Updated:

1. Java 1.21.9 and newer: game rule

/gamerule pvp false

Players can no longer damage other players anywhere in the world. Set it to true to turn PvP back on. The name stayed pvp when 1.21.11 renamed other rules.

2. Java 1.21.8 and older servers: server.properties

pvp=false

Edit server.properties and restart. 1.21.9 removed this property in favor of the game rule. See server.properties.

3. Any version: a team with friendly fire off

/team add peace "Peace"
/team modify peace friendlyFire false
/team join peace @a

Keep new players on the team with a repeating block:

/team join peace @a[team=]

See team command.

4. PvP only in an arena (repeating)

/team leave @a[x=100,y=60,z=200,dx=30,dy=20,dz=30]
/execute as @a[team=] unless entity @s[x=100,y=60,z=200,dx=30,dy=20,dz=30] run team join peace @s

Players inside the box leave the team and can fight; outside they rejoin. Fence the arena, since a player with no team can still hit a team member. See area detection.

5. Bedrock Edition

/gamerule pvp false

Bedrock has had this rule for a long time. Turning off Friendly Fire in the world settings does the same.

Troubleshooting

Check your command

The Command Error Doctor checks common syntax mistakes in your browser.