Most of server.properties is gameplay. Six lines are not — they decide who may connect and what may reach in from outside, and every one of them has a default that is right for a reason.
The six
| Setting | Safe value | Why |
|---|---|---|
online-mode | true | Verifies that players own the account they claim. Off means anyone can be anyone. |
enable-rcon | false | Remote console. If you do not know you need it, you do not, and it is a password away from total control. |
rcon.password | Long and unique | Only relevant if RCON is on. A weak one is the same as no protection. |
white-list | true for private servers | The only setting that stops a problem before it connects. |
enforce-whitelist | true | Kicks non-listed players already online when the list changes. Without it the allowlist only applies at join. |
enable-query | false unless needed | Publishes server details to anything that asks. Useful for listing sites, unnecessary otherwise. |
online-mode=false is not a setting, it is a decisionIt disables the only check that a connecting player is who they say. On a directly reachable server it means anyone can join as you, with your operator permissions. It exists for backends behind an authenticating proxy that are themselves unreachable from the internet — and only there.
If you turned RCON on
- Use a long random password
Not the one you use elsewhere, and not a word. RCON hands whoever has it full console access.
- Do not share the port publicly
It is not the same as your game port and it does not need to be known by anyone playing.
- Turn it off when you finish with it
Most people enable RCON for one tool, one time. Leaving it on afterwards is a permanent risk for a temporary convenience.
enforce-secure-profile is about chat, not accessIt controls signed chat messages. Turning it off does not weaken account verification, and it is a normal thing to do on servers with chat plugins. Do not confuse it with online-mode — they sound related and are not.
online-mode=true, RCON off or behind a strong password, and the allowlist enforced if the server is private.