What it is
Under Attack Mode is a state, not a feature you invoke. The system watches indicators — combined ping and login rate, per-source concentration, failure ratios — and when they cross a threshold it escalates: rate limits tighten, new joins are routed through verification, and status pings are answered from cache rather than forwarded. When the indicators fall, it relaxes again.
Why it matters for Minecraft
Because the correct strictness is different on a quiet Tuesday and during a flood, and no single static setting is right for both. Tuned for calm, you are defenceless under attack; tuned for attack, you inconvenience real players permanently. Automatic escalation resolves that by making strictness a function of what is actually happening.
What to look for
Whether activation is driven by joins or by total request rate, whether it engages per network or globally, and whether you are told when it fires. Escalation you cannot observe is hard to trust — an alert with the peak rate and duration is what turns it from a black box into something you can reason about.
Common questions
Does Under Attack Mode inconvenience real players?+
Briefly and only while it is active. Most legitimate joins still pass without seeing anything; the ones that get held are those the risk engine flags. The trade is deliberate — a few seconds of verification during an attack against the server being unreachable.
Can I turn Under Attack Mode on manually?+
On most systems yes, and it is occasionally useful if you know an attack is coming. The point of the automatic version is that attacks rarely announce themselves.