How do I protect my Minecraft server against griefers?

Griefers are players who destroy builds or disrupt the server. With a few measures you limit the damage or prevent it entirely.

1. Use a whitelist

With a whitelist, only players you have added yourself can join. Run in the console:

whitelist on to enable the whitelist
whitelist add PlayerName to add a player

For a private server with friends this is the most effective protection.

2. Be careful with operator rights

Players with op rights can do almost anything, including deleting the world with commands. Only give op rights to people you fully trust, and for moderators prefer a permissions plugin such as LuckPerms, which lets you grant rights per command.

3. Install protective plugins

CoreProtect logs all block changes and can roll back the damage done by a griefer with a single command.
WorldGuard lets you protect areas in which only designated players may build, for example your spawn.

Both plugins run on Paper and Spigot and are installed through the plugins folder.

4. Make regular backups

Use the Backups tab in the game panel to make regular backups of your server. If something does go wrong, you can restore the world within minutes.

Also, never set the online-mode option in server.properties to false without a good reason, otherwise players can join under someone else's name.

Tip: at HostValues you can rent a Minecraft server and be online within minutes.