Protection#

What a player who has not authenticated yet is stopped from doing. Every item can be turned off individually.

On the game server#

Standalone or bridge — the same set either way, on Paper and every fork of it (Purpur, Pufferfish, Folia, Canvas …).

protection:
  block-movement: true    # looking around still works, walking does not
  block-chat: true
  block-commands: true
  block-inventory: true   # click, drag, open, drop
  block-interact: true    # blocks, entities, vehicles
  block-break: true
  block-place: true
  block-damage: true      # taking and dealing
  block-teleport: true
  block-pickup: true
  hide-unlogged: false
  allowed-commands: []

Option	Notes
`block-movement`	The player can turn their head — only actual displacement is reverted, so it does not feel like a freeze-frame
`block-teleport`	The plugin's own teleports (login spawn, putting the player back) always go through
`block-damage`	Blocks damage in both directions, so a waiting player is neither killed nor used as a weapon
`hide-unlogged`	Hides unauthenticated players from everyone else, and from each other. Useful against bot spam in the player list

On a proxy#

Velocity and BungeeCord only see connections, chat and commands:

protection:
  block-chat: true
  block-commands: true
  block-server-switch: true
  allowed-commands: []

block-server-switch stops /server, portals and plugin-initiated connects while unauthenticated. The very first connection is always allowed, otherwise the player would never get in at all.

Chat on modern clients

Chat from an unauthenticated player is denied at the proxy so a mistyped password never reaches a backend server. On 1.19.1+ clients chat is cryptographically signed, and Velocity may log a note when it drops such a message. The message is not forwarded either way.

Movement, blocks, inventories and damage never reach a proxy at all — for those, put the same jar on your backend servers (bridge mode) or hold players on an auth server.

Allowed commands#

These always work while unauthenticated, including their aliases:

/login /l · /register /reg · /logout · /changepassword /changepass /cp · /unregister · /premium · /slimeadmin /sladmin

Add your own:

protection:
  allowed-commands:
    - "help"
    - "discord"
    - "vote"

No leading slash. plugin:command forms resolve to the same entry, so /myplugin:help is covered by help.

The kick timer#

A player who never authenticates is disconnected:

title:
  kick-after-seconds: 30    # 0 = never kick

This is also your first line of defence against bots holding connection slots. Captcha is the second.

While a player waits, a title is repeated on their screen:

show-title: true
title-main: "&6&lSLIME"
title-sub-login: "&7Type &e/login <password>"
title-sub-register: "&7Type &e/register <password> <confirm>"
title-fade-in: 10
title-stay: 60
title-fade-out: 10

title:
  repeat-interval-ticks: 60   # 20 ticks = 1 second

The subtitle changes depending on whether the player already has an account. Set show-title: false to turn the whole thing off.

Bypass#

slimelogin.bypass skips the gate — but only for an account that is genuinely Mojang-verified. A cracked client using a staff member's name still has to log in like everyone else. The permission is a convenience for real admins, not a way in.