{"id":116531,"date":"2026-06-06T23:35:48","date_gmt":"2026-06-06T20:35:48","guid":{"rendered":"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/"},"modified":"2026-06-06T23:35:48","modified_gmt":"2026-06-06T20:35:48","slug":"opshield","status":"publish","type":"mod","link":"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/","title":{"rendered":"OPShield"},"content":{"rendered":"
\n

# \ud83d\udee1\ufe0f OPShield<\/p>\n

**Advanced security & command protection plugin for Paper 1.21+**<\/p>\n

![Version]()
\n![Paper]()
\n![Java]()
\n![License]()<\/p>\n

*Protect your server from abuse \u2014 secure OP access, track every action, stop attackers instantly.*<\/p>\n<\/div>\n

—<\/p>\n

## \ud83d\udcd6 Table of Contents<\/p>\n

– \u2728 Features
\n– \ud83d\udd10 Security System
\n– \ud83d\udcca Audit & Logging
\n– \ud83d\udce6 Requirements
\n– \ud83d\ude80 Installation
\n– \u2328\ufe0f Commands & Permissions
\n– \ud83d\udd27 Configuration
\n– \ud83d\udd0d Troubleshooting
\n– \u2753 FAQ
\n– \ud83d\udcc4 Credits<\/p>\n

—<\/p>\n

# \u2728 Features<\/p>\n

## \ud83d\udd12 OP Protection<\/p>\n

– Password-gated `\/op` and `\/deop` \u2014 no password, no privilege changes
\n– PBKDF2-HMAC-SHA256 hashed storage \u2014 plaintext never kept in config
\n– Configurable PBKDF2 iteration count (`security.password.pbkdf2_iterations`)
\n– Automatic migration from legacy plaintext and SHA-256 hashes
\n– **Auto-upgrade legacy hashes** \u2014 on next successful login, SHA-256 is silently replaced with PBKDF2 (`security.password.auto_upgrade_legacy_hash`)
\n– Console warning if a legacy SHA-256 hash is detected on startup
\n– OP whitelist \u2014 restrict `\/op` to a predefined set of player names<\/p>\n

—<\/p>\n

## \ud83d\udeab Sensitive Command Protection<\/p>\n

– Block dangerous commands for non-OP players (`blocked_commands`)
\n– Optionally block commands even for OP players (`blocked_op_commands`)
\n– Block entire command namespaces via prefix list (`blocked_command_prefixes`)
\n– Alias and namespace resolution \u2014 bypass attempts via `minecraft:op` or plugin aliases are caught
\n– Per-player bypass permission (`opshield.bypass`) for trusted staff<\/p>\n

—<\/p>\n

## \ud83e\udde0 Brute-force Detection & Lockout<\/p>\n

– Configurable failed-attempt limit before lockout (`security.lockout.max-attempts`)
\n– Exponential backoff \u2014 each offence doubles the lockout duration
\n– Optional IP-mirrored lockout (`security.lockout.track_ip`)
\n– Lockout count decay after a cooling-off period (`security.lockout.count_decay_hours`)
\n– Persistent tracking \u2014 lockout state survives server restarts
\n– Manual unlock via `\/opshield unlock `<\/p>\n

—<\/p>\n

## \ud83d\udd75\ufe0f Shadow Ban System<\/p>\n

– Sensitive blocked commands send a fake success message instead of an error
\n– Each trigger increments the player’s hidden shadow-ban level
\n– Level persists across restarts
\n– Auto-escalates to real punishment when `shadow_ban.auto_punish_level` is reached
\n– Set `auto_punish_level: 99` to keep decoy behaviour without escalation
\n– Fake messages come from language files \u2014 fully customisable per locale<\/p>\n

—<\/p>\n

## \u26a0\ufe0f Auto Punishment System<\/p>\n

– Punishment modes: `kick`, `ban`, `ban-ip`, `firewall`, `custom`
\n– Persistent rolling-window threshold \u2014 survives restarts and crashes
\n– Firewall mode runs an OS script asynchronously via `ProcessBuilder` with configurable timeout
\n– Custom mode supports `{player}` and `{ip}` placeholders
\n– IP-limit auto-punishment for accounts detected sharing the same IP<\/p>\n

—<\/p>\n

## \ud83c\udf0d Multi-Language Support<\/p>\n

– Bundled language files: **English** (`en`), **Vietnamese** (`vn`), **Russian** (`ru`)
\n– Automatic fallback to English for any missing key
\n– Switch language via `language: “en”` in `config.yml`<\/p>\n

—<\/p>\n

# \ud83d\udcca Audit & Logging<\/p>\n

– Every privilege change, password failure, command block, and punishment is logged
\n– Async queue \u2014 log writes never touch the main thread
\n– **Queue capacity limit** \u2014 `audit.max_queue_size` prevents OOM if disk writes fail for extended periods
\n– **Dual output format** \u2014 `audit.format: plain` (default human-readable) or `audit.format: json` (machine-readable, one JSON object per line)
\n– **UTF-8 safe** \u2014 uses NIO `Files.write()` with explicit charset
\n– **Retry on failure** \u2014 failed writes are re-queued instead of silently discarded
\n– Configurable rotation: `audit.max_file_size_mb` and `audit.log_retention` (up to N backup files)
\n– Optional console mirror: `audit.console_output: true`
\n– Log files: `plugins\/OPShield\/audit.log`, `audit.log.1` \u2026 `audit.log.N`<\/p>\n

—<\/p>\n

# \ud83d\udce6 Requirements<\/p>\n

| Component | Version |
\n|———–|———|
\n| Java | 21+ |
\n| Paper | 1.21+ |
\n| Folia | \u274c Not supported |<\/p>\n

—<\/p>\n

# \ud83d\ude80 Installation<\/p>\n

1. Download the plugin `.jar`
\n2. Drop it into your server’s `plugins\/` folder
\n3. Start the server \u2014 OPShield will generate a random password and print it **once** in the console
\n4. Save the password somewhere safe (it is only shown once)
\n5. **Grant permissions** \u2014 add `opshield.admin` to your admin group in your permission plugin (e.g. LuckPerms). OPShield no longer grants permissions based on OP status alone (changed in v1.8.0)
\n6. Open `plugins\/OPShield\/config.yml` to customise behaviour
\n7. Run `\/opshield reload` in-game or restart to apply changes \u2705<\/p>\n

> **Upgrading from 1.7.0?** `data.yml` is automatically migrated on first boot. You only need to update your permission plugin setup \u2014 see the CRITICAL note in the changelog.<\/p>\n

> **Tip:** If you already have an `op_password` plaintext value from an older version,
\n> OPShield will automatically migrate it to `op_password_hash` and remove the plaintext entry.<\/p>\n

—<\/p>\n

# \u2328\ufe0f Commands<\/p>\n

| Command | Description |
\n|———|————-|
\n| `\/op [password]` | Grant OP with password verification |
\n| `\/deop [password]` | Remove OP with password verification |
\n| `\/opshield reload` | Reload configuration |
\n| `\/opshield unlock ` | Clear all tracking state for a player or IP |
\n| `\/opshield status` | Show runtime statistics (active levels, flagged IPs, etc.) |<\/p>\n

—<\/p>\n

# \ud83d\udd10 Permissions<\/p>\n

> \u26a0\ufe0f **Changed in v1.8.0:** All permissions now default to `false`. You must grant them explicitly via a permission plugin.<\/p>\n

| Permission | Default | Description |
\n|————|———|————-|
\n| `opshield.*` | false | Wildcard \u2014 grants all permissions |
\n| `opshield.admin` | false | Grants all child permissions |
\n| `opshield.reload` | false | Reload OPShield configuration |
\n| `opshield.unlock` | false | Unlock a tracked player or IP |
\n| `opshield.status` | false | View runtime statistics |
\n| `opshield.op` | false | Use password-protected `\/op` |
\n| `opshield.deop` | false | Use password-protected `\/deop` |
\n| `opshield.bypass` | false | Bypass non-OP restricted command blocking |<\/p>\n

### Example LuckPerms setup
\n“`bash
\n\/lp group admin permission set opshield.admin true
\n“`<\/p>\n

—<\/p>\n

# \ud83d\udd27 Configuration<\/p>\n

Files generated under `plugins\/OPShield\/`:<\/p>\n

– `config.yml` \u2014 main configuration
\n– `data.yml` \u2014 persistent runtime state (lockouts, shadow-ban levels, IP windows)
\n– `languages\/en.yml` \u2014 English messages
\n– `languages\/vn.yml` \u2014 Vietnamese messages
\n– `languages\/ru.yml` \u2014 Russian messages<\/p>\n

—<\/p>\n

## \u2699\ufe0f Key Config Options<\/p>\n

“`yaml
\n# Enable verbose console logging for troubleshooting (disable in production)
\ndebug: false<\/p>\n

# Password security
\nsecurity:
\n lockout:
\n enabled: true
\n max-attempts: 3
\n duration-minutes: 3
\n track_ip: true
\n count_decay_hours: 168
\n password:
\n pbkdf2_iterations: 120000 # range: 10000 \u2013 1000000
\n auto_upgrade_legacy_hash: true # silently upgrade SHA-256 \u2192 PBKDF2 on login<\/p>\n

# Auto-punishment
\nauto_punishment:
\n enabled: true
\n threshold: 5
\n window_seconds: 300
\n command: “kick” # kick | ban | ban-ip | firewall | custom
\n firewall_timeout_seconds: 10<\/p>\n

# Shadow ban
\nshadow_ban:
\n enabled: true
\n auto_punish_level: 5<\/p>\n

# Audit log
\naudit:
\n console_output: true
\n max_file_size_mb: 5
\n log_retention: 3
\n max_queue_size: 10000 # 0 = unlimited (not recommended)
\n format: “plain” # plain | json
\n“`<\/p>\n

—<\/p>\n

## \ud83d\udcd0 Recommended settings by server size<\/p>\n

**Small server (\u2264 20 players)**
\n“`yaml
\nsecurity.lockout.max-attempts: 3
\nsecurity.lockout.duration-minutes: 5
\nip_limit.max_accounts: 2
\nauto_punishment.enabled: false
\nshadow_ban.auto_punish_level: 10
\n“`<\/p>\n

**Medium server (20\u2013100 players)**
\n“`yaml
\nsecurity.lockout.max-attempts: 3
\nsecurity.lockout.duration-minutes: 3
\nip_limit.max_accounts: 3
\nauto_punishment.enabled: true
\nauto_punishment.command: kick
\nauto_punishment.threshold: 5
\nshadow_ban.auto_punish_level: 5
\n“`<\/p>\n

**Large server (100+ players)**
\n“`yaml
\nsecurity.lockout.max-attempts: 2
\nsecurity.lockout.duration-minutes: 10
\nip_limit.max_accounts: 2
\nauto_punishment.enabled: true
\nauto_punishment.command: ban-ip
\nauto_punishment.threshold: 3
\nshadow_ban.auto_punish_level: 3
\n“`<\/p>\n

—<\/p>\n

## \ud83d\udd25 Firewall mode setup<\/p>\n

Firewall mode executes an OS script asynchronously. To enable it:<\/p>\n

“`yaml
\nauto_punishment:
\n command: “firewall”
\n allow_unsafe_firewall_exec: true
\n firewall_timeout_seconds: 10
\n # Linux:
\n firewall_script: “iptables -A INPUT -s {ip} -j DROP”
\n # Windows:
\n # firewall_script: “netsh advfirewall firewall add rule name=OPShield dir=in action=block remoteip={ip}”
\n“`<\/p>\n

If `allow_unsafe_firewall_exec` is `false`, firewall mode falls back to a safe kick.<\/p>\n

—<\/p>\n

# \ud83d\udd0d Troubleshooting<\/p>\n

\nCannot use \/op \u2014 “Incorrect password”<\/b><\/summary>\n

The password is required. Run:
\n“`
\n\/op \n“`
\nIf you forgot the password, clear `op_password_hash` in `config.yml` and restart \u2014 a new password will be generated and printed in the console.
\n<\/details>\n

\nAdmin cannot use \/opshield after upgrading from 1.7.0<\/b><\/summary>\n

In v1.8.0, permissions now default to `false` instead of `op`. You need to explicitly grant the permission:
\n“`bash
\n\/lp group admin permission set opshield.admin true
\n“`
\n<\/details>\n

\nPlayer is locked out and cannot try again<\/b><\/summary>\n

An admin can manually clear the lockout:
\n“`
\n\/opshield unlock \n\/opshield unlock
\n“`
\n<\/details>\n

\nAuto-punishment is not triggering<\/b><\/summary>\n

Check the following:
\n– `auto_punishment.enabled: true` in `config.yml`
\n– The command the player used is listed in `auto_punishment.sensitive_commands`
\n– `shadow_ban.enabled` \u2014 if true, the player may be getting fake success messages first; level must reach `auto_punish_level`
\n– Run `\/opshield reload` after any config change
\n– Run `\/opshield status` to see current shadow-ban levels and punish state
\n<\/details>\n

\nAudit log is empty or not updating<\/b><\/summary>\n

– Check `audit.console_output: true` to confirm logging is active
\n– Check write permissions on the `plugins\/OPShield\/` folder
\n– If `audit.max_queue_size` is reached, a `SEVERE` warning appears in console \u2014 check disk space
\n<\/details>\n

\nConfig changes are not taking effect<\/b><\/summary>\n

Run in-game or console:
\n“`
\n\/opshield reload
\n“`
\n<\/details>\n

—<\/p>\n

# \u2753 FAQ<\/p>\n

### Does OPShield replace `\/op`?
\nNo \u2014 it intercepts and wraps it. The original `\/op` behaviour is preserved but gated behind a password.<\/p>\n

—<\/p>\n

### Is the password stored securely?
\nYes \u2014 passwords are hashed using PBKDF2-HMAC-SHA256 with a random salt and 120,000 iterations (configurable). The plaintext is never written to disk.<\/p>\n

—<\/p>\n

### Does it support Spigot or Folia?
\nPaper 1.21+ only. Spigot may work but is not tested. Folia is explicitly **not supported** (`folia-supported: false`).<\/p>\n

—<\/p>\n

### Can I disable auto-punishment entirely?
\nYes \u2014 set `auto_punishment.enabled: false`. Shadow-ban fake messages will still work independently.<\/p>\n

—<\/p>\n

### What happens if the server restarts during a lockout?
\nLockout state is persisted to `data.yml` and restored on startup. Players cannot bypass lockouts by crashing or restarting the server.<\/p>\n

—<\/p>\n

### Can I have multiple language files?
\nYes \u2014 all three bundled files (`en`, `vn`, `ru`) are always present. Switch via `language:` in `config.yml`. Missing keys automatically fall back to the bundled English defaults.<\/p>\n

—<\/p>\n

### What changed in v1.8.0?
\nThe most important change is **permission defaults** \u2014 see the [Changelog](CHANGELOG.md) for the full list. The short version: grant `opshield.admin` to your admin group in LuckPerms.<\/p>\n

—<\/p>\n

# \ud83d\udcc4 Credits<\/p>\n

**Author:** Duong2012G
\n**License:** Apache 2.0
\n**Website:** https:\/\/modrinth.com\/user\/Duong2012G<\/p>\n

*Built for secure, professional Minecraft servers.*
\n– Password-gated `\/op` and `\/deop` \u2014 no password, no privilege changes
\n– PBKDF2-HMAC-SHA256 hashed storage \u2014 plaintext never kept in config
\n– Configurable PBKDF2 iteration count (`security.password.pbkdf2_iterations`)
\n– Automatic migration from legacy plaintext and SHA-256 hashes
\n– Console warning if a legacy SHA-256 hash is detected on startup
\n– OP whitelist \u2014 restrict `\/op` to a predefined set of player names<\/p>\n

—<\/p>\n

## \ud83d\udeab Sensitive Command Protection<\/p>\n

– Block dangerous commands for non-OP players (`blocked_commands`)
\n– Optionally block commands even for OP players (`blocked_op_commands`)
\n– Block entire command namespaces via prefix list (`blocked_command_prefixes`)
\n– Alias and namespace resolution \u2014 bypass attempts via `minecraft:op` or plugin aliases are caught
\n– Per-player bypass permission (`opshield.bypass`) for trusted staff<\/p>\n

—<\/p>\n

## \ud83e\udde0 Brute-force Detection & Lockout<\/p>\n

– Configurable failed-attempt limit before lockout (`security.lockout.max-attempts`)
\n– Exponential backoff \u2014 each offence doubles the lockout duration
\n– Optional IP-mirrored lockout (`security.lockout.track_ip`)
\n– Lockout count decay after a cooling-off period (`security.lockout.count_decay_hours`)
\n– Persistent tracking \u2014 lockout state survives server restarts
\n– Manual unlock via `\/opshield unlock `<\/p>\n

—<\/p>\n

## \ud83d\udd75\ufe0f Shadow Ban System<\/p>\n

– Sensitive blocked commands send a fake success message instead of an error
\n– Each trigger increments the player’s hidden shadow-ban level
\n– Level persists across restarts
\n– Auto-escalates to real punishment when `shadow_ban.auto_punish_level` is reached
\n– Set `auto_punish_level: 99` to keep decoy behaviour without escalation<\/p>\n

—<\/p>\n

## \u26a0\ufe0f Auto Punishment System<\/p>\n

– Punishment modes: `kick`, `ban`, `ban-ip`, `firewall`, `custom`
\n– Persistent rolling-window threshold \u2014 survives restarts and crashes
\n– Firewall mode runs an OS script asynchronously via `ProcessBuilder` with configurable timeout
\n– Custom mode supports `{player}` and `{ip}` placeholders
\n– IP-limit auto-punishment for accounts detected sharing the same IP<\/p>\n

—<\/p>\n

## \ud83c\udf0d Multi-Language Support<\/p>\n

– Bundled language files: **English** (`en`), **Vietnamese** (`vn`), **Russian** (`ru`)
\n– Automatic fallback to English for any missing key
\n– Switch language via `language: “en”` in `config.yml`<\/p>\n

—<\/p>\n

# \ud83d\udcca Audit & Logging<\/p>\n

– Every privilege change, password failure, command block, and punishment is logged
\n– Async queue \u2014 log writes never touch the main thread
\n– **UTF-8 safe** \u2014 uses NIO `Files.write()` with explicit charset (fixed in 1.6.0)
\n– **Retry on failure** \u2014 failed writes are re-queued instead of silently discarded (fixed in 1.6.0)
\n– Configurable rotation: `audit.max_file_size_mb` and `audit.log_retention` (up to N backup files)
\n– Optional console mirror: `audit.console_output: true`
\n– Log files: `plugins\/OPShield\/audit.log`, `audit.log.1` \u2026 `audit.log.N`<\/p>\n

—<\/p>\n

# \ud83d\udce6 Requirements<\/p>\n

| Component | Version |
\n|———–|———|
\n| Java | 21+ |
\n| Paper | 1.21+ |
\n| Folia | \u274c Not supported |<\/p>\n

—<\/p>\n

# \ud83d\ude80 Installation<\/p>\n

1. Download the plugin `.jar`
\n2. Drop it into your server’s `plugins\/` folder
\n3. Start the server \u2014 OPShield will generate a random password and print it **once** in the console
\n4. Save the password somewhere safe (it is only shown once)
\n5. Open `plugins\/OPShield\/config.yml` to customise behaviour
\n6. Run `\/opshield reload` in-game or restart to apply changes \u2705<\/p>\n

> **Tip:** If you already have an `op_password` plaintext value from an older version,
\n> OPShield will automatically migrate it to `op_password_hash` and remove the plaintext entry.<\/p>\n

—<\/p>\n

# \u2328\ufe0f Commands<\/p>\n

| Command | Description |
\n|———|————-|
\n| `\/op [password]` | Grant OP with password verification |
\n| `\/deop [password]` | Remove OP with password verification |
\n| `\/opshield reload` | Reload configuration |
\n| `\/opshield unlock ` | Clear all tracking state for a player or IP |<\/p>\n

—<\/p>\n

# \ud83d\udd10 Permissions<\/p>\n

| Permission | Default | Description |
\n|————|———|————-|
\n| `opshield.admin` | op | Grants all child permissions |
\n| `opshield.reload` | op | Reload OPShield configuration |
\n| `opshield.unlock` | op | Unlock a tracked player or IP |
\n| `opshield.op` | op | Use password-protected `\/op` |
\n| `opshield.deop` | op | Use password-protected `\/deop` |
\n| `opshield.bypass` | false | Bypass non-OP restricted command blocking |<\/p>\n

—<\/p>\n

# \ud83d\udd27 Configuration<\/p>\n

Files generated under `plugins\/OPShield\/`:<\/p>\n

– `config.yml` \u2014 main configuration
\n– `data.yml` \u2014 persistent runtime state (lockouts, shadow-ban levels, IP windows)
\n– `languages\/en.yml` \u2014 English messages
\n– `languages\/vn.yml` \u2014 Vietnamese messages
\n– `languages\/ru.yml` \u2014 Russian messages<\/p>\n

—<\/p>\n

## \u2699\ufe0f Example Config<\/p>\n

“`yaml
\n# Password security
\nsecurity:
\n lockout:
\n enabled: true
\n max-attempts: 3
\n duration-minutes: 3
\n track_ip: true
\n count_decay_hours: 168
\n password:
\n pbkdf2_iterations: 120000 # range: 10000 \u2013 1000000<\/p>\n

# Auto-punishment
\nauto_punishment:
\n enabled: true
\n threshold: 5
\n window_seconds: 300
\n command: “kick” # kick | ban | ban-ip | firewall | custom
\n firewall_timeout_seconds: 10<\/p>\n

# Shadow ban
\nshadow_ban:
\n enabled: true
\n auto_punish_level: 3<\/p>\n

# Audit log
\naudit:
\n console_output: true
\n max_file_size_mb: 5
\n log_retention: 3
\n“`<\/p>\n

—<\/p>\n

## \ud83d\udcd0 Recommended settings by server size<\/p>\n

**Small server (\u2264 20 players)**
\n“`yaml
\nsecurity.lockout.max-attempts: 3
\nsecurity.lockout.duration-minutes: 5
\nip_limit.max_accounts: 2
\nauto_punishment.enabled: false
\n“`<\/p>\n

**Medium server (20\u2013100 players)**
\n“`yaml
\nsecurity.lockout.max-attempts: 3
\nsecurity.lockout.duration-minutes: 3
\nip_limit.max_accounts: 3
\nauto_punishment.enabled: true
\nauto_punishment.command: kick
\nauto_punishment.threshold: 5
\nshadow_ban.auto_punish_level: 3
\n“`<\/p>\n

**Large server (100+ players)**
\n“`yaml
\nsecurity.lockout.max-attempts: 2
\nsecurity.lockout.duration-minutes: 10
\nip_limit.max_accounts: 2
\nauto_punishment.enabled: true
\nauto_punishment.command: ban-ip
\nauto_punishment.threshold: 3
\nshadow_ban.auto_punish_level: 2
\n“`<\/p>\n

—<\/p>\n

## \ud83d\udd25 Firewall mode setup<\/p>\n

Firewall mode executes an OS script asynchronously. To enable it:<\/p>\n

“`yaml
\nauto_punishment:
\n command: “firewall”
\n allow_unsafe_firewall_exec: true
\n firewall_timeout_seconds: 10
\n # Linux:
\n firewall_script: “iptables -A INPUT -s {ip} -j DROP”
\n # Windows:
\n # firewall_script: “netsh advfirewall firewall add rule name=OPShield dir=in action=block remoteip={ip}”
\n“`<\/p>\n

If `allow_unsafe_firewall_exec` is `false`, firewall mode falls back to a safe kick.<\/p>\n

—<\/p>\n

# \ud83d\udd0d Troubleshooting<\/p>\n

\nCannot use \/op \u2014 “Incorrect password”<\/b><\/summary>\n

The password is required. Run:
\n“`
\n\/op \n“`
\nIf you forgot the password, clear `op_password_hash` in `config.yml` and restart \u2014 a new password will be generated and printed in the console.
\n<\/details>\n

\nPlayer is locked out and cannot try again<\/b><\/summary>\n

An admin can manually clear the lockout:
\n“`
\n\/opshield unlock \n\/opshield unlock
\n“`
\n<\/details>\n

\nAuto-punishment is not triggering<\/b><\/summary>\n

Check the following:
\n– `auto_punishment.enabled: true` in `config.yml`
\n– The command the player used is listed in `auto_punishment.sensitive_commands`
\n– `shadow_ban.enabled` \u2014 if true, the player may be getting fake success messages instead
\n– Run `\/opshield reload` after any config change
\n<\/details>\n

\nAudit log is empty or not updating<\/b><\/summary>\n

– Check `audit.console_output: true` to confirm logging is active
\n– Check write permissions on the `plugins\/OPShield\/` folder
\n– In 1.6.0, failed writes are retried and logged to console as `SEVERE` \u2014 check console output
\n<\/details>\n

\nConfig changes are not taking effect<\/b><\/summary>\n

Run in-game or console:
\n“`
\n\/opshield reload
\n“`
\n<\/details>\n

—<\/p>\n

# \u2753 FAQ<\/p>\n

### Does OPShield replace `\/op`?
\nNo \u2014 it intercepts and wraps it. The original `\/op` behaviour is preserved but gated behind a password.<\/p>\n

—<\/p>\n

### Is the password stored securely?
\nYes \u2014 passwords are hashed using PBKDF2-HMAC-SHA256 with a random salt and 120,000 iterations (configurable). The plaintext is never written to disk.<\/p>\n

—<\/p>\n

### Does it support Spigot or Folia?
\nPaper 1.21+ only. Spigot may work but is not tested. Folia is explicitly **not supported** (`folia-supported: false`).<\/p>\n

—<\/p>\n

### Can I disable auto-punishment entirely?
\nYes \u2014 set `auto_punishment.enabled: false`. Shadow-ban fake messages will still work independently.<\/p>\n

—<\/p>\n

### What happens if the server restarts during a lockout?
\nLockout state is persisted to `data.yml` and restored on startup. Players cannot bypass lockouts by crashing or restarting the server.<\/p>\n

—<\/p>\n

### Can I have multiple language files?
\nYes \u2014 all three bundled files (`en`, `vn`, `ru`) are always present. Switch via `language:` in `config.yml`. Missing keys automatically fall back to the bundled English defaults.<\/p>\n

—<\/p>\n

# \ud83d\udcc4 Credits<\/p>\n

**Author:** Duong2012G
\n**License:** Apache 2.0
\n**Website:** https:\/\/modrinth.com\/user\/Duong2012G<\/p>\n

*Built for secure, professional Minecraft servers.*<\/p>\n","protected":false},"excerpt":{"rendered":"

Protects your server from OP\/admin abuse with console-only OP (via password) and optional admin command restriction.<\/p>\n","protected":false},"featured_media":116532,"template":"","meta":{"_minecraft_slug":"opshield","_minecraft_project_id":"Bv67n40d","_minecraft_author":"Duong2012G","_minecraft_license":"Apache-2.0","_minecraft_downloads":126,"_minecraft_follows":1,"_minecraft_client_side":"unsupported","_minecraft_server_side":"required","_minecraft_storage_type":"zip","_minecraft_archive_name":"opshield.zip","_minecraft_size_bytes":313347,"_minecraft_version_count":13,"_minecraft_updated_at":"2026-05-15T19:18:28.885989Z","_minecraft_date_created":"2026-03-11T23:13:21.779083Z","_minecraft_date_modified":"2026-05-15T23:50:32.684537Z","_minecraft_project_url":"https:\/\/modrinth.com\/mod\/opshield","_minecraft_icon_attachment_id":116532,"_minecraft_imported_at":"2026-06-06T20:35:49+00:00","_minecraft_import_hash":"c114ca455fb3921ddde59ef99407cd14","_minecraft_versions":"","_minecraft_links":"","_minecraft_gallery":"","_minecraft_api_metadata":""},"mod_category":[87,124,43,126,127,128,129],"mod_loader":[130,132,133,134],"minecraft_version":[62,37,40,41,73,74,38,78,79,80,81,82],"class_list":["post-116531","mod","type-mod","status-publish","has-post-thumbnail","hentry","mod_category-adventure","mod_category-bukkit","mod_category-cursed","mod_category-management","mod_category-paper","mod_category-purpur","mod_category-spigot","mod_loader-bukkit","mod_loader-paper","mod_loader-purpur","mod_loader-spigot","minecraft_version-1-21","minecraft_version-1-21-1","minecraft_version-1-21-10","minecraft_version-1-21-11","minecraft_version-1-21-2","minecraft_version-1-21-3","minecraft_version-1-21-4","minecraft_version-1-21-5","minecraft_version-1-21-6","minecraft_version-1-21-7","minecraft_version-1-21-8","minecraft_version-1-21-9"],"yoast_head":"\nOPShield - Minecraft<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OPShield - Minecraft\" \/>\n<meta property=\"og:description\" content=\"Protects your server from OP\/admin abuse with console-only OP (via password) and optional admin command restriction.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/\" \/>\n<meta property=\"og:site_name\" content=\"Minecraft\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"14 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/mods\\\/opshield\\\/\",\"url\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/mods\\\/opshield\\\/\",\"name\":\"OPShield - Minecraft\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/mods\\\/opshield\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/mods\\\/opshield\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/opshield-icon-8e8db8948461db1f2f46d24a17daf4eff2c9c9d6_96.webp\",\"datePublished\":\"2026-06-06T20:35:48+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/mods\\\/opshield\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/mods\\\/opshield\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/mods\\\/opshield\\\/#primaryimage\",\"url\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/opshield-icon-8e8db8948461db1f2f46d24a17daf4eff2c9c9d6_96.webp\",\"contentUrl\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/opshield-icon-8e8db8948461db1f2f46d24a17daf4eff2c9c9d6_96.webp\",\"width\":96,\"height\":96},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/mods\\\/opshield\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Mods\",\"item\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/mods\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"OPShield\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/#website\",\"url\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/\",\"name\":\"Minecraft\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/vpesports.com\\\/minecraft\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"OPShield - Minecraft","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/","og_locale":"en_US","og_type":"article","og_title":"OPShield - Minecraft","og_description":"Protects your server from OP\/admin abuse with console-only OP (via password) and optional admin command restriction.","og_url":"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/","og_site_name":"Minecraft","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"14 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/","url":"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/","name":"OPShield - Minecraft","isPartOf":{"@id":"https:\/\/vpesports.com\/minecraft\/#website"},"primaryImageOfPage":{"@id":"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/#primaryimage"},"image":{"@id":"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/#primaryimage"},"thumbnailUrl":"https:\/\/vpesports.com\/minecraft\/wp-content\/uploads\/2026\/06\/opshield-icon-8e8db8948461db1f2f46d24a17daf4eff2c9c9d6_96.webp","datePublished":"2026-06-06T20:35:48+00:00","breadcrumb":{"@id":"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/vpesports.com\/minecraft\/mods\/opshield\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/#primaryimage","url":"https:\/\/vpesports.com\/minecraft\/wp-content\/uploads\/2026\/06\/opshield-icon-8e8db8948461db1f2f46d24a17daf4eff2c9c9d6_96.webp","contentUrl":"https:\/\/vpesports.com\/minecraft\/wp-content\/uploads\/2026\/06\/opshield-icon-8e8db8948461db1f2f46d24a17daf4eff2c9c9d6_96.webp","width":96,"height":96},{"@type":"BreadcrumbList","@id":"https:\/\/vpesports.com\/minecraft\/mods\/opshield\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/vpesports.com\/minecraft\/"},{"@type":"ListItem","position":2,"name":"Mods","item":"https:\/\/vpesports.com\/minecraft\/mods\/"},{"@type":"ListItem","position":3,"name":"OPShield"}]},{"@type":"WebSite","@id":"https:\/\/vpesports.com\/minecraft\/#website","url":"https:\/\/vpesports.com\/minecraft\/","name":"Minecraft","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/vpesports.com\/minecraft\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/vpesports.com\/minecraft\/wp-json\/wp\/v2\/mod\/116531","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vpesports.com\/minecraft\/wp-json\/wp\/v2\/mod"}],"about":[{"href":"https:\/\/vpesports.com\/minecraft\/wp-json\/wp\/v2\/types\/mod"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vpesports.com\/minecraft\/wp-json\/wp\/v2\/media\/116532"}],"wp:attachment":[{"href":"https:\/\/vpesports.com\/minecraft\/wp-json\/wp\/v2\/media?parent=116531"}],"wp:term":[{"taxonomy":"mod_category","embeddable":true,"href":"https:\/\/vpesports.com\/minecraft\/wp-json\/wp\/v2\/mod_category?post=116531"},{"taxonomy":"mod_loader","embeddable":true,"href":"https:\/\/vpesports.com\/minecraft\/wp-json\/wp\/v2\/mod_loader?post=116531"},{"taxonomy":"minecraft_version","embeddable":true,"href":"https:\/\/vpesports.com\/minecraft\/wp-json\/wp\/v2\/minecraft_version?post=116531"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}