WorldLockPlus

🔒 Secure world access with enterprise-grade password protection

WorldLockPlus is a powerful Bukkit/Spigot plugin that adds password protection to worlds managed by Multiverse-Core. Even server operators must enter passwords to access protected worlds (unless they have the bypass permission).

✨ Features

• 🔐 Enterprise Security: Uses bcrypt password hashing (work factor 12) for maximum security
• 🛡️ Operator Protection: Even server operators must enter passwords unless they have bypass permission
• 🚫 Comprehensive Blocking: Prevents teleportation, world changes, and unauthorized access
• ⏱️ Session-Based Access: Authorization lasts until player logout for convenience
• 💾 Persistent Storage: Passwords are securely stored in config files
• 🎯 Multiverse Integration: Seamlessly works with Multiverse-Core
• 🔄 Automatic Migration: Detects and warns about legacy password formats

📋 Requirements

• Minecraft Server: Spigot/Paper 1.19+
• Multiverse-Core: Required dependency (Download here)
• Java: 17 or higher

🚀 Installation

1. Install Multiverse-Core first
2. Download WorldLockPlus and place it in your plugins/ folder
3. Restart your server
4. Configure world passwords using the commands below

📖 Commands

Admin Commands

/worldlock or /wlock (aliases)

• /worldlock set <world> <password> - Set a password for a world
• /worldlock remove <world> - Remove password protection from a world
• /worldlock list - List all password-protected worlds

Permission: worldlock.admin (default: OP)

Player Commands

/wunlock

• /wunlock <world> <password> - Enter password to unlock access to a protected world

Permission: worldlock.use (default: true)

🔑 Permissions

• worldlock.admin - Full access to world lock management (default: OP)
• worldlock.use - Ability to unlock password-protected worlds (default: true)
• worldlock.bypass - Bypass world password protection entirely (default: false)

💡 Usage Example

# Admin protects the "lobby" world
/worldlock set lobby MySecurePassword123

# Player tries to teleport (blocked)
/mv tp lobby
# Message: "⚠ This world is password protected! Use /wunlock lobby <password> to enter."

# Player unlocks access
/wunlock lobby MySecurePassword123
# Message: "Password correct! Teleporting to 'lobby'..."
# Message: "Access granted until logout."

# Player can now access the world
/mv tp lobby

🔒 Security Features

• bcrypt Hashing: Industry-standard password hashing with work factor 12 (4096 iterations)
• Built-in Salt: Each password hash includes a unique salt automatically
• Brute-Force Resistant: Adaptive hashing makes attacks computationally expensive
• Secure Storage: Passwords are never stored in plain text
• Session Management: Access is cleared on logout for security

⚙️ Configuration

Passwords are automatically stored in plugins/WorldLockPlus/config.yml using bcrypt format. The configuration file is managed automatically - no manual editing required.

❓ Troubleshooting

• Plugin won't enable: Ensure Multiverse-Core is installed and enabled first
• Can't access world: Use /wunlock <world> <password> to authorize yourself
• Operators bypassing: Check they don't have worldlock.bypass permission
• Legacy passwords: If you see warnings about legacy formats, reset passwords using /worldlock set

📝 Notes

• Authorization persists until player logout for convenience
• Players are automatically teleported away from protected worlds if they lose authorization
• The plugin works with all Multiverse-Core world management features
• Passwords are case-sensitive