Anti Bot system
Protect your Paper server from bot attacks with IP rate limiting, math CAPTCHA verification, auto-shield mode, and persistent security bans stored in MariaDB or YAML.
AntiBot — Advanced Bot Protection for Paper 1.21+
Keep bots off your server with a multi-layered protection system that combines rate limiting, CAPTCHA challenges, automatic shield mode, and persistent security bans.
Features
Math CAPTCHA
New players must solve a simple math problem (+, −, ×) before they can move or interact. They are frozen in place until they answer correctly in chat.
- Configurable number range, attempts, and timeout
- Repeating reminder every X seconds so players don't miss the question
- Beautiful formatted chat messages with title screen display
- Verified players are remembered permanently — they never see the CAPTCHA again
IP Rate Limiting
Limits how many times a single IP can connect within a rolling time window. Blocks connection floods before they reach your server logic.
Auto-Shield Mode
Monitors the global join rate every second. When it exceeds the configured threshold (e.g. 5 joins/second), shield mode activates automatically and blocks all unverified players. Deactivates itself once traffic normalizes. Can also be toggled manually via command.
Security Bans
Players who reconnect suspiciously fast (3 times within 60 seconds by default)
receive a 7-day security ban that is stored persistently.
Admins can unban players at any time with /antibot unban <player>.
Whitelist
Exempt trusted players from all checks permanently. Managed via command and stored in your chosen storage backend.
Flexible Storage
Choose between MariaDB (for multi-server setups) or YAML (zero setup) in a single config option. All data — verified players, whitelist, and bans — is stored in the selected backend.
Commands
| Command | Description |
|---|---|
/antibot status | Show shield state, active CAPTCHAs, and blocked IPs |
/antibot reload | Reload the configuration |
/antibot shield <on|off> | Manually toggle shield mode |
/antibot whitelist <add|remove> <name> | Manage the whitelist |
/antibot unban <player> | Remove a security ban |
Permission: antibot.admin (default: op)
Bypass permission: antibot.bypass
Requirements
- Paper 1.21.1+
- Java 21+
- MariaDB (optional — YAML works out of the box)
Configuration
Every threshold, message, and color is fully configurable via config.yml.
Storage backend, CAPTCHA math range, ban duration, shield sensitivity,
rate limit windows — all adjustable without recompiling.
This plugin uses:
- HikariCP (Apache 2.0) by Brett Wooldridge
- MariaDB Connector/J (LGPL-2.1) by MariaDB Corporation