Anti-xray and anti-cheat, honestly

Intermediate 309 4 min read

Two different problems, two different tools — the anti-xray already built into Paper, and what anti-cheat plugins can and genuinely can't catch on a small server.

People lump "stop cheaters" into one wish, but it's two separate problems with two separate answers. Anti-xray hides ores from x-ray users. Anti-cheat tries to detect movement and combat hacks like fly, speed, and killaura. This guide covers both — and it's honest about the ceiling, because overselling anti-cheat is how servers end up punishing innocent players while the real cheaters walk through.

At a glance
You need	A plugin-capable server for anti-cheat plugins; anti-xray is built into Paper-family software
Plan	Any
Time	Ten minutes to decide what you actually need

Anti-xray: mostly already solved

If you run Paper, Purpur, Pufferfish, or Leaf, you already have anti-xray — it's built into the server software, no plugin required. It works by obfuscation: the server sends fake ore blocks scattered through the stone so an x-ray user sees noise instead of the real veins. You turn it on and tune it in the Paper/Purpur config files (the anti-xray section, with an engine-mode setting) — see Paper config tour.

Honest limits:

It's obfuscation, not detection — it makes x-ray useless rather than catching the user. That's usually what you want.
The stronger mode (hiding more block types) costs a little CPU as the server rewrites what it sends. On a small server that's fine; on a busy free server, measure it with spark.
It doesn't stop every method — cave-finder tools and other tricks exist — but it defeats plain x-ray, which is the common case.

🎯 Good to know: Don't install a separate anti-xray plugin on top of Paper's built-in one. Two systems fighting over the same block data waste CPU and can cancel each other out.

Anti-cheat: what it can and can't do

Anti-cheat plugins watch how players move, hit, and interact, and flag or block behavior that isn't physically possible — flying without permission, moving too fast, hitting through walls, attacking faster than a human can click. When it works, it catches the obvious stuff.

Here's the honest part, because it matters:

The server can't see the player's client. It only sees the packets that arrive. Anti-cheat infers cheating from those packets — it never has proof of what's running on someone's PC. That's why it can be fooled and why it sometimes flags legitimate play.
It's an arms race. Cheat clients update specifically to slip past popular anti-cheats. Any anti-cheat is strong against yesterday's cheats and playing catch-up with today's.
False positives are real. Lag spikes, high ping, and certain legit movement (elytra, ice, knockback) can trip detections. Aggressive auto-ban settings will eventually punish an innocent player. Start in a warn/log mode, not auto-ban.
No anti-cheat is 100%. Anyone who promises that is selling something. The goal is to raise the effort required, not to make cheating impossible.

The right tool for your server

The best defense depends on who's on your server:

Your server	Best defense
Friends only	A whitelist — nobody you didn't invite can join. Nearly all your cheating risk disappears. See Customize your server.
Small trusted community	Whitelist or application-only, plus active ops who can spot and ban. See the moderation playbook.
Public, open server	An anti-cheat plugin and good moderation and built-in anti-xray — layered, because no single layer is enough

⚠️ Heads up: On a small friends server, an aggressive anti-cheat often causes more grief (false kicks, rubber-banding) than it prevents. A whitelist is simpler, lighter, and more effective. Reach for anti-cheat when your server is genuinely public.

If you do run an anti-cheat

Install one from the Plugins page — confirm it supports your Minecraft version, because anti-cheats are especially sensitive to version changes.
Start in log or warn mode, not auto-ban. Watch what it flags for a few days.
Exempt trusted staff and tune the thresholds down from the defaults if legit play trips them.
Only then enable automatic action, and keep it to kicks or short bans you can reverse — never a permanent auto-ban you can't undo.
Budget the performance. Anti-cheat runs checks every tick; profile with spark if TPS drops.

Because which anti-cheat is currently effective changes constantly, check current reviews and the plugin's own docs for your version before committing — this is not a "set it and forget it" pick.

Verify it works

Test on yourself with permission to be exempt turned off: try to trip a basic check (in a safe test world). A well-configured anti-cheat logs the event; a badly-configured one bans you for lagging. Watch the console and the plugin's log for what it actually flags on real players before trusting auto-actions.

Troubleshooting

Legit players getting kicked — thresholds are too tight, or high ping/lag is tripping movement checks. Loosen settings, exempt the affected players, and read Fixing Minecraft lag.
Anti-xray tanking performance — you're on the heaviest engine mode, or running a plugin and the built-in one. Drop to a lighter mode and remove the redundant plugin. See Paper config tour.
Cheaters still getting through — expected; no tool is perfect. Add moderation and a whitelist for the accounts you can't vouch for.

Was this guide helpful?

More in this category

Getting started with Minecraft pluginsBeginnerTemplate 1,141 Set up EssentialsXBeginner 567 LuckPerms basicsIntermediate 435 Build a rank ladder with LuckPermsIntermediate 502 Roll back grief with CoreProtectIntermediate 467

View all

Anti-xray and anti-cheat, honestly

Intermediate 309 4 min read

Two different problems, two different tools — the anti-xray already built into Paper, and what anti-cheat plugins can and genuinely can't catch on a small server.

At a glance
You need	A plugin-capable server for anti-cheat plugins; anti-xray is built into Paper-family software
Plan	Any
Time	Ten minutes to decide what you actually need

Anti-xray: mostly already solved

Honest limits:

It's obfuscation, not detection — it makes x-ray useless rather than catching the user. That's usually what you want.
The stronger mode (hiding more block types) costs a little CPU as the server rewrites what it sends. On a small server that's fine; on a busy free server, measure it with spark.
It doesn't stop every method — cave-finder tools and other tricks exist — but it defeats plain x-ray, which is the common case.

🎯 Good to know: Don't install a separate anti-xray plugin on top of Paper's built-in one. Two systems fighting over the same block data waste CPU and can cancel each other out.

Anti-cheat: what it can and can't do

Here's the honest part, because it matters:

The server can't see the player's client. It only sees the packets that arrive. Anti-cheat infers cheating from those packets — it never has proof of what's running on someone's PC. That's why it can be fooled and why it sometimes flags legitimate play.
It's an arms race. Cheat clients update specifically to slip past popular anti-cheats. Any anti-cheat is strong against yesterday's cheats and playing catch-up with today's.
False positives are real. Lag spikes, high ping, and certain legit movement (elytra, ice, knockback) can trip detections. Aggressive auto-ban settings will eventually punish an innocent player. Start in a warn/log mode, not auto-ban.
No anti-cheat is 100%. Anyone who promises that is selling something. The goal is to raise the effort required, not to make cheating impossible.

The right tool for your server

The best defense depends on who's on your server:

Your server	Best defense
Friends only	A whitelist — nobody you didn't invite can join. Nearly all your cheating risk disappears. See Customize your server.
Small trusted community	Whitelist or application-only, plus active ops who can spot and ban. See the moderation playbook.
Public, open server	An anti-cheat plugin and good moderation and built-in anti-xray — layered, because no single layer is enough

⚠️ Heads up: On a small friends server, an aggressive anti-cheat often causes more grief (false kicks, rubber-banding) than it prevents. A whitelist is simpler, lighter, and more effective. Reach for anti-cheat when your server is genuinely public.

If you do run an anti-cheat

Install one from the Plugins page — confirm it supports your Minecraft version, because anti-cheats are especially sensitive to version changes.
Start in log or warn mode, not auto-ban. Watch what it flags for a few days.
Exempt trusted staff and tune the thresholds down from the defaults if legit play trips them.
Only then enable automatic action, and keep it to kicks or short bans you can reverse — never a permanent auto-ban you can't undo.
Budget the performance. Anti-cheat runs checks every tick; profile with spark if TPS drops.

Verify it works

Troubleshooting

Legit players getting kicked — thresholds are too tight, or high ping/lag is tripping movement checks. Loosen settings, exempt the affected players, and read Fixing Minecraft lag.
Anti-xray tanking performance — you're on the heaviest engine mode, or running a plugin and the built-in one. Drop to a lighter mode and remove the redundant plugin. See Paper config tour.
Cheaters still getting through — expected; no tool is perfect. Add moderation and a whitelist for the accounts you can't vouch for.

Anti-xray and anti-cheat, honestly

Anti-xray: mostly already solved

Anti-cheat: what it can and can't do

The right tool for your server

If you do run an anti-cheat

Verify it works

Troubleshooting

Next steps

Falix Guides

Browse by topic

Only show guides for your app

Anti-xray and anti-cheat, honestly

Anti-xray: mostly already solved

Anti-cheat: what it can and can't do

The right tool for your server

If you do run an anti-cheat

Verify it works

Troubleshooting

Next steps