Sooner or later, every public server that grows will get a visitor with a hacked client: someone flying over the spawn, spotting diamonds through walls, or hitting players faster than any human could. The goal is not to eliminate cheating but to make it hard and unrewarding, catch cheaters with evidence, and punish fairly. This guide walks through four layers: an anti-cheat plugin, ore hiding against x-ray, logging, and a fair punishment policy.

What does an anti-cheat plugin actually do?

The Minecraft client tells the server where the player is standing, where they are looking and what they are hitting. A vanilla server trusts most of these messages and only rejects very crude problems, such as jumping a huge distance in one step. An anti-cheat plugin fills that gap by checking every movement and attack against the game's physics. Floating, moving too fast, hitting outside the field of view or breaking blocks too quickly all get flagged.

Among open source options, Grim simulates the player's movement on the server side and is a popular choice on current Paper versions. NoCheatPlus is older and still well known, although support for recent game versions now depends on community forks. Whichever you choose, check on the plugin's page that it supports your server version, and install only one anti-cheat. When two plugins try to correct the same movement in different ways, players get rubber-banding and stutter.

Install the plugin from the panel and restart the server. In Grim, staff need the grim.alerts permission to receive alerts, and can toggle them with /grim alerts. Grant it to your moderator group, as described in our LuckPerms ranks and permissions guide.

What the plugin cannot see

An anti-cheat can only judge what reaches the server. It has no idea what is drawn on the player's screen. X-ray, player highlighting and other visual cheats do not change movement, so movement checks will never catch them. For those you need to limit what the server sends and review behaviour through logs.

False positives: why honest players get flagged

Every anti-cheat occasionally flags an innocent player. The usual causes are:

  • Latency and packet loss: when a connection stutters, movement arrives in irregular bursts that can look like a speed hack.
  • Server lag: when TPS drops, the server processes movement late. If many players get flagged at the same moment after a load spike, you are looking at a performance problem, not a cheating wave.
  • Plugins that change movement: launch pads, speed items, custom jump blocks or minigame knockback produce motion the anti-cheat does not expect.
  • Different client types: Bedrock players joining through a bridge send movement that differs slightly from Java clients, and some anti-cheats have separate settings for them.

So never treat a single alert as proof. An alert only tells you where to look. What matters is a pattern: many alerts of the same type from the same player, repeated in different places and at different times. On a fresh setup, a sensible approach is to spend the first week with automatic punishments disabled and alerts only. You will learn which false alarms are specific to your server and can tune thresholds accordingly.

Hiding ores from x-ray (Paper anti-xray)

X-ray lets a client see through blocks. The most effective server-side defence is simply not to send the real location of ores the player could not possibly see. Paper does this out of the box, no extra plugin needed. The settings live in the anticheat.anti-xray section of config/paper-world-defaults.yml, which you can edit in the file manager:

anticheat:
  anti-xray:
    enabled: true
    engine-mode: 2
    max-block-height: 64
    update-radius: 2
    lava-obscures: false
    use-permission: false
    hidden-blocks:
      - diamond_ore
      - deepslate_diamond_ore
      - emerald_ore
      - deepslate_emerald_ore
      - gold_ore
      - deepslate_gold_ore
      - ancient_debris
    replacement-blocks:
      - stone
      - deepslate

engine-mode has three values. Mode 1 disguises hidden ores as the surrounding stone. It is cheap, but an x-ray user still sees ores exposed on cave walls. Mode 2 scatters fake ores among hidden blocks, so the x-ray view shows ore everywhere and becomes useless. Mode 3 places fake ores in a pattern, which trims network traffic a little. Mode 2 is a balanced choice for most survival servers; on very busy servers keep an eye on bandwidth and CPU use.

max-block-height is the highest level where hiding applies. Most ores sit below it, so scanning above only adds load. For the Nether, add a separate section to paper-world.yml inside that world's folder: there replacement-blocks should contain netherrack, and hidden-blocks should list ancient_debris and nether_gold_ore. Restart the server after editing.

Chunk data is sent fresh on every load, so protection covers your existing world immediately.

Logging: no punishment without evidence

The most reliable way to confirm a suspicion is to see what the player actually did. CoreProtect, covered in our Rolling back griefing with CoreProtect guide, is just as useful here. To list the diamond ores a player broke over the last three days:

co lookup u:PlayerName b:diamond_ore a:-block t:3d

A normal player wanders through caves and mines a lot of stone, finding ore along the way. An x-ray user tunnels in almost straight lines from one ore to the next. Compare it with the stone they broke. With anti-xray in mode 2, a player who keeps digging straight toward fake ores gives themselves away, because an honest player never sees those fake blocks in the first place.

Keep the anti-cheat alert history, the relevant lines from the server log and any video players send you. Write a short note for each case with the date, the player name, what you observed and what you decided. That note protects you when an appeal comes in later.

A fair punishment policy

The biggest mistake in fighting cheaters is punishing in anger and without evidence. To keep things fair:

  1. Write the rule in advance. State clearly which client modifications are allowed (performance and visual improvements, for example) and which are not. Our Server rules and community moderation guide covers this in depth.
  2. Escalate step by step. Watch the player while you only suspect; act once the evidence is clear. A warning for a minor offence, a temporary ban for repeat offences and a permanent ban for obvious, deliberate cheating is a reasonable ladder.
  3. Use two pairs of eyes. For heavy decisions such as permanent bans, let one staff member gather evidence and another review it.
  4. Record the reason. The vanilla /ban PlayerName reason command stores the reason in the ban list; keep it short but clear.
  5. Offer an appeal. Provide an appeal channel on Discord or through a form, and have someone other than the original moderator review it.
  6. Repair the damage. Roll back stolen items and broken builds with CoreProtect so that honest players are not left paying for someone else's cheating.

Quick checklist

  • One anti-cheat matching your version; alerts only for the first week.
  • Paper anti-xray on, Nether configured separately.
  • CoreProtect from day one.
  • Alerts are hints; logs are evidence.
  • A written, gradual policy with a real appeal process.

When these layers work together, cheating becomes both harder and quicker to spot, and your honest players feel safe on the server.