When a few friends join your server, giving everyone operator (OP) status feels practical. As the community grows it becomes the quickest way to lose the server: an OP can place command blocks, kick players and even stop the server. The better approach is to give each person only the permissions they need. This guide walks through doing that with LuckPerms, the most widely used permissions plugin.

What LuckPerms does

Behind every command in Minecraft and its plugins sits a permission node. EssentialsX's home teleport, for example, checks the node essentials.home; if the player doesn't have it, the command doesn't run. LuckPerms ties these nodes to groups and puts each player in one or more groups. A player has the permissions of the groups they belong to.

If you run software from the plugin family (Paper, Purpur, Spigot), you can install LuckPerms with one click from the store inside the panel. Restart the server afterwards; on first start the plugin creates its configuration files and the default group that everyone joins automatically.

Plan your groups on paper first

Before typing any commands, write down how many ranks you want and what each can do. Four groups are enough for most servers:

  • default: the base group everyone is in. Basic commands such as setting a home or sending a teleport request.
  • vip: a few extra comforts, such as more home points or a coloured name.
  • helper: muting, kicking and looking into reports.
  • admin: bans, region protection and world settings.

Groups can inherit from each other. If helper inherits everything from vip and vip inherits from default, you never write the same permission into four groups; each group only gets what is specific to it.

Creating the groups

You can run the commands in game as an OP or from the panel's live console. In the console, type commands without the leading slash, because some versions' consoles don't accept it. In game you add the / as usual.

  1. Create the groups: lp creategroup vip, lp creategroup helper, lp creategroup admin
  2. Set up inheritance: lp group vip parent add default, lp group helper parent add vip, lp group admin parent add helper
  3. Give the groups weights: lp group vip setweight 10, lp group helper setweight 20, lp group admin setweight 30. Weight decides which group wins when a player is in more than one.
  4. Grant a permission: lp group helper permission set essentials.mute true
  5. Put a player in a group: lp user PlayerName parent set helper

parent set removes the player from their other groups and leaves only the one you name; because the inheritance chain is in place, they still carry default's permissions. Use parent add if you want to add a group on top of the ones the player already has.

The web editor: editing without memorising commands

The lp editor command produces a link that opens an editor in your browser. You edit groups, permissions and players there by clicking, then save. The changes are applied to the server; if the connection can't be made, the editor gives you a one-line command to run on the server instead. It is the most comfortable way to set many permissions at once.

Rank prefixes in chat

To show a player's rank in front of their name in chat, give the group a prefix: lp group vip meta setprefix 10 "&6[VIP] ". The number is the priority; when a player is in several groups, the prefix with the highest priority is shown. &6 is the colour code for gold.

LuckPerms only stores the prefix; it doesn't write it into chat itself. For the prefix to appear you need a plugin that formats chat; the most common pair is EssentialsX Chat with Vault.

Finding which permission a command needs

Plugin pages and documentation list the permission nodes of their commands. For anything you can't find there, use lp verbose on: while it is on, whenever a player tries a command LuckPerms writes which node was checked and what the result was to wherever you typed the command (in-game chat or the console). Turn it off with lp verbose off when you're done.

Common mistakes

  • Setting up permissions but leaving everyone as OP. An OP can use most commands regardless of the permission list. Once the system is in place, remove operator status from everyone but yourself with deop PlayerName.
  • Granting the star node. The * node opens everything. Even for the admin group, grant the permissions of the plugins you use one by one, so that a dangerous command added later by a plugin isn't switched on automatically.
  • Trusting names with unverified logins. If unverified logins (offline mode) are on, someone can join under another person's name. To keep staff names from being impersonated, turn on the whitelist and give permissions only to players you know.
  • Assuming a permission didn't apply. LuckPerms applies changes immediately; the player doesn't need to rejoin. If something doesn't work as expected, first check which groups the player is really in with lp user PlayerName info.

Once permissions are split up, our server security guide covers protecting your server at the other layers: who can join and what to do when something goes wrong.