DDoSDefender

DDoSDefender delivers high-performance mitigation by plugging directly into your server's Netty pipeline. Every connection is inspected from its very first packet: invalid handshakes, ping floods and login bursts are rate-limited and cancelled before your server spends anything on them.

Logins then pass through a layered verification pipeline. Each player is checked against a shared database of genuine Minecraft accounts (V2.0+), and a detection suite of over 25 heuristic checks examines every username: letter-pair plausibility (V2.0+), random casing (V2.0+), entropy, keyboard walks, leet-speak, UUID fingerprinting, swarm detection and more. Bots using made-up or stolen identities are stopped before they ever reach your server.

Runs on Paper, Spigot, Purpur, Folia, BungeeCord, Waterfall and Velocity (V2.0+). Completely free, with no premium tier and no locked features.

---

Shared Player Database (V2.0+)

DDoSDefender comes with a database of known, genuine Minecraft accounts, so players can be confirmed instantly and locally instead of waiting on Mojang. Joins are faster, Mojang's rate limits stop being a weak spot, and fake accounts are spotted straight away.

• Encrypted and locked to your server
• Privacy first: no readable usernames or personal data, and player IP addresses are never sent
• Updates itself in the background, with no restarts needed

Under-Attack Mode (V2.0+)

When DDoSDefender detects a coordinated attack, such as bots replaying real player names from many networks at once, it automatically switches to enhanced protection: only your regular players can join until the attack is over. It switches itself off once things calm down, and your staff get an alert in chat the moment it happens.

/ii lockdown on | off | status: take manual control at any time

Failed-Login Learning (V2.0+)

Connections that fail Minecraft's own account verification are remembered. Repeat offenders are blocked for longer and longer, and whole networks are shut out if fake logins keep coming from them. Genuine accounts are never blocked.

FastPass

DDoSDefender features our proprietary FastPass system: once a player is verified, they skip the security checks on future logins. Your community gets seamless connections while your server stays protected.

• Multi-network (V2.0+): players are recognised on any of their usual networks (up to 3, e.g. home, mobile data and a friend's house)

/ii fastpass add <playername>: pre-approve a player who can't get in /ii test <playername>: see how any name scores against the detection suite

Accurate Detection (V2.0+)

The name checks are tuned against over 300,000 real player names, so your real players aren't caught in the crossfire: only 0.01% of genuine names are blocked on their name alone. Anything borderline gets a full account verification instead of an instant block.

Works With Your Setup

• TCPShield (V2.0+): real player IPs are read automatically, with no extra setup
• Geyser / Floodgate (V2.0+): Bedrock players are handled correctly
• ViaVersion (V2.0+): clients from 1.7 up to future releases are accepted
• Offline-mode servers (V2.0+): adapts automatically

---

Scope & Recommended Setup

DDoSDefender focuses exclusively on managing and filtering application-level connection attempts. It does not, and cannot, protect your physical network infrastructure: no software-level plugin can mitigate volumetric attacks at the ISP level.

For comprehensive protection, we strongly recommend a layered security strategy: pair DDoSDefender with a network-level proxy like TCPShield. TCPShield hides your IP and absorbs massive network-layer floods, and DDoSDefender provides the "last mile" of defence by filtering the Minecraft-specific handshake exploits and bot logins that proxies pass through.

DDoSDefender's verification pipeline runs fully off the main server thread, so mitigation doesn't cost you TPS. Performance scales with the CPU threads available to your server (more threads means faster processing of concurrent connections during a flood), so we recommend a host with adequate CPU headroom rather than a heavily oversold or shared core.

Requires: Java 17+ · PacketEvents 2.13+