Whitelist, password or private: which one do you want?
Three ways to keep a server to your own group, and what each one really protects you from. Which games support which, and how to pick without locking yourself out.
7 min read · Updated Oct 21, 2026 · By GuavaHost Team
The three approaches
A whitelist or allowlist. You keep a list of accounts that are allowed in. Everyone else is refused at the door, whether or not they know the address. The list is tied to a player's game account, not to a secret they could pass on.
Minecraft calls this a whitelist on Java and an allowlist on Bedrock. ARK, Project Zomboid and a few others have their own version.
A server password. Anyone who knows the password gets in, whoever they are. The server is often still visible in the public list, with a padlock next to it, and it simply refuses a wrong password.
This is the model Valheim, Enshrouded, Don't Starve Together, Terraria, Palworld and RuneScape: Dragonwilds use. Minecraft Java has no built-in server password at all, which surprises people.
Just not being listed. You do not advertise the server anywhere, and it does not appear in any public browser. Anyone with the address can walk in, but almost nobody has it.
Every game supports this by doing nothing, but it is the weakest of the three on its own.
What each one actually protects you from
| Whitelist | Password | Unlisted only | |
|---|---|---|---|
| Stops a random stranger who found your IP | Yes | Yes | No |
| Stops a password being passed around | Yes | No | Not applicable |
| Survives someone leaking the address | Yes | Yes | No |
| Lets a friend bring a friend without asking you | No | Yes | Yes |
| Admin work per new player | One command or one entry | None | None |
| Works when the server is in a public browser | Yes | Yes | Not applicable |
| Can lock you out of your own server | Yes, if set up in the wrong order | Rarely | No |
The honest summary: a whitelist is the strongest and the most work, a password is good enough for a group of friends who trust each other, and unlisted alone is not a security measure. Server addresses get found: scanners sweep the internet for open game ports constantly, so "nobody knows the IP" has a shelf life.
A common and sensible combination is a password or whitelist for access plus not advertising the address. One keeps strangers out, the other keeps you off the radar.
Which to pick
Pick a whitelist if:
- It is a long-running world and griefing would really hurt.
- Your group is stable and you do not mind adding people by name.
- You are on Minecraft Java, where there is no built-in password anyway.
- You want to know exactly who can get in, with no shared secret floating around.
Pick a password if:
- The group changes often, or people bring friends.
- The game has no whitelist feature, which covers most survival co-op games.
- You want zero admin work per player.
- You are happy that the password will eventually spread a little further than you intended.
Rely on being unlisted only if:
- It is a short-lived world you are playing for a week.
- The game supports neither of the other two.
- And even then, turn one of the others on if you can.
What each game supports
| Game | Whitelist or allowlist | Server password | Hide from the public list |
|---|---|---|---|
| Minecraft Java | Yes, built in | No built-in password (plugins can add a login step) | Yes, by not advertising |
| Minecraft Bedrock | Yes, the allow list | No | Yes |
| Rust | Admin and moderator lists, plus plugin whitelists | No built-in password | Hard, Rust servers list themselves |
| Valheim | No | Yes | Yes, a community toggle |
| Palworld | No | Yes | Yes, a community toggle |
| ARK | Yes, an exclusive join list | Yes | Yes |
| Project Zomboid | Yes, plus account passwords | Yes | Yes, an open or public toggle |
| Enshrouded | No | Yes | Yes |
| Don't Starve Together | No | Yes | Yes, via the cluster settings |
| Terraria and tModLoader | No | Yes | Yes |
| Counter-Strike 2 | No | Yes | Yes |
| RuneScape: Dragonwilds | No | Yes | Yes |
| Hytale | See the game's own config guide | See the game's own config guide | Yes |
Options and names move between game updates, so check your own config file and the game's guide in this help centre rather than treating this table as final. The per-game guides cover the exact setting: allowlists and whitelists is the overview, and for specifics there are Minecraft without locking yourself out, Bedrock allowlists and operators, Valheim passwords, Enshrouded admin and passwords, Don't Starve Together passwords and privacy and Dragonwilds server passwords.
The classic mistake, and how to avoid it
Turning a whitelist on before adding yourself to it. The server then refuses everyone, including you, and you cannot add yourself in game because you cannot get in.
The fix is always the same and it is why the panel console matters: add yourself from the console, which is not subject to the whitelist. On Minecraft Java that is whitelist add YourName followed by whitelist on, in that order. Using the console command box covers sending commands, and the whitelist without locking yourself out covers the whole order of operations.
Two related traps:
- Usernames change. Minecraft stores a whitelist entry by account ID once the player has been seen, but an entry added by name before they have ever joined can go stale if they rename. If a whitelisted friend is refused, re-add them.
- Bedrock players on a Java server. With Geyser, a Bedrock player's name does not match a Java account, so the whitelist needs the Floodgate form of their name. Geyser skins and usernames explains the prefix.
A password is not a security boundary
Worth saying plainly. A server password keeps out people who do not have it. It does nothing about:
- Someone in your group who turns out to be a griefer. That is what permissions, claims and rollbacks are for. Stopping griefers and CoreProtect rollbacks cover it.
- Someone sharing the password in a Discord server.
- Anything happening to your panel account, which is a separate login entirely. Securing your panel account and two-step login cover that side.
If your worry is "a stranger wandering in", any of the three options above handles it. If your worry is "someone I invited wrecking the place", none of them do, and you want permissions plus backups instead. Backups is the one that actually saves you.
And if you want the opposite
Plenty of people start private and later want players. Changing your mind is easy: turn the whitelist off or clear the password, and get the server listed. Getting players for your server covers advertising it properly, and if it will not appear in the browser afterwards, server not showing in the server list is the fix list. Before you open up, read stopping griefers first, because a public server needs the protections a private one could do without.
Common questions
Can I use a whitelist and a password together?
Yes, where the game supports both, and it is a reasonable setup for a server that appears in a public browser. The password turns away casual attempts and the whitelist makes sure only the people you actually named get through.
Does Minecraft Java have a server password?
Not built in. Java checks the player's Mojang or Microsoft account instead, and the whitelist is the supported way to limit who can join. Plugins can add a login prompt, but a whitelist is simpler and does the job.
Will a whitelist stop lag or griefing?
It stops griefing by strangers, which is most of it on a small server. It does nothing about a lag problem, and nothing about someone you invited. For those, look at the performance guides and at permissions plus regular backups.
I turned on the whitelist and now I cannot join my own server. What now?
Open the panel console, which bypasses the whitelist entirely, and add your own account there. On Minecraft Java that is the whitelist add command followed by a reload. You never need to reinstall anything to recover from this.
Still stuck? Jump into our Discord at discord.gg/GuavaHost and the team will help you out.
- whitelist
- allowlist
- password
- private server
- security
Still need help? Our team is online 24/7 to answer questions.