OpGuard

OpGuard protects selected players from losing operator privileges on your Paper server.

Protected operators cannot be accidentally deopped through commands, and any other attempt to remove their operator status is automatically detected and reversed.

Features

Command Protection

When someone tries to run:

/deop <player>

OpGuard intercepts the command before it is executed.

This works for commands issued by players, the server console, and RCON.

If the target is a protected operator, the command is cancelled, so the player never loses operator status, even for a moment.

Background Check

Not every way of removing operator status goes through /deop.

Another plugin could modify operator status through the API, or someone could manually edit ops.json.

OpGuard periodically checks the current operator list against the protected list. If a protected player is no longer an operator, their operator status is immediately restored.

The interval is configurable and defaults to approximately once per second.

Restoration

When OpGuard needs to restore operator status, it uses the server console command:

op <player>

This is the same method an administrator would use manually and keeps the restoration process compatible with the server's normal operator system.

OP Level

OpGuard does not hardcode an operator level such as level 4.

The operator permission level is controlled by:

op-permission-level

in server.properties.

The /op command always grants the permission level configured by the server. By default, this is normally level 4.

Configuration

config.yml:

protected-ops:
  - PlayerName

protected-uuids:
  - uuid-here

settings:
  check-interval-ticks: 20
  log-to-console: true

Options

protected-ops Player names that should always remain operators.

protected-uuids Optional UUID-based protection.

settings.check-interval-ticks How often the background check runs. 20 ticks is approximately 1 second.

settings.log-to-console Controls whether OpGuard logs protection and restoration actions to the console.

Commands

/opguard reload

Reloads the configuration.

/opguard check

Immediately runs an operator protection check.

Alias: /og

Compatibility

OpGuard is designed for the standard Paper/Bukkit operator system and protects against both /deop commands and operator removal that happens outside the command system.

Protected players stay operators.