Server rules, moderation and staff that actually work

A rule is only a rule if you can prove it was broken and you are willing to act when it is. Most server rule sets fail both tests: fourteen bullet points written in a hurry, half of them unenforceable opinions, applied inconsistently by five people who were given operator status because they were online a lot. The result is not a lenient server, it is an arbitrary one, and arbitrary is what drives regulars away.

The working version is smaller than you expect. Six to eight rules that describe behaviour rather than attitude, logging that can answer "who did this and when" before anybody is punished, two or three staff with the narrowest powers that do the job, a ban ladder that mostly uses temporary bans, and an appeals route that exists so that your mistakes are recoverable. This post is each of those, with the commands and files that go with them.

Rules that work are short, specific and enforceable#

Three tests. Can a new player understand it in one reading? Can you prove a breach from logs or a screenshot? Are you actually prepared to act every time, including when it is a regular? Any rule that fails one of those is decoration, and decoration teaches players that the rest are optional too.

"Don't be toxic" fails all three. What counts as toxic differs per person, it cannot be proven from a log without a judgement call, and in practice it gets enforced against strangers and not against friends. "No slurs, no targeted harassment, no threats" passes: it is specific, it shows up verbatim in the chat log, and nobody argues about what it means.

The failure modes are predictable:

• Vague states of mind. "Respect everyone", "no drama", "keep it friendly". Replace with the behaviour you would actually act on.
• Rules for things that never happen. Every line dilutes the ones that matter. Delete anything you have never enforced.
• Rules with no stated consequence. If a rule does not say roughly what happens, every enforcement looks invented on the spot.
• Rules you will not apply to yourself. Staff exemptions destroy trust faster than anything else on this list.
• A length nobody reads. Eight lines is a rule set. Forty lines is a document, and documents get scrolled past.

Write the consequence next to the rule, in ranges rather than absolutes, so you keep room to judge: "first offence a warning, repeat offences a temporary ban". Then add one line at the end that covers everything you did not think of - staff may act on behaviour that is clearly against the spirit of the server - and use it rarely enough that it stays credible.

A rule set you can adapt#

1.  Be civil. No slurs, targeted harassment, threats or sexual content.    Warning, then a 7-day ban, then permanent.2.  No griefing. Do not break, take from or build on anything that is not    yours without permission. Rolled back, plus a ban on the second time.3.  No stealing. Chests, animals and item frames belong to whoever built    the base they are in.4.  No cheats or exploits. X-ray, fly, duplication, automation clients.    Permanent on the first offence.5.  No advertising other servers, and no DM advertising to our players.    Permanent.6.  One account per person. Alt accounts used to evade a ban extend it.7.  Keep builds off other people's doorsteps. Leave 100 blocks between    bases unless both sides agree.8.  English in global chat so staff can moderate it. Any language in    party, team and DMs.Staff may act on anything clearly against the spirit of these rules.Appeals: post in #appeals within 14 days. A different admin decides.

Adapt the specifics to your game. A PvP wipe server needs nothing about griefing and a lot about teaming and exploits; a roleplay server needs rules about character behaviour that a survival server would find absurd; a modded co-op server for eight friends needs about three lines. The structure survives: behaviour, consequence, appeal route.

The eighth rule is the one people argue about, so be deliberate. Requiring one language in global chat is a moderation decision, not a cultural one, and it only holds if you genuinely cannot moderate the alternative. If you have a moderator who speaks the language, allow it.

Where the rules have to live#

Nobody reads a website before joining a game. Put the rules where the player already is:

1. The MOTD or the join message. Not all of them - a single line pointing at the rest. In Minecraft that is also where your icon and the first impression live: MOTD, icon and resource packs.
2. At spawn. Signs, a book given on first join, a room they have to walk through. A rule wall at spawn is the highest-traffic notice board you will ever have.
3. A `/rules` command. Every permissions plugin can attach a text file to one, and it means staff can say "read /rules point 3" instead of typing it out.
4. The Discord's first channel. The same text, unchanged. Different wording in two places is a defence every time somebody breaks one.
5. The listing entry. One line. It filters out people who were never going to fit.

Version them. When a rule changes, announce the change, date it, and say when it takes effect. Enforcing a rule that appeared quietly last Tuesday is the fastest way to make a fair decision look unfair.

Evidence first: the logs that make a ban stick#

Never act on a report alone, and never act on your memory of a report. Before any punishment, you want to be able to answer three questions: who, when, and what exactly. If you cannot, the punishment is a guess, and a guess that lands on a regular will cost you more than the original offence did.

The tools depend on the game, but the categories are the same everywhere:

In Minecraft, CoreProtect is the one plugin almost every server should have before it opens. /co inspect toggles an inspector so clicking a block tells you who placed or broke it and when. /co lookup u:PlayerName t:3d r:20 a:block-break searches a radius for a specific action, and /co rollback u:PlayerName t:2h r:15 undoes it. Rolling back is usually the better first response to griefing than banning: the victim gets their base back, and you can decide about the ban afterwards with a clear head. Grief protection and anti-cheat goes through the choices.

Everything else starts with the console and the log file. The console is the unfiltered output of the game process, so the join line, the command someone ran and the error they caused are all in it: reading the console. Logs rotate and get deleted, though, so decide now what you keep and for how long - logs worth keeping is about exactly that, and an incident you investigate three weeks later is an incident whose evidence has been rotated away.

Keep the evidence somewhere that is not a moderator's personal Discord history. A shared folder or a private channel with one message per incident - who, when, what, the log excerpt or screenshot, who decided, what was done - takes ten seconds at the time and settles every argument later.

Staff: how few you need, and what each one gets#

The usual mistake is recruiting staff for the wrong reason. More moderators does not mean better moderation; it means more people with the power to make a decision you will have to defend. A server with fifteen people online in the evening needs one or two trusted people online at that time, not eight titles.

Some working rules:

• Recruit from regulars, never from applications by strangers. Somebody who has been around a month and has helped new players without being asked is the candidate. An application form full of "I have moderated 12 servers" is a warning.
• One trusted person per shift, not per timezone you wish you covered. Empty coverage is better than unreliable coverage.
• Trial period, stated up front. Two to four weeks, reduced powers, an explicit review. It makes stepping back down a normal thing rather than a demotion.
• Write down what each rank may do. Especially the things they may not: reset land claims, edit configs, hand out items, change ranks.
• Nobody moderates a dispute they are part of. Including you.

A three-rank structure covers almost every server:

In Minecraft, grant those with a permissions plugin rather than with operator status. An operator at level 4 has every command in the game including /stop and /op, and there is no way to take one command back; a permissions group is a list you can edit. /lp creategroup moderator then /lp group moderator permission set essentials.kick true builds the rank a node at a time, and inheritance means the admin group can pick up everything the moderator group has: the LuckPerms guide has the structure worth copying.

In Source games it is addons/sourcemod/configs/admins_simple.ini, where each line is an identity and a set of single-letter flags, with z meaning root. Give z to nobody except yourself. Immunity levels matter too: without them, a moderator can kick an admin.

In Discord, never hand out Administrator. The permissions that actually do moderation work are Manage Messages, Moderate Members - which is the timeout, up to 28 days, and far more useful than a kick - and Kick Members. Turn on AutoMod for the obvious keyword and spam cases so a human is not the first line of defence, and remember the audit log holds 90 days, so anything you might need later should be copied somewhere else.

Panel access is not in-game access#

This is the separation people get wrong, usually by sharing one login. In-game moderation powers and control of the server itself are different jobs with different blast radiuses. A moderator who abuses a mute causes an argument; someone with the panel account can delete the world, and on essentially every host deleting a server deletes its backups with it.

So: nobody uses your account. Everybody who needs panel access gets their own, with only the permissions their job needs. A moderator who wants to restart a stuck server needs console and power controls and nothing else - not files, not backups, not billing, not the delete button. Whoever installs plugins needs files and SFTP on that one server.

On RE:NODE that is roles, teams and grants: a role holds a set of permissions, a team holds people, and a grant joins a team to a server, so adding a new moderator is one action rather than a dozen checkboxes. Access can be time-boxed, which is the right tool for "this person is helping with the modpack this weekend", and every server keeps its own activity log of who did what. SFTP credentials are per server rather than per account, so file access to the test server is not file access to the live one. Subusers and least privilege has the practical version, and the people and permissions guide has the clicks.

Two more things, both boring and both load-bearing. Turn on two-factor for every account that can delete something - two-factor on your panel account - and store the recovery codes somewhere that is not the same phone, because an account with the authenticator and the codes both lost cannot be recovered by anybody. And treat RCON as a root password, because it is one: a single shared RCON password known to five ex-staff is an open door. Rotate it whenever someone leaves, and never expose the port to the internet without needing to (RCON safely).

The ladder: warn, mute, kick, tempban, ban#

Consistency matters more than severity. Players accept a strict server; they do not accept an unpredictable one.

A kick is not a punishment and treating it as one teaches players that consequences are theatre. Temporary bans are the workhorse: they interrupt the behaviour, they make the point, and they do not force you to choose between doing nothing and removing someone forever.

Four habits keep the ladder honest. State the duration and the reason at the moment you act, in a form the player sees. Record every step, including warnings, because the third warning only means something if the first two are written down. Never act while angry - almost nothing needs to be decided in the next ten minutes, and a temporary ban plus a look at the logs tomorrow is always available. And apply the same steps to staff and to your friends, visibly, or the rest of this is theatre.

Appeals, records and handover#

An appeals process is not leniency. It is the mechanism by which your mistakes get corrected before they cost you a regular, and it is also what stops arguments happening in public channels.

Make it narrow and boring. One place to appeal - a form, a channel, an email - one deadline, and a decision by someone who was not involved. Ask for three things: what happened, why they think the decision was wrong, and what they will do differently. Answer within a stated window, even if the answer is no. Publish the policy, never the details of an individual case; a public trial is worse for everybody than a private decision.

Keep a ban log with one row per action: player, date, rule, evidence link, who decided, duration, expiry. It takes seconds and it answers the three questions that otherwise consume an evening - has this person been warned before, who banned them, and when does it end. It also makes handover possible.

Handover is the part that always gets skipped. When a staff member leaves, whether on good terms or not, do all of it the same day: remove their in-game rank, remove their Discord role, revoke their panel access, rotate the RCON password and any shared credential they knew. This is not an accusation, it is hygiene, and doing it routinely for everyone means doing it is not an insult when it matters. Write down where the configs live, which plugins are load-bearing, and which schedules exist, so the server survives any one person losing interest - including you.

FAQ#

How many rules should a server have?

Six to eight for a public server, three or four for a private one. Each should describe a behaviour you could prove and would actually act on. If you have never enforced a rule, delete it; if you enforce something that is not written down, write it down.

Should I ban by IP?

Rarely. Addresses are shared and reassigned constantly, so an IP ban tends to catch bystanders and miss the target after a router reboot. Ban the account, and reach for a time-limited IP ban only against active ban evasion.

How many moderators do I need?

Fewer than you think. One or two trusted people covering the hours you are actually busy beats eight ranks covering nothing. Promote from regulars after a month, with a stated trial period.

What do I do about a griefed base?

Roll it back first with a plugin like CoreProtect, then decide on the punishment with the log in front of you. Restoring the build matters more to the victim than the ban does, and rollbacks are much easier within hours than within weeks.

Should staff have access to the hosting panel?

Only the parts they need. A moderator needs the console and power controls at most; files, backups and billing belong to whoever actually runs the server. Give each person their own account rather than sharing one, and enable two-factor on anything that can delete a server.

How do I handle an appeal from someone who was obviously cheating?

Answer it anyway, briefly, and keep the ban. A short, polite, final reply closes the matter in a way that silence does not, and it demonstrates to everyone watching that the process is real rather than decorative.