Choose and tune an anti-cheat for your Minecraft server

A cheater who flies, hits from six blocks away or mines in a straight line towards diamonds drives honest players away faster than any bug. An anti-cheat is essential as soon as a server is public, but a badly tuned anti-cheat that bans innocent people does as much damage as a cheater.

What an anti-cheat can do, and what it can't

A server-side anti-cheat compares what the player sends with what the game allows: speed, path, hit range, click rate, blocks broken. It's good at spotting:

• flying, speed and impossible jumps;
• reach and hits through walls (killaura, reach);
• block placing that's too fast (scaffold).

It doesn't see what the client displays: a player who sees ores through stone (x-ray) or players through walls isn't cheating in their movements. Against this, the server has to stop sending the information: that's the job of anti-xray.

The main plugins

Plugin	Price	Strength
Grim	free, open source	simulates the player's movements instead of guessing: very few false positives
Vulcan	paid	very widespread, many combat checks, thorough documentation

Others exist, free or paid: judge them on recent updates and on their false-positive rate, not on the length of their detection list.

Grim is an excellent starting point: free, maintained, compatible with Paper and Folia, and it handles Bedrock players arriving through Geyser, whose movements differ from Java's. Always check that an anti-cheat supports your exact version before installing it.

Never install two anti-cheats at the same time: they contradict each other, double the false positives and cost CPU time.

Paper's anti-xray

Paper ships an anti-xray: hidden ores are sent to the client as stone until they're exposed to air. It's set in config/paper-world-defaults.yml:

anticheat:
  anti-xray:
    enabled: true
    engine-mode: 2

Mode 1 hides ores behind stone; mode 2 adds fake ores everywhere, which makes x-ray useless, at the cost of a little more bandwidth. Start with mode 1 if your server is busy, test mode 2 otherwise.

Tune without banning innocent players

1. Start in alert mode. For two weeks, the anti-cheat warns the team instead of sanctioning. You'll see which checks fire wrongly.
2. Raise the thresholds of noisy checks rather than disabling them: a lagging player often triggers speed alerts.
3. Keep automatic bans for obvious cases (sustained flying, reach far beyond what's possible). The rest goes through a human.
4. Keep the evidence: alert history, a video, the logs. A contested ban is settled with facts.

Performance matters too: an anti-cheat checks every movement of every player. If your server slows down after installing it, a Spark profile will show it right away.

The team remains essential

No anti-cheat catches everything. Discreet cheaters (a little extra reach, an x-ray used carefully) slip through. What stops them:

• CoreProtect, to see who mined what: a player who only digs towards diamonds shows up in the history;
• moderators who watch in spectator mode, with a clear procedure. The guide Recruit a moderation team details how to build it;
• rules that say what's forbidden and what it costs. The rules generator includes the cheating rule and the sanction scale.

What actually works

Grim in alert mode, Paper's anti-xray turned on, automatic sanctions limited to obvious cases, and a team that settles the rest with evidence. A server known for being fair attracts players; a server known for banning at random drives them away.