CoreProtect: Roll Back Griefing and See Who Did What

CoreProtect logs every block change, container movement and interaction along with the player, the timestamp and the coordinates, so you can see afterwards who did what and undo it in a single command. /co i switches on inspect mode so you can click a block and read its history; /co rollback u:Player t:2d r:20 reverses whatever that player did within twenty blocks of you over the past two days. It is not a replacement for a backup: CoreProtect undoes a player's actions, whereas a backup returns your world to a moment in time. You want both.

What does CoreProtect actually log?

CoreProtect is a server-side plugin for Paper, Purpur or Spigot. Players need install nothing. It belongs to the core plugins you will find on practically every serious server, alongside EssentialsX, LuckPerms and WorldGuard.

What ends up in the log goes well beyond blocks:

• Blocks placed and broken, including what an explosion, fire or a piston moved
• Containers: who took which items out of a chest, furnace or hopper, or put them in
• Interactions: doors, trapdoors, buttons, pressure plates and container openings
• Chat, commands run and sessions: who logged in and out, and when
• Killed entities such as armour stands, item frames and pets

What it does not log matters just as much: the inventory a player is carrying, XP, advancements and data that other plugins track themselves, such as an economy balance or a claim. And it prevents nothing at all; it is a camera, not a lock. If you want to stop griefing before it happens, you need WorldGuard or GriefPrevention.

How does inspect mode work?

Inspect mode is how you investigate a report without changing anything: switch it on, click around the damaged area, and read in chat who has been past.

1. Type /co i (or /co inspect in full). You get a confirmation in chat.
2. Left-click a block that is still standing: you see who placed it, or who removed the previous block, and how long ago.
3. Left-click the spot where something has gone missing: you read the history of that exact position.
4. Right-click a block: you get the history of the space next to it.
5. Right-click a chest, furnace or hopper: you get the container log, line by line, with a plus or minus per item.
6. Type /co i again to switch the mode off. While it is on you cannot break or place anything.

Besides clicking there are two search commands. /co near shows what happened recently within a small radius around you, ideal when someone shouts that something is missing. /co lookup u:Name t:1d r:10 searches the log by player, time and radius; /co l 2 takes you to the next page. Always do this before a rollback, because the query you build here is exactly the rollback you are about to run.

How do you undo griefing with /co rollback?

A rollback uses the same parameters as a lookup: whatever the search would show is what gets reversed. That is why you search first, so you can see how many entries you are about to touch.

The order is always the same. Search first with /co l u:Griefer t:6h r:50, view it with #preview appended if you like, then run the same line as a rollback. Finally, walk through the area to check that nothing has been left behind.

Never roll back on radius alone when you know who did it: /co rollback t:6h r:50 without u: also removes whatever other players legitimately built there during those same six hours, and you will only find out when someone complains.

Rollback or restore: what is the difference?

A rollback undoes recorded actions. A restore performs those same actions again. Restore is therefore not a button for repairing your world, but the undo button for your own rollback.

Concretely: if a player spent three hours demolishing a housing district, /co rollback u:Player t:3h r:40 removes that demolition and the houses are back. If it turns out afterwards that you filtered too broadly and half of it was legitimate demolition, /co restore u:Player t:3h r:40 puts things back the way they were before you stepped in. The condition is that you use the same filters: roll back with t:3h and restore with t:6h and you will touch more than you intended.

How much logging do you really need?

This is where CoreProtect servers drift out of shape. By default the plugin logs a great deal: every water flow, every decaying leaf and every growing tree is an entry, and on a busy survival server that makes the database swell fast. It is rarely useful, because with griefing you are looking at who placed or broke something.

So go through plugins/CoreProtect/config.yml once and switch off what you never look up. leaf-decay, tree-growth and liquid-tracking are safe candidates, and on some servers hopper-transactions too, because that adds up quickly once players build large sorting systems. Keep block placement and breaking, container transactions, explosions and sessions switched on. That covers practically every griefing case.

Purging: how do you keep the database small?

The second half is tidying up. /co purge t:30d throws away everything older than thirty days. For most servers that is a sensible cut-off: griefing is nearly always reported within a few days, and anything nobody noticed after a month is not going to be rolled back anyway. On a small whitelisted project you can be more generous.

Schedule a purge outside peak hours: it works through the entire table, takes time and temporarily needs extra disk space. Newer versions can do this periodically on their own, so check your config.yml first. CoreProtect runs on SQLite by default, which is perfectly fine for a single server; MySQL is mainly of interest when you have several servers in a network. Fast storage makes the biggest difference, because on NVMe you barely notice the logging itself. More on that in our article on optimising your Minecraft server.

Why is CoreProtect not a backup?

This misunderstanding costs people worlds on a regular basis. CoreProtect only knows what it has seen itself: player actions, with a timestamp. A backup knows the entire world folder exactly as it sat on disk at a given moment. Two tools for two kinds of disaster.

If a world is damaged after a version change, CoreProtect has nothing to roll back. The other way round: restore last night's backup because one player knocked down a tower and everybody else loses an evening's work too. That is why you should have both. Automatic backups are included as standard with Minecraft hosting at MC-Node, along with NVMe storage and the Pterodactyl panel.

When do you not need CoreProtect?

On a pure NeoForge, Forge or Fabric server it simply will not run. Plugins are Bukkit-based and only work on Paper, Purpur or Spigot; a modpack like All the Mods 10 runs on NeoForge with Minecraft 1.21.1 and will not load a single plugin. If you play a pack like that, you lean on your backups and on whatever protection the pack brings along itself. How those worlds fit together is covered in our explanation of modpacks and how to install them.

On a private server with five friends who trust each other, the benefit is small; the plugin mostly costs you disk space. Even so, most administrators install it anyway: if it is not running at the moment you need it, there is nothing to investigate. Switching it on after the fact does not help.

Frequently asked questions

Can I undo a rollback? Yes. Run /co restore with exactly the same parameters as the rollback, so the same u:, t: and r:. Deviate on time or radius and you will restore more or less than you reversed. Test large actions with #preview first.

How far back can CoreProtect roll? Exactly as far as your database goes. If you purge monthly with /co purge t:30d, you can go back thirty days at most. Anyone who wants to look further back purges less aggressively and accepts more disk usage, because the database grows with the activity on your server.

Does CoreProtect slow my server down? In normal use, hardly: logging happens in the background and the load lands mainly on storage, where NVMe makes the difference. What you will notice are large rollbacks and purges, so run those outside peak hours.

Does CoreProtect work on a modpack server? Not on a pure mod loader. All the Mods 10 runs on NeoForge with Minecraft 1.21.1 and Java 21, and a NeoForge server loads no Bukkit plugins. If you want CoreProtect you need Paper or Purpur, and that means running no content mods.

Does a rollback bring stolen items back too? Yes, container contents are restored as long as container transaction logging is switched on. /co rollback u:Thief t:12h r:10 a:container touches only chests and furnaces. Whatever the thief is carrying in their own inventory at that moment falls outside it: CoreProtect does not log player inventories.

Further reading

• GriefPrevention: Let Players Claim Their Own Land
• spark: find out where the lag on your Minecraft server comes from
• Datapacks vs Mods vs Plugins: What Is the Difference?