Something is wrong: a compromise checklist

Security & DDoS Reviewed September 6, 2026 2 min read

You noticed a login you did not make, a plugin you did not install, or an operator who should not be one. Work in this order — it is arranged so that each step stops the situation getting worse before the next one investigates it.

First, close the door

  1. Change your panel password

    From a page you navigated to yourself, not a link. This is first because everything else is reachable through it.

  2. Change it wherever you reused it

    Especially your email. An attacker with your email can undo the password change you just made.

  3. Remove every subuser you do not recognise

    And every one you do recognise but did not add recently. Add them back afterwards if they were legitimate.

  4. Stop the server if damage is ongoing

    A stopped server cannot be damaged further, and the world on disk stops changing. This buys you time to think.

Then, find out what happened

  1. Read the activity log from before you noticed

    Work backwards to the first login you cannot account for. That is your starting point, and everything after it is suspect.

  2. Check Startup and Settings for changes

    A changed startup command or jar is how persistence gets added. Compare against what you remember configuring.

  3. List operators and permissions

    ops.json and your permissions groups. An added operator is the most common change and the easiest to miss.

  4. Look at the plugins folder by modification date

    Anything added or changed at a time you were not working is worth examining before the server runs again.

Then, rotate everything the server knew

  1. Database passwords

    They sit in plugin configs in plain text. Anyone with file access has them.

  2. RCON, if it is enabled

    And consider whether you need it enabled at all.

  3. Any bot tokens or API keys in configs

    A Discord bridge token in a config file is a Discord bot somebody else now controls.

Restoring a backup does not remove an attacker's access

If they had your password, they still have it after a restore. Rotate credentials first, restore second. A restore that puts a clean world behind an unchanged password is a delay, not a fix.

Write down what you found while you remember it

Dates, what changed, what you rotated. In two weeks you will want to know whether you already changed a particular password, and «I think so» is not an answer you can act on.