Skip to main content


What does the plugin do?

BungeeGuard is a plugin used to protect against BungeeCord's UUID spoof exploit which allows users to join without authenticating through the BungeeCord proxy, allowing them to join as any user.



Make sure your BungeeCord is on the latest version. Also, make sure to use version 1.2 or later of BungeeGuard as previous versions have an issue.

Download the plugin then upload the jar into both your BungeeCord and Spigot plugins folder. Restart the servers. If you need help installing plugins, check out this guide.

After you have restarted the servers you installed BungeeGuard on, enter the config.yml file located in your BungeeCord's BungeeGuard directory and copy the authentication token. Paste this authentication token into the config.yml file within your Spigot servers' BungeeGuard directory.

Example configuration:

# Allowed authentication tokens.  
- "AUSXEwebkOGVnbihJM8gBS0QUutDzvIG009xoAfo1Huba9pGvhfjrA21r8dWVsa8"

Now, restart all your servers you installed BungeeGuard on and test to see if it's properly working!

BungeeGuard on Velocity

You can use BungeeGuard on Velocity if you are unable to use modern forwarding for any reason.

Follow these steps to get BungeeGuard running on Velocity:


Velocity has the BungeeGuard code built-in, so there’s no need to install the BungeeGuard plugin on the Velocity proxy.


BungeeGuard forwarding must be enabled in your spigot.yml. You cannot have modern forwarding and BungeeCord legacy forwarding enabled at the same time. To enable BungeeCord forwarding mode correctly you must:

  • have settings.bungeecord set to true in spigot.yml
  • have settings.velocity-support.enabled set to false in paper.yml, if you are running a Paper (or a fork of it like Purpur or Pufferfish) server.
  1. Download the plugin then upload the jar into your Spigot plugins folder. Restart the server. If you need help installing plugins, check out this guide.
  2. Make sure that player-info-forwarding is set to bungeeguard.
  3. Enter the forwarding-secret in velocity.toml into the config.yml in the Spigot/Paper server's BungeeGuard directory. Both of these must match exactly or you will not be able to join the server!