PortalMine owner documentation. Test important changes on a copy and keep a verified backup.
Important: a random port reduces accidental discovery, but it is not authentication and does not protect a public game server by itself.
1. Understand what changing the port can and cannot do
Players can try other open ports on the same public address. If another Minecraft server is listening and allows them to join, they may reach that game server. This does not grant dashboard, console, or file access unless the management application has a separate authorization flaw. Every owner action must be checked against the logged-in account and the server’s internal identifier.
2. Separate game access from owner access
| Surface | Protection | Never rely on |
|---|---|---|
| Game server | Account authentication, allow-list, moderation, rate limits | A hidden or unusual port |
| Dashboard | Session authentication and server ownership checks | Browser-selected server ID |
| Backend server | Firewall or private network accessible only through a proxy | Players not knowing the backend port |
3. Java server options
For an independent public Java server, keep account authentication enabled unless you understand and accept the impersonation risk. For a proxy network, expose only the proxy and firewall the backend servers so players cannot bypass forwarding and identity checks.
4. Bedrock server options
Bedrock uses UDP. Keep the assigned UDP port open for the intended server, use account authentication for public servers, and use an allow-list for private groups. A domain name improves usability but does not hide the destination IP or neighboring ports.
5. PortalMine security checklist
- Select only unassigned ports when creating a server.
- Keep every server’s management authorization based on account ID plus server UUID.
- Do not expose internal service credentials or management endpoints to players.
- Use a whitelist or allow-list for private worlds.
- Use a proxy and firewall for multi-server Java networks.
- Log failed owner actions and invalidate old share links when ownership changes.
- Test that changing a URL or server ID cannot access another account’s files or console.