Two separate problems get called security: cheating clients, and people joining as someone else. Different plugins solve them.
Page updated
2 resources, newest first
Server Security Plugins · Security Plugin · by AuthMe
An authentication plugin that adds registration and login with passwords for servers that cannot use Mojang's online mode.
Paper · Spigot · Velocity · +3MC 26.3 · 26.2
Folia support · Open source · +1
Server Security Plugins · Security Plugin · by GrimAnticheat
An open source predictive anticheat for Minecraft servers that simulates player movement to detect cheating clients.
Paper · Spigot · Purpur · +3MC 26.2
Folia support · Open source
Anticheat catches modified clients. Grim is a predictive anticheat: instead of checking a list of known cheats, it simulates the movement the game's rules allow and flags a player whose movement does not fit. That approach aims to catch new cheats without a signature for each, and to avoid false flags for lag, at the cost of being demanding to configure and keep current. It supports Paper and Folia among other platforms.
Login protection is for servers that do not check accounts with Mojang. Behind a proxy or in offline mode, the server cannot tell who a player is, so anyone can join under any name, including an operator's. AuthMe adds registration and login with passwords, so a name is protected by something other than trust. It does not replace online mode; where online mode is available, use it.
Treat both as layers rather than complete answers. Test anticheat with the same lag, mods and Bedrock players your community has, and begin with alerts for staff before enabling automatic punishments. Store login data securely, rate-limit login attempts and tell players how passwords are stored.
Do I need AuthMe if my server is in online mode? No. Online mode authenticates players with Mojang. AuthMe is for servers that cannot use it.
Can an anticheat prove someone cheated? No. It reports behaviour that does not fit the rules. A human should review serious punishments.
Twenty checks that close the most common ways servers are taken over: accounts, ports, proxies, panels, plugins and backups.
MCRank Editorial
MCRank is Minecraft resource search and discovery. Featured placement is its paid visibility layer: creators pay to appear first, labeled Featured, on the page their resource belongs to and in searches that resolve to it. Payment buys placement, not guaranteed clicks, traffic or sales, and never an MCRank endorsement. It is bought by the owner of an approved resource, from their account.
Paid Featured placement is not available at the moment.