EULA
The first start of a Java server stops with You need to agree to the EULA. The panel shows an accept button; it writes eula=true into eula.txt. By accepting you agree to Mojang's terms, so read them once. The important part is that you may not sell gameplay advantages beyond what Mojang allows.
Whitelist
The best griefing protection there is: only people you added can join.
whitelist on
whitelist add PlayerName
whitelist remove PlayerName
whitelist list
Type these in the panel console (without /). Turning the whitelist on kicks nobody who is already online. Bedrock players via Geyser are added with their Floodgate name (prefix ., e.g. .Steve).
OP
op PlayerName gives full operator rights: every command, creative, kicking, banning. deop takes them back. OP levels 1-4 exist (op-permission-level in server.properties), but on a real server you want a permissions plugin instead:
- LuckPerms (free, the standard): groups like
default,mod,admin, each with exactly the commands you allow. Install it through the Plugins tab; the in-game editor/lp editoropens in a browser.
Rule of thumb: OP only for yourself and one backup admin. Everyone else gets a LuckPerms group.
Bans
ban PlayerName reason, ban-ip, pardon PlayerName. Bans are stored in banned-players.json. Whitelist plus a small trusted group beats a ban list every time.