People lump "stop cheaters" into one wish, but it's two separate problems with two separate answers. Anti-xray hides ores from x-ray users. Anti-cheat tries to detect movement and combat hacks like fly, speed, and killaura. This guide covers both — and it's honest about the ceiling, because overselling anti-cheat is how servers end up punishing innocent players while the real cheaters walk through.
| At a glance | |
|---|---|
| You need | A plugin-capable server for anti-cheat plugins; anti-xray is built into Paper-family software |
| Plan | Any |
| Time | Ten minutes to decide what you actually need |
Anti-xray: mostly already solved
If you run Paper, Purpur, Pufferfish, or Leaf, you already have anti-xray — it's built into the server software, no plugin required. It works by obfuscation: the server sends fake ore blocks scattered through the stone so an x-ray user sees noise instead of the real veins. You turn it on and tune it in the Paper/Purpur config files (the anti-xray section, with an engine-mode setting) — see Paper config tour.
Honest limits:
- It's obfuscation, not detection — it makes x-ray useless rather than catching the user. That's usually what you want.
- The stronger mode (hiding more block types) costs a little CPU as the server rewrites what it sends. On a small server that's fine; on a busy free server, measure it with spark.
- It doesn't stop every method — cave-finder tools and other tricks exist — but it defeats plain x-ray, which is the common case.
🎯 Good to know: Don't install a separate anti-xray plugin on top of Paper's built-in one. Two systems fighting over the same block data waste CPU and can cancel each other out.
Anti-cheat: what it can and can't do
Anti-cheat plugins watch how players move, hit, and interact, and flag or block behavior that isn't physically possible — flying without permission, moving too fast, hitting through walls, attacking faster than a human can click. When it works, it catches the obvious stuff.
Here's the honest part, because it matters:
- The server can't see the player's client. It only sees the packets that arrive. Anti-cheat infers cheating from those packets — it never has proof of what's running on someone's PC. That's why it can be fooled and why it sometimes flags legitimate play.
- It's an arms race. Cheat clients update specifically to slip past popular anti-cheats. Any anti-cheat is strong against yesterday's cheats and playing catch-up with today's.
- False positives are real. Lag spikes, high ping, and certain legit movement (elytra, ice, knockback) can trip detections. Aggressive auto-ban settings will eventually punish an innocent player. Start in a warn/log mode, not auto-ban.
- No anti-cheat is 100%. Anyone who promises that is selling something. The goal is to raise the effort required, not to make cheating impossible.
The right tool for your server
The best defense depends on who's on your server:
| Your server | Best defense |
|---|---|
| Friends only | A whitelist — nobody you didn't invite can join. Nearly all your cheating risk disappears. See Customize your server. |
| Small trusted community | Whitelist or application-only, plus active ops who can spot and ban. See the moderation playbook. |
| Public, open server | An anti-cheat plugin and good moderation and built-in anti-xray — layered, because no single layer is enough |
⚠️ Heads up: On a small friends server, an aggressive anti-cheat often causes more grief (false kicks, rubber-banding) than it prevents. A whitelist is simpler, lighter, and more effective. Reach for anti-cheat when your server is genuinely public.
If you do run an anti-cheat
- Install one from the Plugins page — confirm it supports your Minecraft version, because anti-cheats are especially sensitive to version changes.
- Start in log or warn mode, not auto-ban. Watch what it flags for a few days.
- Exempt trusted staff and tune the thresholds down from the defaults if legit play trips them.
- Only then enable automatic action, and keep it to kicks or short bans you can reverse — never a permanent auto-ban you can't undo.
- Budget the performance. Anti-cheat runs checks every tick; profile with spark if TPS drops.
Because which anti-cheat is currently effective changes constantly, check current reviews and the plugin's own docs for your version before committing — this is not a "set it and forget it" pick.
Verify it works
Test on yourself with permission to be exempt turned off: try to trip a basic check (in a safe test world). A well-configured anti-cheat logs the event; a badly-configured one bans you for lagging. Watch the console and the plugin's log for what it actually flags on real players before trusting auto-actions.
Troubleshooting
- Legit players getting kicked — thresholds are too tight, or high ping/lag is tripping movement checks. Loosen settings, exempt the affected players, and read Fixing Minecraft lag.
- Anti-xray tanking performance — you're on the heaviest engine mode, or running a plugin and the built-in one. Drop to a lighter mode and remove the redundant plugin. See Paper config tour.
- Cheaters still getting through — expected; no tool is perfect. Add moderation and a whitelist for the accounts you can't vouch for.