Setting up a whitelist for a private server

A whitelist flips your server from 'anyone with the address can join' to 'only people I've approved can join'. For a friends-and-family SMP it's the single most important security setting — server addresses leak, and bots scan the whole internet for open Minecraft servers.

The commands

From the console (or in-game with a slash, as an OP):

whitelist on
whitelist add PlayerName
whitelist remove PlayerName
whitelist list

The setting everyone forgets

Turning the whitelist on does not kick players who are already online. If someone unwanted is already connected, set enforce-whitelist=true in server.properties (or run /whitelist reload after enabling it) so non-whitelisted players are removed immediately.

white-list=true
enforce-whitelist=true

Names must match exactly

The whitelist works on Minecraft account names (resolved to account UUIDs). Capitalization doesn't matter, but spelling does — if a friend can't join with 'You are not white-listed on this server', the name on the list is almost always typo'd or out of date after a name change. Remove and re-add them to refresh it.