A one-time setup isn't enough. Follow these free practices:
# Limits how fast players can send packets
rate-limit=10
This setting (values 5-15) slows down connection attempts. Bots that try to flood login packets will get throttled automatically. minecraft bot attack free
network-compression-threshold=256
Forces clients (including bots) to compress packets. Many free bots don't implement compression correctly, causing their connections to fail. A one-time setup isn't enough
If you are under attack right now:
white-list=true
Then run /whitelist add [your_real_players]. Bots can't join without being on the whitelist. This is a zero-cost, instant solution for small servers. # Limits how fast players can send packets
rate-limit=10
Most bot scripts look for the default Minecraft port (25565). Change your server port in server.properties to something random like 50213. This doesn't stop dedicated attackers, but it stops 99% of drive-by bot scanners.
False. Offline-mode actually gives you more free options because you can use captcha plugins without worrying about Mojang session conflicts.