SpigotSecurity | AntiCrasher, Packet & Exploit Protection

Spigot-Security | Advanced Anti-Crash Protection

━━━━━━━━━━━━━━━━━━━━
About
━━━━━━━━━━━━━━━━━━━━

Spigot-Security is a configurable anti-crash and exploit-protection plugin for Bukkit-based Minecraft servers.

It protects your server against malformed packets, packet floods, dangerous books and items, invalid NBT data, inventory exploits, movement crashes, entity overloads, unsafe clientbound packets and many other common crash methods.

The plugin uses conservative defaults to prevent false detections and accidental player kicks. Every important protection, limit, kick message, permission and notification can be configured.

This is a server plugin only. It does not contain Velocity or proxy-side code.

━━━━━━━━━━━━━━━━━━━━
️ Protection Features
━━━━━━━━━━━━━━━━━━━━

Packet flood and packet-size protection
Invalid packet and packet-state detection
CustomPayload and PluginMessage protection
TabComplete and command-suggestion protection
BookBan, Book-NBT and Book-JSON protection
Bounded JSON, selector and component validation
Item NBT and modern Data Component validation
Recursive container, bundle and nested-item checks
Display name, lore and enchantment protection
Attribute, potion, firework, banner and skull validation
Creative inventory and WindowClick protection
Bundle, crafting, container and inventory dupe protection
Anvil rename and workstation protection
Sign and modern front/back sign validation
Movement, vehicle, teleport and coordinate validation
NaN, Infinity and extreme-value protection
Entity metadata and DataWatcher validation
Entity, projectile, vehicle and passenger limits
Particle, sound, explosion and velocity validation
Scoreboard, team, bossbar and map protection
Command tree, tag and advancement validation
Merchant trade and outgoing inventory validation
Resource-pack and server-list response protection
Chunk entity, projectile, firework and book limits
Optional chunk-palette and region-file diagnostics
Portal, End Gateway and projectile-through-portal protection
Redstone, hopper, piston, dispenser and physics protection
TNT and explosion-chain protection
Crash-loop detection and temporary connection blocking
KeepAlive timeout diagnostics without touching KeepAlive packets

━━━━━━━━━━━━━━━━━━━━
Crash Codes and Forensics
━━━━━━━━━━━━━━━━━━━━

Every protection category has its own stable crash code.

Detailed detections include an additional rule fingerprint, for example:

#42-12345678

This allows players to send the exact code to the server team when they believe a detection was incorrect.

Administrators can look up codes directly in-game:

/spigotsecurity lookup <#code>

Diagnostics can include:

Player and UUID
Connection phase
Packet type
Packet size and configured limit
Bedrock status
Detection reason
Exact crash code
Optional bounded packet hex data
Optional exception information

The plugin does not spam the server console. Security diagnostics are written to a configurable asynchronous log file.

━━━━━━━━━━━━━━━━━━━━
️ Bedrock Support
━━━━━━━━━━━━━━━━━━━━

Spigot-Security supports Geyser and Floodgate environments.

Bedrock players are detected through the available APIs and receive configurable relaxed packet-size and rate budgets. Malformed data is still validated, but Bedrock users are not globally bypassed or unnecessarily kicked.

Detection is refreshed after joining to avoid an incorrect cached Java-player result.

━━━━━━━━━━━━━━━━━━━━
Compatibility
━━━━━━━━━━━━━━━━━━━━

Designed for:

Spigot
Bukkit / CraftBukkit
Paper
Purpur
Pufferfish
Leaf
Folia

Optional plugin compatibility:

PacketEvents
ProtocolLib
Geyser
Floodgate
ViaVersion
ViaBackwards

PacketEvents and ProtocolLib are optional. The Bukkit protection core continues running when they are not installed.

Fork-specific safe transport profiles are included for Paper, Purpur, Pufferfish, Leaf and Folia. Experimental raw Netty hooks are disabled by default to prevent connection and KeepAlive problems.

No Velocity plugin is included or required.

━━━━━━━━━━━━━━━━━━━━
Configuration
━━━━━━━━━━━━━━━━━━━━

The configuration contains editable options for:

Enabling or disabling every protection profile
Packet sizes and packet rates
Violation levels, buffers and decay
Book, item, NBT and component limits
Entity and world limits
Bedrock multipliers
Player, world and permission exceptions
Per-protection Bedrock exceptions
Kick messages and connection messages
Team notifications
Crash-code overrides
Diagnostics and file logging
Platform and version profiles
Safe, balanced and strict security modes

The default configuration uses conservative production values to reduce false detections.

━━━━━━━━━━━━━━━━━━━━
Commands
━━━━━━━━━━━━━━━━━━━━

/spigotsecurity status
Displays the active platform, version profile and packet integrations.

/spigotsecurity reload
Reloads the configuration and safely rebuilds all protection integrations.

/spigotsecurity warnings
Displays configuration validation warnings.

/spigotsecurity lookup <#code>
Shows the protection profile and latest detection associated with a crash code.

/spigotsecurity modules <page>
Displays the runtime status of every protection module.

━━━━━━━━━━━━━━━━━━━━
Permissions
━━━━━━━━━━━━━━━━━━━━

spigotsecurity.admin
Grants access to every administrative command.

spigotsecurity.status
Allows access to the status command.

spigotsecurity.reload
Allows configuration reloads.

spigotsecurity.warnings
Allows viewing configuration warnings.

spigotsecurity.lookup
Allows crash-code lookups.

spigotsecurity.modules
Allows viewing protection module states.

spigotsecurity.bypass
Optional complete security bypass. Disabled by default.

spigotsecurity.nbtquery
Allows trusted players to use NBT query features.

team.notify
Receives security detections and crash-code notifications.

━━━━━━━━━━━━━━━━━━━━
Installation
━━━━━━━━━━━━━━━━━━━━

1. Stop your Minecraft server.
2. Place SpigotSecurity-1.0.0.jar inside the plugins folder.
3. Optionally install PacketEvents or ProtocolLib.
4. Start the server.
5. Review plugins/SpigotSecurity/config.yml.
6. Use /spigotsecurity status to check the selected platform profile.
7. Test your configuration before using strict limits on a production server.

Java 21 is required.

━━━━━━━━━━━━━━━━━━━━
Important Information
━━━━━━━━━━━━━━━━━━━━

No Bukkit plugin can guarantee protection against every possible server crash.

Errors inside the Minecraft decoder, server implementation, Java runtime, damaged world files or third-party plugins may occur before Bukkit can safely process them.

Always use an updated server build, create backups and test security settings before deploying them to a live network.

━━━━━━━━━━━━━━━━━━━━
Support
━━━━━━━━━━━━━━━━━━━━

Discord:
https://discord.com/invite/uwffG2vrRB

Join for support, configuration help and updates.