Minecraft Server Permissions: How to Grant, Configure, and Revoke Player Access

Permissions are a set of rules that tell the server which commands and actions are available to a specific player or group. Without this system, the only options are too blunt: a regular player can do almost nothing, while an operator has full control over everything.
In practice, that quickly becomes unworkable. A moderator needs ban and warning commands, but not the ability to stop the server. A donor can have /fly, but not /give. A builder needs WorldEdit tools on their own plot, not across the entire map. A permission system lets each role have exactly the capabilities it actually needs.
Permissions are recorded as text nodes — for example, essentials.home or worldedit.region.set. When a player enters a command, the server or plugin checks whether they hold the required permission. If it's granted, the command runs. If not, the player receives an access denied message.

Minecraft provides two ways to manage permissions. The first is to grant a player operator status (OP). The second is to configure a flexible system through a dedicated permissions plugin.
OP vs a permissions plugin (LuckPerms and others)

For most servers with several roles, a permissions plugin is the better choice. OP stays a convenient option for the owner or administrator who manages the server through the console and is personally responsible for all settings.

Granting OP is the simplest approach — one command in the server console or from another operator in-game.

To grant operator rights, type in the console:

op PlayerName

To revoke operator rights:

deop PlayerName

The current list of operators is stored in ops.json in the server folder. You can also add or remove players there manually if console access isn't available. After editing the file, restart the server or run /reload.
The OP level can be restricted in server.properties using the op-permission-level parameter (values 1 to 4). Level 4 gives full access; level 1 limits permissions to bypassing spawn protection.

Operator status opens access to every command without exception: /stop, /ban, /give, and all functions of installed plugins. If several people hold OP, the risk to the server increases significantly. A player could accidentally stop the server, delete data, hand out items, or break the economy.
A permissions plugin lets you distribute access by role:

• Player — basic commands: /spawn, /home, /msg
• VIP — extra features: /fly, /kit vip, colored name
• Moderator — player management: /mute, /kick, /tempban
• Admin — server management without critical stop commands
• Owner — full unrestricted access

This structure reduces the risk of mistakes and abuse. Even if a moderator's account is compromised, an attacker won't reach the most dangerous commands.

On Bukkit, Spigot, and Paper servers, LuckPerms is the most widely used permissions plugin. It supports groups, inheritance, temporary permissions, and a web editor. This makes it a good fit both for a first server and for more complex projects with multiple roles.

Groups in LuckPerms mean you don't have to assign permissions to each player individually. An administrator sets the permissions for a role, and players receive them through their assigned group. When one group inherits another, it takes its base capabilities and adds its own on top.
Create groups:

/lp creategroup vip
/lp creategroup moderator
/lp creategroup admin

Set up inheritance — for example, so moderator inherits VIP permissions:

/lp group moderator parent set vip

Add a permission to a group:

/lp group vip permission set essentials.fly true
/lp group moderator permission set essentials.kick true

Remove a permission from a group:

/lp group vip permission set essentials.fly false

How to Grant Command Permissions to a Player via LuckPermsTo give a player access to commands, you can assign them a group or add an individual permission directly. Working through groups is usually more convenient; direct permissions work best for exceptions.
Assign a player to a group:

/lp user SteveBuilder parent set vip

Grant a specific permission directly without a group:
/lp user SteveBuilder permission set worldedit.region.set true

Grant a temporary permission for 24 hours:
/lp user SteveBuilder permission settemp essentials.fly true 1d

Check which permissions a player has:
/lp user SteveBuilder permission check essentials.fly

Quick reference — the most common LuckPerms commands:

To remove access, you can remove a group, delete a specific permission, or set an explicit denial.
Remove a group from a player:
/lp user SteveBuilder parent remove vip

Revoke a specific permission:
/lp user SteveBuilder permission unset essentials.fly

Explicitly deny a permission so the player can't use the command even through a group:
/lp user SteveBuilder permission set essentials.fly false

The distinction between "unset" and "set false" matters. "unset" removes the record — the player can regain that permission through a group. "set false" is stricter: it creates a hard denial that overrides group inheritance.

In Essentials, almost every command has its own permission node. Through permissions you can control access to /home, /spawn, /warp, /fly, /kit, and other features. This is useful when different roles need different capabilities.

The full list of Essentials permissions is in the plugin's official documentation.

Essentials stores its settings in plugins/Essentials/config.yml, but permissions themselves are normally assigned elsewhere — through LuckPerms or another permissions manager. The permissions.yml file in the server root is not directly related to Essentials configuration.

To grant the VIP group flight access via LuckPerms:

/lp group vip permission set essentials.fly true
/lp group vip permission set essentials.home true
/lp group vip permission set essentials.kit true

If an administrator needs full Essentials access, you can assign a wildcard node:
/lp group admin permission set essentials.* true

The * wildcard enables all permissions within the selected namespace. Use it cautiously for player-facing groups: alongside useful commands, it may also open /give, /ban, and other dangerous actions.

In WorldEdit, most commands are only available to operators by default. To let builders or moderators edit the map without full OP, assign specific permission nodes through LuckPerms. This opens the tools they need without giving full server control.

WorldEdit permissions and commands

Grant a builder group basic WorldEdit access:

/lp group builder permission set worldedit.wand true
/lp group builder permission set worldedit.selection.pos true
/lp group builder permission set worldedit.region.set true
/lp group builder permission set worldedit.clipboard.copy true
/lp group builder permission set worldedit.clipboard.paste true

The permissions.yml file in the server root is Bukkit's built-in tool for basic permission configuration without a separate manager. It can work for a small server, but it falls short of LuckPerms in convenience: no flexible hierarchy, no temporary permissions, and no web editor.

Example file structure:

groups:
default:
default: true
permissions:
- essentials.home
- essentials.spawn
- essentials.msg
vip:
permissions:
- essentials.fly
- essentials.kit
- essentials.home
- essentials.spawn

For a small server, permissions.yml works as a quick option. But if you need to properly separate players, moderators, builders, and administrators into different roles, LuckPerms is the more practical choice.

After editing the file, run in the console:
/reload confirm

Most mistakes in Minecraft permission configuration repeat themselves — they're usually caused by incorrect nodes, inheritance issues, or manual file editing errors.

A command doesn't work even though the permission was added. First check the exact node spelling. Case matters: Essentials.fly and essentials.fly are different strings. Use /lp user <player> permission check <node> to verify whether the permission exists and where it's coming from.

The player still sees an access denied message. The plugin you need may not be connected to LuckPerms, or you may be using an incompatible version. Check the compatibility between the plugin, LuckPerms, and the server version.

Group permissions aren't working. Make sure the player is assigned to the right group and that inheritance is configured correctly. The default group is usually the lowest level; other roles either get their own permissions or inherit from default.

The wildcard * opens too much. essentials.* can enable not just convenient commands but dangerous ones too. For regular player roles, it's safer to list specific permissions explicitly.

Changes aren't taking effect. In the LuckPerms web editor, click Save and apply changes. If files were edited manually, restart the server or run /lp reload.

Can you grant all permissions in LuckPerms with one command? Yes — use the wildcard *: /lp user <player> permission set * true. But never do this for regular players: they'll get access to every command on the server and in all plugins. This approach is only appropriate for the server owner.

How do you open commands in Minecraft without installing plugins? Without additional plugins, two options are available: OP with full access, or permissions.yml with limited basic configuration. For precise permission distribution, LuckPerms is the better tool.

What if you don't know the right permission node? The correct node is usually listed in the specific plugin's documentation. For Essentials, that's the EssentialsX docs; for WorldEdit, it's the EngineHub documentation. You can also enable LuckPerms verbose mode with /lp verbose on — it will show which permission is being checked during any player action.

Why do permissions disappear after a server restart? The most likely cause is the LuckPerms storage method. Check storage-method in the plugin's config.yml: it should be set to h2, sqlite, or mysql. If it's set to memory, data won't be saved across restarts.

How do you grant permissions in Minecraft without console access? If a player already has OP, LuckPerms commands can be run from the in-game chat. If no OP is available, the server owner needs to grant access through the hosting control panel's console, or assign the required group directly.

Permissions setup is one of the first things anyone building a Minecraft server for more than a few friends runs into. On the Minecraft course at Rocket Tech School, children learn not just to build in the game, but to understand how a server works from the inside: commands, plugin logic, configuration structure. That's the first step into real programming — and it happens right inside the game they already love.