Yeah, that freaked me out when I first set up a server. I found a guestbook plugin that stopped people modifying the world at all if they weren’t signed in. Whitelisting gives me more confidence however if they can’t even connect!