v1.3.0 — players can lock their own name, and crawlers get blocked

Two additions driven by a live server's first afternoon, and a fix for an upgrade path that v1.2.0 got wrong.

Players can lock their own name

Any player can now type /premium in chat to be told what locking their username to their Microsoft account would do, and /premium confirm to go ahead. They are disconnected with instructions, rejoin with the genuine account, and the name is theirs permanently — nobody else can use it on that server, and they are never asked for a password.

/premium            → explains what this does, and that it cannot be undone
/premium confirm    → arms it; rejoin with the real account

This was the missing middle. An admin could declare a name premium in appsettings.json, which does not scale past the handful of names an admin knows about; or auto-claim could offer the challenge to everyone, which asks every new player's client to answer an encryption request and is switched off for exactly that reason. Neither covers one player who cares about their own name on a server where the owner has not turned auto-claim on. So this works independently of that setting — whether everyone is challenged is a different question from whether one person asked to be.

Why it cannot be abused. Mojang is asked whether that username has an active session, so the only account that can ever answer for a name is the one that owns it. Somebody squatting a name with a cracked client can arm this all they like: the challenge they then have to pass is one only the real owner can pass, and a failure records nothing at all.

Server-indexing crawlers are blocked automatically

Sites that catalogue Minecraft servers sweep address ranges looking for them, and they give themselves away. A Minecraft client puts the address the player typed into its Handshake packet, so somebody given a raw IP sends that IP. A crawler has no address to send — it found you by scanning — so it sends its own domain instead: its brand, in the field meant for your server's name.

Once an address has announced three different domains that are not yours, it is banned for a month rather than the usual few hours, because an indexing service is on a schedule and will otherwise be back next week.

A raw IP in that field never escalates, and that distinction matters more than it sounds: testing your own server by IP produces exactly that pattern, so treating the two the same would ban you from your own machine. This only does anything if you have set allowed domains — with no list, nothing is a mismatch.

Fixed: upgrading from 1.1.0 left the Protection page inert

The installer never overwrites appsettings.json, which is right — it holds your servers, protected usernames and webhook. The consequence, which v1.2.0 shipped without noticing, is that a configuration written by 1.1.0 has no section for any of the defence settings, so every switch on the new Protection page failed, and the threat feed stayed enabled with nothing to fetch and said nothing about it.

The page now detects this and offers one button that copies the missing sections across from the shipped defaults — comments and all, since the explanation of what a setting does is the part that makes it usable. Nothing you set is touched. It stays something you ask for rather than something that happens at startup: silently adding settings to somebody's configuration is the same class of behaviour as silently removing their comments.

If you are on 1.2.0, this is the release you want.

Downloads

File	Use it if
MinecraftFirewall-1.3.0-setup.exe	You want it installed properly. Start here.
MinecraftFirewall-v1.3.0-win-x64.zip	You would rather unzip it somewhere and run it yourself.

Windows 10 1809 or newer, 64-bit. Nothing else needs installing — not even .NET.

Verified

This release was installed for real, elevated, and checked on the running service rather than reasoned about:

• The Windows service registers, starts, and is set to start with Windows. Its registry ImagePath is quoted — the fix for the unquoted-service-path hazard, confirmed where it actually lives rather than at the command line.
• The Windows Firewall rule is created and enabled.
• defense-status and list-threats answer over the admin pipe from the running service.
• The control panel shows live counters, the real threat list, and "Protected".
• The upgrade repair was exercised end to end: a 1.1.0 configuration was put in place, the service logged the missing-feed warning, the page showed the banner naming all six sections, the button added them with their explanations intact and the existing server untouched, and the service restarted cleanly on the result and imported 10,543 ranges.
• The Turkish rendering of the Protection page was checked on screen, not just in the dictionary.

467 automated tests pass.

Still not verified against the real thing, as ever: movement analysis has never been watched against a real Minecraft client, and anomaly detection has never seen a real server's traffic. docs/plan.md keeps the full list.