Anti-cheat on a Minecraft server: what works

What cheat clients actually do, what a server-side anti-cheat can and cannot detect, how to keep false positives from punishing honest players, and why logging and moderation catch more cheaters than any plugin on its own.

6 min read · Updated Oct 21, 2026 · By GuavaHost Team

What cheating looks like in practice

Cheat clients are modified Minecraft clients with a menu of toggles. You do not need to know how they are built, but you do need to recognise what each one looks like from the server's side, because that is what decides whether anything can catch it.

• Reach. Hitting a player from further away than the game allows. The server sees the attack packet and can measure the distance, so this is detectable.
• Killaura. Automatically attacking anything nearby, with inhumanly consistent timing and impossible head turns. Detectable, mostly by the rotation pattern and hit rate.
• Fly and speed. Moving in ways the game's physics do not allow. The server simulates where a player should be able to go, so large violations stand out.
• Autoclicker, nuker and scaffold. Clicking faster than a hand can, breaking a lot of blocks at once, or placing blocks under yourself at full walking speed. Detectable statistically, which is also where false positives start.
• X-ray. Seeing ores through stone. The awkward one, because the client sends nothing unusual: the player walks to the right place and mines, and there is nothing in the packets to catch.

That last point is the whole lesson of this guide. An anti-cheat plugin runs on the server and only sees what the client sends: positions, rotations, clicks, inventory actions, block changes. If a cheat only changes what the player can see, the server has no direct evidence of it.

What server-side anti-cheat can and cannot see

Can see, with reasonable confidence: movement that physics does not permit, attacks at impossible distances or angles, click patterns with no human variation, block breaking faster than the tool allows, and inventory actions in impossible orders.

Cannot see: what the player's screen is showing, so x-ray, chest ESP and player outlines through walls; client mods that only help a player decide; and anything done by a human who is simply very good.

So an anti-cheat catches the loud cheats well, the subtle ones sometimes, and the visual ones not at all. Anyone claiming otherwise is selling you a feeling.

For x-ray specifically, the real fix is obfuscation rather than detection, and it is already built into Paper. Paper's anti-xray feature fills the world data it sends with fake ore blocks so a cheat client cannot tell a real diamond from a decoy. You enable it in the world defaults config, and it has a measurable CPU cost at the higher engine modes: optimize Paper for performance covers those config files.

The other half of catching an x-rayer is boring and effective. A player who tunnels in a straight line and turns at exactly the right moments every time is visible in block logs, which is what undoing griefing with CoreProtect is for.

False positives are the real cost

Every anti-cheat has a dial between catching more cheats and punishing more innocents, and there is no setting where both are zero.

The things that look like cheating but are not:

• Lag and high ping. A player on a bad connection sends position updates in bursts, and the server sees a teleport. Distance to the server matters here, which is what lag versus ping is about.
• A server at low TPS. If your server is ticking at 15, its own physics simulation is wrong, so its idea of where a player should be is wrong too. Fix your performance before you tune your anti-cheat, or you will ban honest players for your own lag.
• Elytra, boats, ice roads, pistons, bubble columns. Anything with unusual movement physics. Elytra over an ice track is the classic trigger.
• Plugins that move players. Teleport plugins, launch pads, grappling hooks, vehicles. Most anti-cheats have an exemption list, and you have to use it.

Two habits keep this manageable. Start in a mode that only logs and warns staff, and run it like that for a week while you read what it flags. And never set an automatic ban on a first violation: let it flag, let a human look, then act. Kicks and bans are covered in ban, kick and unban players.

The options, by name

We are not going to tell you which one to buy, because the answer depends on your version, your plugins and your budget, and the landscape genuinely moves. Here is the honest shape of it:

Free:

• GrimAC is open source, actively developed, and built around predicting movement rather than guessing at thresholds. It is the free option most people point at now.
• AntiCheatReloaded is simpler and lighter, and catches the obvious things.
• NoCheatPlus is the old name everyone remembers. It is very dated, and it is not a good choice on a modern version.
• Paper's own anti-xray, as above. Not an anti-cheat, but it closes the hole no anti-cheat can.

Paid: Vulcan, Matrix, Spartan, Themis and Intave are the names you will see on plugin marketplaces. They vary a lot in detection quality and in how chatty their false positives are, and a build that was great a year ago may not be maintained now.

Before you install any of them, check it supports your exact Minecraft version and server type, and check when it was last updated: an unmaintained anti-cheat is worse than none, because it flags honest players on new movement mechanics. Get it from the developer's own page rather than a reupload, which matters more here than for any other plugin because it runs on every packet your server receives. Safe sources for plugins and mods covers that, and take a backup before you install.

Do not run two anti-cheats at once. They both intercept the same packets, both try to correct the same movements, and the result is a rubber banding mess with duplicate flags.

The setup that actually works

An anti-cheat is one layer. The servers that have the least trouble with cheaters do all of this:

1. Keep online mode on. online-mode=true in server.properties verifies every player against Mojang, which means a banned cheater cannot just change their name and come back on the same account. Turning it off invites exactly the crowd you are trying to keep out. See editing server.properties.
2. Control who joins. A whitelist is the bluntest and most effective anti-cheat there is. Set up a Minecraft whitelist without locking yourself out shows how to do it without cutting yourself off.
3. Log every block change. CoreProtect, installed before you need it, turns "I think he x-rayed" into a list of exactly what was mined and when.
4. Give staff the tools to watch. Vanish and spectator mode catch more killaura in five minutes than a week of plugin flags. Give staff the right tools covers what to hand out and what to hold back.
5. Keep your TPS healthy and keep backups. A laggy server makes every anti-cheat worse, and a backup turns a bad night into ten minutes of restoring. Keeping griefers out lays out the whole approach.

Common questions

Can an anti-cheat plugin detect x-ray?

Not reliably, because an x-ray client sends nothing unusual to the server. The practical answers are Paper's anti-xray, which hides the ore data from the client in the first place, and block logs that show a suspicious mining pattern after the fact.

Why did my anti-cheat flag a player who was clearly not cheating?

Usually lag, either theirs or the server's, or an unusual movement your anti-cheat has no exemption for, like elytra flight or a launch pad. Run the plugin in a warn only mode until you have trimmed those exemptions, and never ban on a single automated flag.

Does GuavaHost block cheaters at the network level?

No, and nobody can. Cheat clients are ordinary Minecraft clients as far as the network is concerned, so detection has to happen in the game. What the hosting side protects you from is attacks on the server itself, which is a different problem and covered in how DDoS protection works.

Still stuck? Jump into our Discord at discord.gg/GuavaHost and the team will help you out.

• anti-cheat
• minecraft
• java
• security
• plugins

Host a Minecraft Java server From $3.99/mo, with instant setup and DDoS protection.

Still need help? Our team is online 24/7 to answer questions.

Contact support