1. Check that it is really on
Run /whitelist list or look for white-list=true in server.properties. Since Java Edition 26.3 new servers start with the whitelist on, but a server that was set up earlier keeps its old setting after updating.
2. Turn on enforce-whitelist
Without enforce-whitelist=true, removing a player from the list doesn’t affect them while they are online. With it, players who aren’t on the list are kicked when the whitelist is reloaded.
3. Reload after editing the file
The server keeps the list in memory. After replacing or editing whitelist.json, run /whitelist reload before doing anything else. If you use /whitelist add first, the server saves its in-memory list and your edits are overwritten.
4. Review the operator list too
Operators in ops.json can always join a Java Edition server, whitelisted or not. Removing someone from the whitelist doesn’t lock them out if they are still an operator. Use /deop as well.
5. Don’t worry about name changes
The server matches players by UUID. A player who renames stays whitelisted, even though the old name may still appear in the file for a while.
6. Match the server’s online mode
With online-mode=false, players have offline UUIDs calculated from their names, so a list built from account UUIDs won’t let them in. The UUID Lookup shows the offline UUID for any name, but keep in mind that an offline-mode whitelist can’t stop someone joining with a whitelisted player’s name.
7. Keep a copy
Save a copy of whitelist.json before large changes. Rebuilding a list of fifty players from memory is slow; restoring a file is instant. The Whitelist Creator can import the copy later and add new names to it.