Minecraft server anti-cheat

Types of cheats in Minecraft

Before you pick an anti-cheat, it helps to know what you're fighting. Cheats (hacks) in Minecraft fall into a few categories:

Movement cheats

• Fly: flying without an elytra or creative mode
• Speed: moving faster than the game allows
• NoFall: taking no fall damage
• Spider: climbing walls
• Step: walking up blocks without jumping
• Jesus/WaterWalk: walking on water
• NoSlowdown: no slowdown in cobwebs or on soul sand

Combat cheats

• KillAura: automatically attacking players in range
• Reach: a longer attack range
• AutoClicker: automatic clicking at an unnaturally high rate
• Velocity/AntiKnockback: reduced or zero knockback
• Criticals: every hit is a critical hit
• AimBot: automatically aiming at the head or body

Other cheats

• X-Ray: seeing ores and blocks through walls
• Nuker: instantly mining many blocks
• Scaffold: automatically placing blocks under your feet
• ChestStealer: emptying chests instantly
• FreeCam: a free camera detached from the character

No anti-cheat catches 100% of cheats. X-Ray is especially hard to detect on the server side. The best fix is Paper Anti-XRAY (built into Paper), which swaps ores you can't see for stone on the server side.

How does anti-cheat work?

An anti-cheat analyzes the network packets the client sends and compares them with the behavior it expects. If a player moves faster than the game allows, hits from a longer range or takes no fall damage, the anti-cheat counts violations.

Every violation raises the player's VL (Violation Level) counter. Once the VL crosses a threshold, the anti-cheat takes action:

The admin configures the VL thresholds and actions. Thresholds that are too aggressive cause false positives (wrongly flagged players), and thresholds that are too lenient let cheaters through.

Anti-cheat comparison

Recommendation: Vulcan is the best paid anti-cheat, and Grim is the best free one. If the budget allows, go with Vulcan. If not, go with Grim. Some servers run both at once. That's not recommended because of potential conflicts, but it is possible.

Vulcan

Vulcan is a paid anti-cheat available on SpigotMC. Many large servers use it for its excellent detection and low false positives.

Key features

• 100+ checks: detects fly, speed, reach, killaura, velocity, scaffold, timer and many more
• Setback system: instead of kicking, it moves the player back to their previous position
• Admin alerts: chat notifications about suspicious players
• Logs: a full record of violations in a file
• LiteBans integration: automatic bans through LiteBans
• Low CPU usage: optimized for large servers

Installation: download the JAR file from SpigotMC, put it in plugins/ and restart the server. Vulcan works out of the box with the default configuration, but you should adjust the thresholds to fit your server.

Grim AntiCheat

Grim is a free, open-source anti-cheat available on GitHub. It takes an unusual approach: it predicts the player's movement on the server side and compares it with what it gets from the client.

Key features

• Prediction engine: simulates player physics on the server and compares the result with the client's data
• Latency tolerance: compensates for network lag, which cuts false positives at high ping
• Open-source: the source code is public, so you can audit and modify it
• Active community: frequent updates from the community
• Setback system: moves the player back instead of kicking

Installation:

# Download the latest build from GitHub Releases
# Put the .jar file in plugins/
# Restart the server
# Configuration is in plugins/GrimAC/config.yml

Grim requires PacketEvents (a library for intercepting network packets). Install it before Grim.

Matrix AntiCheat

Matrix is a paid anti-cheat from the middle of the price range. It offers solid detection and built-in tools for analyzing suspicious players.

Key features

• Built-in violation database: an alert history for every player
• The /matrix verbose command: shows violations in real time
• Configurable thresholds: easy to adjust the sensitivity
• Bedrock support: works with Geyser (the Java-Bedrock bridge)

Matrix is a good choice for servers that need a solid anti-cheat at an affordable price, with support for Bedrock players.

False positives

A false positive (a false alarm) is when the anti-cheat wrongly flags a legit player as a cheater. The most common causes:

• High ping: players with network lag can trigger movement checks
• Map features: slime block trampolines, elytra launchers, ender pearl stasis chambers
• Plugins: plugins that change movement (MCMMO, Jobs with speed boosts, Elytras+)
• Client version: players on older versions (through ViaVersion) may behave differently
• Trident Riptide: fast movement with a trident can trigger speed or fly checks

How to minimize false positives

1. Start with lenient thresholds: use the default configuration and watch the alerts for a week
2. Monitor alerts: use the /vulcan alerts or /grim alerts command
3. Disable problem checks: if a check produces a lot of false positives, turn it off or raise its threshold
4. Test with different client versions: make sure players on 1.20 and 1.21 don't trigger alerts
5. Don't automate bans right away: ban by hand for the first few weeks, then switch to automatic bans

Configuration and tuning

Recommended rollout strategy

1. Week 1: Install the anti-cheat with the default configuration. Action: logging and alerts only (no kicks or bans)
2. Week 2: Analyze the logs. Disable the checks that produce false positives. Adjust the thresholds
3. Week 3: Turn on setback and kick for the checks you've confirmed (fly, speed, reach)
4. Week 4+: Turn on automatic bans for the most obvious cheats. Keep monitoring and adjusting

Paper Anti-XRAY configuration

Paper has built-in X-Ray protection. Edit config/paper-world-defaults.yml:

anticheat:
  anti-xray:
    enabled: true
    engine-mode: 2
    hidden-blocks:
      - diamond_ore
      - deepslate_diamond_ore
      - gold_ore
      - deepslate_gold_ore
      - iron_ore
      - deepslate_iron_ore
      - emerald_ore
      - deepslate_emerald_ore
      - ancient_debris
      - lapis_ore
      - deepslate_lapis_ore
    replacement-blocks:
      - stone
      - deepslate
      - netherrack

Engine mode 2 replaces hidden blocks with random ores, so an X-Ray user sees ores everywhere and can't tell the real ones from the fake ones. It costs more performance than mode 1, but it works much better.

Supporting plugins