The instinct is to fix the damage. Doing that first destroys the evidence and makes an accurate rollback impossible, so the order below is worth following even though it feels slower.
In this order
- Stop it happening again right now
Ban or kick whoever is doing it. If you do not know who, turn the allowlist on — a temporarily closed server is better than an ongoing one.
- Do not repair anything yet
Manual repairs overwrite the record of what was there. A rollback after a partial repair produces a stranger mess than the grief did.
- Take a backup of the damaged state
This sounds backwards and it is not. If the rollback goes wrong, you want to be able to return to the situation you understood.
- Find out who and when
A block-logging plugin answers both in one command. Without one, the activity log and the console tell you who was online, which narrows it considerably.
- Roll back the area, not the world
Block loggers can undo one player's actions in a radius or a time window. That is far better than restoring a world backup, which also undoes everything everyone else did.
- Say what happened publicly
One factual sentence. It stops the rumour, and it tells everyone else their own builds are being looked after.
It is the right move when the damage is enormous or you have no block logging, and the wrong move when a targeted rollback would do. Restoring six hours to fix one building means everyone loses six hours — say so before you do it, not after.
An allowlist on a private server, land protection on a public one, and block logging on both. None of them are interesting, and together they turn griefing from a recurring crisis into a thing that occasionally happens and is undone in a minute.
If it was a staff member
Remove their panel access before their in-game powers, change any password they knew, and check the activity log for file changes and backup deletions. The in-game damage is usually the visible part and rarely the expensive part.
The area is restored, the responsible account can no longer connect, and a spot-check of the logs shows no further edits after the ban.