Undo griefing with CoreProtect

CoreProtect logs every block placed, broken or taken on your Minecraft server, so you can see exactly who did what and roll back one player's damage without touching anyone else's builds.

6 min read · Updated Oct 21, 2026 · By GuavaHost Team

Install it before you need it

This is the one thing to take away from this guide. CoreProtect can only tell you about events it was running for. Installing it after a griefing means you get a working logger and no record of what just happened, which is far too late.

A server backup restores the whole world to a point in time, which means undoing the griefing and everything legitimate that happened since. CoreProtect instead undoes one player's actions and leaves everybody else's alone. You want both tools: backups as the blunt instrument, CoreProtect as the scalpel.

So install it on day one, on an empty world, and forget about it until something goes wrong.

1. Open the Plugins page under Minecraft tools, search CoreProtect under Find plugins, and click Install. The manual upload route is in installing plugins.
2. Restart the server and watch the Console for its startup line, which says it has created its database.
3. In game, run /co help to confirm it answers.

It needs a plugin server: Paper, Spigot, Bukkit or Purpur. On Fabric or Forge it will not load.

The inspect tool

Everything starts here. Run /co i (or /co inspect) to toggle inspector mode on yourself, then:

• Left click a block to see what happened to that block: who placed it, who broke it, and when.
• Right click a block to see what happened at the space next to it, which is how you check an empty hole.
• Left click a chest, barrel or hopper to see every item taken out or put in, by whom.
• Run /co i again to turn it off.

The output is a list in chat, newest first, with a relative time like 3.52 hours ago. This alone answers most "who broke my wall" questions in about ten seconds, and it is the first thing to teach a new moderator.

Look up what happened

The inspector is per block. /co lookup searches the whole log. The syntax is a set of filters, and you only use the ones you need:

Some examples you will actually type:

/co lookup u:Steve t:1d a:block
/co lookup t:3h r:40 a:block e:dirt,stone
/co lookup u:Steve t:7d a:chest
/co l t:1d b:tnt

Results are paged, and /co lookup page 2 steps through them. /co near is the quick version: everything that happened within a few blocks of where you are standing.

Rolling back

Once you know who and when, /co rollback undoes it. Same filters:

/co rollback u:Steve t:2d r:100

That reverses everything Steve did in the last two days within 100 blocks of you. /co restore is the exact opposite: it puts back what a rollback just undid, which is your undo button if you rolled back too much.

How to do it without making things worse:

1. Take a backup first. Always. A rollback is a bulk world edit, and a backup is your way out if you got the filters wrong.
2. Look up before you roll back. Run the same filters with lookup and read the result. If the count looks far too large, your radius or time is too wide.
3. Be specific about the user. A rollback with a time and radius but no u: filter reverses everyone's work in that area, including the builds you are trying to save.
4. Start small. Roll back a radius of 30, check it in game, then widen. Rolling back a whole world in one command is how you lose a build nobody mentioned.
5. Do it with the griefer offline, ideally banned first, so they cannot redo it while you work. Ban, kick and unban players covers that.

If you end up needing the heavier route, what to do if your server was griefed or hacked walks through the whole incident, backups included.

What a rollback does not fix

Be honest with your players about this. CoreProtect is excellent at blocks and containers. It is weaker on:

• Player inventories. Items a griefer took and then dropped in lava are gone. A rollback restores the chest contents it logged, not a player's pockets.
• Entities. Armour stands, item frames, paintings and mob kills are logged, but restoring them is less complete than blocks, and some of their data may not come back.
• Anything another plugin owns. Economy balances, land claims, plugin stored stats. Those live in that plugin's own data rather than in the world.

For those, a backup restore is the honest answer.

Its database, and its disk cost

CoreProtect stores every logged event in a database. By default that is a single SQLite file, database.db, inside plugins/CoreProtect/ on the Files tab. On a busy server it is usually the largest file your plugins create, and it grows roughly with how much your players build and how long you keep the logs.

Two levers:

Log less. plugins/CoreProtect/config.yml has an on or off switch for each kind of event. The ones that generate the most volume are usually the chattiest and least useful:

block-break: true
block-place: true
chest-transaction: true
container-transaction: true
sign-text: true
item-drops: false
player-commands: false
chat: false

Keep block break, block place and the container ones. Those are what you roll back and what settles arguments. Item drops, chat and commands are nice to have and expensive to store, so turn them off unless you have a reason.

Keep less. Purge old data on a schedule:

/co purge t:30d

That deletes log entries older than 30 days. Thirty to sixty days is a sensible window: long enough to catch a griefing nobody noticed for a fortnight, short enough that the file stays reasonable. Purging takes a while on a large database, so run it when the server is quiet, or set the purge options in the config so it happens on its own.

On a network, or if the file is getting unwieldy, CoreProtect can use MySQL instead. Creating a MySQL database covers getting one, and the connection details go in the mysql section of its config.

Give your staff the inspect tool, carefully

Moderators need coreprotect.inspect and coreprotect.lookup. That lets them answer questions and investigate, and it changes nothing.

coreprotect.rollback is a different matter. It is a destructive, bulk world command, and one mistyped radius undoes a weekend of building. Keep it to the people who own the server, and ask for a backup before every use. Giving staff the right tools goes through that split, permissions are handed out with LuckPerms, and the broader prevention picture is in keeping griefers out.

Common questions

Can CoreProtect undo griefing that happened before I installed it?

No. It can only roll back events it logged, so anything from before the install is invisible to it. That is why it goes on the server on day one, and why you still want regular backups for everything else.

Will rolling back one player wreck other people's builds?

Not if you include a u: filter for that player. A rollback with only a time and radius reverses everything anyone did in that area, which is the mistake to avoid, so always run the same filters as a lookup first and read the count.

How much disk does the CoreProtect database use?

It depends on how much building happens and how long you keep the logs, not on your plan. Turning off item drops, chat and command logging and purging anything older than about a month keeps it modest on almost any server.

Still stuck? Jump into our Discord at discord.gg/GuavaHost and the team will help you out.

• coreprotect
• griefing
• rollback
• minecraft
• java

Host a Minecraft Java server From $3.99/mo, with instant setup and DDoS protection.

Still need help? Our team is online 24/7 to answer questions.

Contact support