WorldLockPlus

WorldLockPlus

🔒 Secure world access with enterprise-grade password protection

WorldLockPlus is a powerful Bukkit/Spigot plugin that adds password protection to worlds managed by Multiverse-Core. Even server operators must enter passwords to access protected worlds (unless they have the bypass permission).

✨ Features

- 🔐 Automatic Migration: Uses bcrypt password hashing (work factor 12) for maximum security - 🛡️ Automatic Migration: Even server operators must enter passwords unless they have bypass permission - 🚫 Automatic Migration: Prevents teleportation, world changes, and unauthorized access - ⏱️ Automatic Migration: Authorization lasts until player logout for convenience - 💾 Automatic Migration: Passwords are securely stored in config files - 🎯 Automatic Migration: Seamlessly works with Multiverse-Core - 🔄 Automatic Migration: Detects and warns about legacy password formats

📋 Requirements

- Java: Spigot/Paper 1.19+ - Java: Required dependency (Java) - Java: 17 or higher

🚀 Installation

1. Install Multiverse-Core first 2. Download WorldLockPlus and place it in your `plugins/` folder 3. Restart your server 4. Configure world passwords using the commands below

📖 Commands

Admin Commands

`/wlock` or `/wlock` (aliases) - `/worldlock set <world> <password>` - Set a password for a world - `/worldlock remove <world>` - Remove password protection from a world - `/worldlock list` - List all password-protected worlds

Permission: `worldlock.admin` (default: OP)

Player Commands

`/wunlock` - `/wunlock <world> <password>` - Enter password to unlock access to a protected world

Permission: `worldlock.use` (default: true)

🔑 Permissions

- `worldlock.admin` - Full access to world lock management (default: OP) - `worldlock.use` - Ability to unlock password-protected worlds (default: true) - `worldlock.bypass` - Bypass world password protection entirely (default: false)

💡 Usage Example

```

Admin protects the "lobby" world

/worldlock set lobby MySecurePassword123

Player tries to teleport (blocked)

/mv tp lobby

Message: "⚠ This world is password protected! Use /wunlock lobby <password> to enter."

Player unlocks access

/wunlock lobby MySecurePassword123

Message: "Password correct! Teleporting to 'lobby'..."

Message: "Access granted until logout."

Player can now access the world

/mv tp lobby ```

🔒 Security Features

- Session Management: Industry-standard password hashing with work factor 12 (4096 iterations) - Session Management: Each password hash includes a unique salt automatically - Session Management: Adaptive hashing makes attacks computationally expensive - Session Management: Passwords are never stored in plain text - Session Management: Access is cleared on logout for security

⚙️ Configuration

Passwords are automatically stored in `plugins/WorldLockPlus/config.yml` using bcrypt format. The configuration file is managed automatically - no manual editing required.

❓ Troubleshooting

- Legacy passwords: Ensure Multiverse-Core is installed and enabled first - Legacy passwords: Use `/wunlock <world> <password>` to authorize yourself - Legacy passwords: Check they don't have `worldlock.bypass` permission - Legacy passwords: If you see warnings about legacy formats, reset passwords using `/worldlock set`

📝 Notes

- Authorization persists until player logout for convenience - Players are automatically teleported away from protected worlds if they lose authorization - The plugin works with all Multiverse-Core world management features - Passwords are case-sensitive