Kordon

Kordon

Kordon is an AntiVPN and anti-bot plugin for Velocity and Waterfall (and other BungeeCord-based proxies). It checks every login before the player reaches your server and keeps out VPNs, proxies, Tor, hosting addresses and bot attacks, while real players join without delay.

The plugin connects your proxy to the Kordon service, which runs the checks. Everything is managed in a web panel, so there are no config files to edit and no API keys from third-party services to get.

A free Kordon account is required to use the plugin. Some features depend on your Kordon plan.

Features

• AntiVPN and anti-proxy at login: VPNs, proxies, Tor, hosting and residential proxies are checked in milliseconds.
• Shared database: an address caught on any server protected by Kordon is blocked on yours too.
• Bot attack protection: Kordon notices a wave of bot connections, switches to attack mode and shuts out the networks they come from.
• Protection levels: soft, balanced or strict, plus country and nickname filters, mobile carrier and network (AS) rules, and maintenance mode.
• Whitelist and blacklist of nicknames, IPs and IP ranges, managed in the panel or in-game with /kordon.
• Observe mode: see who would be blocked before turning protection on.
• Live view of your server: who is online, where they connect from, their client and version, one-click kicks from the panel.
• Custom kick messages for blocked players and staff notifications in chat.
• Fail-safe: if Kordon cannot be reached, the plugin follows your setting and either lets everyone in or nobody.

Compatibility

Requires Java 21 or newer (Velocity 4 itself requires Java 25). Install it on the proxy, not on the backend servers. Minecraft: Java Edition players are checked; Geyser/Floodgate players are supported. Standalone Paper servers without a proxy are not supported yet.

Installation

1. Create a free account and add your server in the Kordon panel.
2. Put Kordon.jar into the proxy's plugins folder and start the proxy.
3. In the proxy console, run /kordon link <key>. The key is on the server's Plugin page in the panel. The plugin saves it to plugins/Kordon/secret.key and connects right away.

The console shows Kordon connected to server "..." when everything is ready.

Commands

The full list of commands and permissions is in the README.

Data sent to Kordon

For each login: nickname, UUID, IP address, protocol version, skin (online mode), whether the player is a Bedrock player (Floodgate), the address the player connected to, and later the backend server, client brand and language. About the proxy: platform and version, plugin version, machine name, online count and response time. The plugin does not collect chat, player commands or other client data. See the Privacy Policy.

Open source

The plugin is open source under GPL-3.0: github.com/KordonLabs/mc-kordon-plugin. It is not obfuscated and includes a small developer API (KordonLoginCheckedEvent, KordonRemoteKickEvent) for other plugins.