Griefers, force-op and malicious plugins

Someone has op they should not have, or a plugin gave players powers.

Remove op, check ops.json, remove unknown plugins, and roll back damage.

Before you start: Console access and a recent backup.

Step by step

1. Turn on the whitelist (whitelist on) while you clean up.
2. Open ops.json in Files and remove names you do not trust; run deop Name for each.
3. Check plugins/ for jars you did not install and delete them; re-download the others from official pages.
4. In LuckPerms, check who is in admin ranks (lp group admin listmembers) and remove unexpected users.
5. Roll back damage with CoreProtect or restore a clean backup.
6. Change your CoreX password and remove unknown sub-users in Users.

Check it worked: Only trusted people have op or admin, and plugins come from official sources.

Why it happens: Leaked op, backdoored plugins from untrusted sites, or a compromised staff account.

If you find a malicious plugin, tell support where it came from.

More guides on Security, abuse, and compromised accounts:

• Your account was hacked or you got a sign-in alert
• Phishing: emails or messages pretending to be CoreX
• Players using hacked clients
• Keep your server private and safe
• Report abuse from a CoreX server