, controlled by the allow-list setting in server.properties and stored in allowlist.json instead of whitelist.json. The console command is /allowlist add <player> rather than /whitelist add. Bedrock gives operators no automatic bypass either; every player, operator or not, must be on the list once it's active. This guide focuses on Java servers, since Bedrock's allowlist commands and permission levels differ enough to deserve their own walkthrough.
Frequently asked questions
How do I whitelist someone on Minecraft?
Add them by username with /whitelist add <player> in the server console or as an operator in-game. The whitelist itself needs to be turned on too, either by setting white-list=true in server.properties and restarting, or by running /whitelist on, which applies immediately without a restart.
How do I add a player to the whitelist in Minecraft?
Type /whitelist add followed by the player's exact Java Edition username. They don't need to be online, or to have ever connected to the server before, for the command to work, and you can list several usernames in the same command separated by spaces to add them all at once.
How do I turn on the whitelist in Minecraft?
Set white-list=true in server.properties and restart the server, or run /whitelist on from the console or as an operator in-game for the same effect without a restart. Operators can still connect while it's active even if they aren't on the list themselves, since the whitelist doesn't apply to them on Java.
Does turning on the whitelist kick players who are already connected?
No, not by itself. /whitelist on and white-list=true only stop new connections from players who aren't on the list; anyone already in the game stays in until they disconnect on their own. Turn on enforce-whitelist in server.properties if you want the server to kick already-connected players who aren't whitelisted the next time the list is reloaded.
Where is the whitelist.json file located?
whitelist.json lives in the server's root folder, alongside server.properties and the server jar file, not inside the world save folder. It's a JSON array with one entry per player, storing their UUID and current username. Editing it directly while the server is running needs a follow-up /whitelist reload for the change to take effect.
