\n
\n
\n
# Better-WebConsole<\/p>\n
Secure browser console and admin dashboard for Paper\/Purpur\/Spigot 1.21.x servers.<\/p>\n
\n
\n
\n
\n \n<\/p>\n
## Features<\/p>\n
### Web Console<\/p>\n
– Embedded Jetty web server with one built-in web UI.
\n– Live console log streaming over WebSocket with buffered history for new sessions.
\n– Console command execution through the server command map, including commands from plugins such as CMI.
\n– Command history, filtering, log export and clear action in the browser.
\n– Configurable web aliases through `!alias`, including chained aliases with `&&`.
\n– Audit log for auth events, command execution, player actions and log exports.<\/p>\n
### Dashboard<\/p>\n
– Desktop-focused two-column dashboard layout for server administration.
\n– Server health: TPS, JVM heap, online players, worlds, loaded chunks, entities and session errors.
\n– Machine health: host CPU load, Java process CPU load, physical RAM, server disk usage and JVM thread counts.
\n– Performance history charts for TPS, JVM RAM, online players and host CPU.
\n– Machine details: CPU model, cores\/threads, memory, disk mount, OS, Java runtime, PID and JVM uptime.
\n– Analytics blocks for log levels, per-world chunks\/entities and recent activity.
\n– Player list with quick kick\/ban actions.<\/p>\n
### Security<\/p>\n
– Web users stored in `plugins\/Better-WebConsole\/users.dat` with BCrypt hashes.
\n– HttpOnly + SameSite session cookies, optional Secure cookies for HTTPS reverse proxies.
\n– CSRF protection for login.
\n– IP whitelist with CIDR support.
\n– Login lockout and command rate limit.
\n– Optional command block list for dangerous console commands.<\/p>\n
## First Setup<\/p>\n
1. Put the JAR into the server `plugins\/` folder.
\n2. Start the server once to generate `plugins\/Better-WebConsole\/config.yml`.
\n3. Create a web user:<\/p>\n
“`text
\n\/bwc adduser admin YourStrongPassword123
\n“`<\/p>\n
4. Open:<\/p>\n
“`text
\nhttp:\/\/your-server-ip:4242
\n“`<\/p>\n
Production recommendation: bind to `127.0.0.1` and expose the panel through Nginx, Caddy, a VPN or a tunnel with HTTPS.<\/p>\n
## Commands<\/p>\n
Main command aliases: `\/betterwebconsole`, `\/bwc`, `\/webconsole`, `\/bwconsole`, `\/betterconsole`.<\/p>\n
Permission: `betterwebconsole.admin` (default: op).<\/p>\n
| Command | Description | Extra command aliases: `useradd`, `createuser`, `deluser`, `deleteuser`, `users`, `passwd`, `password`, `killsessions`.<\/p>\n ## Configuration<\/p>\n The default config is intentionally small and only contains implemented behavior.<\/p>\n “`yaml security: logging: system-stats: # OS-level polling interval. Keep this above 2 seconds for production servers. # Reports disk usage for the Minecraft server folder. commands: `system-stats` can be disabled if the host does not allow OS-level metrics or if you only need Minecraft\/JVM data.<\/p>\n Use `commands.blocked` to prevent risky commands from web access, for example:<\/p>\n “`yaml Use an alias by typing `!name` in the web console. Aliases can chain up to 10 commands with `&&`.<\/p>\n `\/bwc reload` updates aliases, logging, system stats settings and command block rules. Restart the Minecraft server after changing `web.port`, `web.bind-address`, `security.ip-whitelist`, session timeout or rate-limit settings.<\/p>\n ## Security Notes<\/p>\n – Do not expose `0.0.0.0:4242` directly to the internet unless firewall\/IP whitelist\/VPN rules are in place. Secure real-time web console for Minecraft servers<\/p>\n","protected":false},"featured_media":29710,"template":"","meta":{"_minecraft_slug":"better-webconsole","_minecraft_project_id":"khtebxzn","_minecraft_author":"AREKKUZZERA","_minecraft_license":"MIT","_minecraft_downloads":50,"_minecraft_follows":2,"_minecraft_client_side":"unsupported","_minecraft_server_side":"required","_minecraft_storage_type":"zip","_minecraft_archive_name":"better-webconsole.zip","_minecraft_size_bytes":29502877,"_minecraft_version_count":5,"_minecraft_updated_at":"2026-05-15T21:33:09.201540Z","_minecraft_date_created":"2026-04-15T01:54:34.605269Z","_minecraft_date_modified":"2026-05-15T23:49:33.220820Z","_minecraft_project_url":"https:\/\/modrinth.com\/mod\/better-webconsole","_minecraft_icon_attachment_id":29710,"_minecraft_imported_at":"2026-06-01T12:20:30+00:00","_minecraft_import_hash":"9193aa10fb4364222f5177777377f589","_minecraft_versions":"","_minecraft_links":"","_minecraft_gallery":"","_minecraft_api_metadata":""},"mod_category":[124,126,90,127,128,129,123,92],"mod_loader":[130,132,133,134],"minecraft_version":[62,37,40,41,73,74,38,78,79,80,81,82,83,167,163],"class_list":["post-29709","mod","type-mod","status-publish","has-post-thumbnail","hentry","mod_category-bukkit","mod_category-management","mod_category-optimization","mod_category-paper","mod_category-purpur","mod_category-spigot","mod_category-technology","mod_category-utility","mod_loader-bukkit","mod_loader-paper","mod_loader-purpur","mod_loader-spigot","minecraft_version-1-21","minecraft_version-1-21-1","minecraft_version-1-21-10","minecraft_version-1-21-11","minecraft_version-1-21-2","minecraft_version-1-21-3","minecraft_version-1-21-4","minecraft_version-1-21-5","minecraft_version-1-21-6","minecraft_version-1-21-7","minecraft_version-1-21-8","minecraft_version-1-21-9","minecraft_version-26-1","minecraft_version-26-1-1","minecraft_version-26-1-2"],"yoast_head":"\n
\n| — | — |
\n| `\/bwc status` | Show web server, user, session and config status |
\n| `\/bwc reload` | Reload config values that do not require web server restart |
\n| `\/bwc adduser
\n| `\/bwc removeuser
\n| `\/bwc listusers` | List web users |
\n| `\/bwc setpassword
\n| `\/bwc logoutall
\nweb:
\n port: 4242
\n bind-address: “0.0.0.0”
\n log-buffer-size: 1000<\/p>\n
\n session-timeout-minutes: 60
\n max-login-attempts: 5
\n lockout-duration-minutes: 15
\n command-rate-limit-per-minute: 30
\n ip-whitelist: []
\n secure-cookies: false<\/p>\n
\n log-commands: true
\n log-auth: true
\n audit-log: true<\/p>\n
\n # Adds host CPU, machine RAM, disk, OS and JVM details to the dashboard.
\n enabled: true<\/p>\n
\n update-interval-seconds: 5<\/p>\n
\n show-disk: true<\/p>\n
\n blocked: []
\n aliases:
\n tps: “tps”
\n list: “list”
\n save: “save-all”
\n day: “time set day”
\n night: “time set night”
\n clear-weather: “weather clear”
\n“`<\/p>\n
\ncommands:
\n blocked: [“stop”, “restart”, “op”, “deop”]
\n“`<\/p>\n
\n– Set `secure-cookies: true` only when users access the panel through HTTPS.
\n– Block or avoid destructive commands such as `stop`, `restart`, `op`, `deop`, `ban-ip` and `whitelist`.
\n– Keep aliases short and auditable.
\n– Keep `commands.blocked` empty only when every web user is trusted as a full console administrator.
\n– Treat machine metrics as operational data: expose the panel only to trusted administrators.<\/p>\n","protected":false},"excerpt":{"rendered":"