---
title: "Minecraft Anti-Cheat and Fair Play: Stopping X-Ray and Movement Cheats"
description: "Stop x-ray with Paper's built-in anti-xray, pick a movement anti-cheat that is actually still maintained, and know the real limits before tightening."
url: "https://www.gameserverkings.com/knowledge-base/minecraft/anti-cheat-and-fair-play/"
category: "Minecraft"
category_url: "https://www.gameserverkings.com/knowledge-base/minecraft/"
published: "2026-08-19T05:27:48.522Z"
updated: "2026-08-19T06:09:37.106Z"
source_format: "markdown"
site: "GameServerKings"
---

# Minecraft Anti-Cheat and Fair Play: Stopping X-Ray and Movement Cheats

Cheating on a Minecraft server splits into two problems that have almost nothing in common. One is **x-ray** — seeing ores through stone — which is a rendering trick, and is beaten by not sending the client the truth in the first place. The other is **movement and combat cheating** — reach, killaura, fly, speed — which is a physics argument with a client you do not control, and which is never fully won.

This guide covers both honestly: what the server can actually enforce, what it cannot, and where the tooling stands today. It assumes Java Edition on Paper or a Paper fork, because that is where nearly all of the server-side defence lives.

> [!NOTE] Griefing is a different problem
> Cheating is a player doing things the game should not allow. Griefing is a player doing things the game *does* allow, to your build. If what you need is to undo damage or lock an area down, that is [Minecraft Grief Protection and Rollback](/knowledge-base/minecraft/grief-protection-and-rollback/).

## Start With Identity, Because Nothing Else Works Without It

Every ban, every whitelist entry, every "we know who did this" depends on the server being able to prove which account connected. That proof comes from one setting.

| Key | Default | What it does |
|---|---|---|
| `online-mode` | `true` | Verifies each connecting player against Mojang's account database |
| `enforce-secure-profile` | `true` | Only allows players with a Mojang-signed public key. *"If this is not enabled, all chat messages will be left unsigned and unable to be reported"* |
| `prevent-proxy-connections` | `false` | *"Whether to kick players if the ISP/AS sent from the server is different from the one from Mojang Studios' authentication server"* |

The wiki's description of turning `online-mode` off is not subtle: *"This variable should only be set to false when the server is not connected to the Internet; hackers with fake accounts can connect if this is set to false."* With it on, the server makes an authenticated call to Mojang's session servers during login and gets back the account's real UUID. With it off that call never happens — the server takes whatever username the client typed at face value and manufactures a UUID from it, specifically a version-3 UUID generated from the MD5 hash of the string `OfflinePlayer:<username>`. That algorithm is public and deterministic.

> [!CAUTION] An offline-mode server cannot verify identity at all
> Because the UUID is derived from the typed name, anyone who types your admin's username *is* your admin as far as the server is concerned — same UUID, same op entry, same whitelist entry, same inventory. The wiki states it directly: on servers with `online-mode` disabled, "the whitelist checks against the offline UUID of players, converted from their usernames." No anti-cheat plugin, permission system or ban list survives this. If you run offline mode, everything below is decoration.

`prevent-proxy-connections` is the one people reach for against VPN-hopping ban evaders. Enabled, the server sends the connecting IP with its authentication request and a mismatch becomes a kick. That catches some proxies — and also carrier-grade NAT, mobile networks and corporate VPNs. It is a lever with a real false-positive cost, not a free win.

For the whitelist and ban lists themselves — the files, the UUID trap, and why you must never hand-edit `banned-players.json` on a running server — see [Minecraft Whitelist and Ban Management](/knowledge-base/minecraft/whitelist-and-ban-management/).

## X-Ray: The Complaint You Will Actually Get

X-ray is the most reported and least understood form of cheating on a survival server. The report is always the same shape: someone found four diamond veins in ten minutes, their tunnels go straight to ore and turn at right angles, and they never once mine into a cave by accident.

**What x-ray actually is:** the server sends every client the full contents of the chunks around it, because the client has to render the world. A vanilla client draws stone opaquely. A modified client — a mod, not a texture pack, in almost every case today — simply chooses not to draw stone. The data was always there. The cheat is purely in what the client does with it.

That is why the server-side fix is not detection. It is **lying about the chunk**.

### Paper's Anti-Xray

Paper ships chunk obfuscation built in. It rewrites the block data in the chunk packets it sends, so a client that stops drawing stone sees a plausible fiction rather than your ore distribution. It is **off by default**.

```yaml title="config/paper-world-defaults.yml"
anticheat:
  anti-xray:
    enabled: false
    engine-mode: 1
    max-block-height: 64
    update-radius: 2
    lava-obscures: false
    use-permission: false
    hidden-blocks: [ ... ]
    replacement-blocks: [ stone, oak_planks, deepslate ]
```

Those eight keys are the whole feature:

| Key | Default | What it does |
|---|---|---|
| `enabled` | `false` | *"Controls the on/off state for the Anti-Xray system"* |
| `engine-mode` | `1` | Which obfuscation strategy to use — see below |
| `hidden-blocks` | 23 ores and chests | The blocks to hide. In mode 1 they are replaced by stone, deepslate, netherrack or end_stone by dimension |
| `replacement-blocks` | `stone`, `oak_planks`, `deepslate` | The material fake ores are scattered through. *"With engine-mode: 1, replacement blocks are not used"* |
| `max-block-height` | `64` | The Y coordinate above which anti-xray stops. Only multiples of 16 are accepted; *"all other values will be rounded down"* |
| `update-radius` | `2` | How much real data to send around a block the player interacts with. *"0 is only designed for testing purposes. Do not use it in production"* |
| `lava-obscures` | `false` | Whether to obfuscate blocks touching lava. *"Does not work well with non-stone-like ore textures"* |
| `use-permission` | `false` | Lets players with `paper.antixray.bypass` see the truth. Off by default because *"legacy permission plugins may struggle with the number of checks made"* |

### The three engine modes, in Paper's words

> **1** — *"replaces specified blocks (hidden-blocks) with other 'fake' blocks, stone (deepslate at y < 0), netherrack, or end_stone based on the dimension."*
>
> **2** — *"will replace both hidden-blocks and replacement-blocks with randomly generated hidden-blocks."*
>
> **3** — *"works similarly to engine-mode: 2, but instead of randomizing every block, it randomizes the block for each layer of a chunk."*

The practical difference is what happens at a cave wall. Paper: *"With `engine-mode: 1`, only ores that are entirely covered by solid blocks will be hidden. Ores exposed to air in caves or water from a lake will not be hidden. With `engine-mode: 2`, fake ores obstruct the view of real blocks."* Mode 2's stronger trick is adding `air` to `hidden-blocks`, which fills the world with fake holes and defeats cave-finding as well as ore-finding — at a cost Paper flags twice: *"doing this may cause client performance issues (FPS drops) for some players."*

> [!WARNING] Anti-xray changes need a full restart, not a reload
> PaperMC: *"Make sure to always restart your server after making changes to the Anti-Xray configuration. Changes won't be applied automatically. Do not use the `/reload` command."* This catches people constantly — they edit the file, run `/reload`, see no change, and conclude the feature is broken. Use **Restart** from the panel's Console tab, or the schedule from [Minecraft Scheduled Restarts and Server Automation](/knowledge-base/minecraft/scheduled-restarts-and-automation/).

### `max-block-height` is an absolute Y coordinate

This deserves its own heading because the wording invites the wrong reading. Paper describes it as *"the maximum height (y coordinate, starting from the bottom of the world)"*, and many people take "starting from the bottom of the world" to mean the number is an offset from y=-64 — so `64` would only reach y=0 and leave the diamond layer exposed.

It does not. The value is compared against absolute Y. On a modern overworld with a floor at y=-64, `max-block-height: 64` obfuscates **everything from y=-64 up to y=63** — the entire deepslate band, diamonds included — and leaves the surface alone. The default is correct for the overworld out of the box.

The clause you *should* act on is the one in Paper's own config comments: *"As of 1.18 some ores are generated much higher. Please adjust the max-block-height setting at your own discretion."* Copper and iron in particular generate well above y=64 in mountain biomes.

### The Nether and the End need their own settings

Overworld settings live in `config/paper-world-defaults.yml`. Per-dimension overrides go in their own files:

- `world/dimensions/minecraft/the_nether/paper-world.yml`
- `world/dimensions/minecraft/the_end/paper-world.yml`

Paper's own worked examples set the Nether to `max-block-height: 128` with a Nether-specific `hidden-blocks` list — `ancient_debris`, `nether_gold_ore`, `nether_quartz_ore` — and, for mode 2, Nether-appropriate `replacement-blocks` such as `basalt`, `blackstone`, `gravel`, `netherrack`, `soul_sand` and `soul_soil`. The End example simply sets `enabled: false`, because there is nothing there worth hiding.

> [!IMPORTANT] The commonest anti-xray failure is a stale config
> Paper's FAQ on "it doesn't work below y = 0 or in certain other places": *"Your configuration file is probably outdated and missing important blocks in the `replacement-blocks` list, such as `deepslate` or biome-specific blocks, such as `basalt`."* A config carried forward from a pre-1.18 server obfuscates the old world height with the old block list and quietly leaves the deepslate layer — the interesting one — untouched. If you have upgraded across versions, compare your lists against a freshly generated `paper-world-defaults.yml`.

### What it costs

Paper publishes no TPS benchmarks for anti-xray, and we will not invent any. What its documentation does say:

- *"Especially on the client side, `engine-mode: 1` is much less computationally intensive, while `engine-mode: 2` may better prevent Xray."*
- *"`engine-mode: 3` can reduce network load when joining by a factor of ~2 and helps with chunk packet compression."*

That second line is the only quantified figure Paper gives, and it is a comparison against mode 2, not praise for mode 3 in isolation: mode 2's randomised-every-block output compresses badly, which shows up as bandwidth on chunk load, and mode 3 exists to get most of the effect back without that penalty.

The sensible default is to **start on `engine-mode: 1`**. It is the cheapest, it handles the overwhelming majority of casual x-ray, and it never makes anyone's client stutter. Move to 2 or 3 only with evidence that people are cave-finding around it, and re-measure MSPT afterwards using [Diagnosing Minecraft Server Lag](/knowledge-base/minecraft/diagnosing-lag-and-low-tps/).

### What anti-xray does not stop

Paper is unusually candid about the bypasses, and a host that pretends otherwise is doing you no favours.

**Range extension.** *"While Anti-Xray alone will prevent the majority of users from Xraying on your server, it is not by any means infallible. Because of how Anti-Xray is (and has to be) implemented, it is possible to, on a default server, extend the range of real ores you can see by a not insignificant amount."* Paper's suggested mitigation is *"any competent anti-cheat plugin; however, this is not included out of the box."*

**Seed reversing.** *"If the client is able to obtain the world seed, it is able to know the real location of every generated ore, completely bypassing Anti-Xray."* Obfuscation is irrelevant to someone who can compute where ore is from first principles. Paper's partial mitigation is the `feature-seeds` section of the world config — `generate-random-seeds-for-all: true` autofills a random population seed for every feature that lacks one — used together with the per-structure `seed-*` keys in `spigot.yml`. Paper adds that *"this is not a complete solution."* Never publishing your seed helps most.

**Ores exposed to air.** True in every engine mode. Modes 2 and 3 obscure the view rather than removing the exposure, and *"hiding those exposed ores too requires additional plugins."*

**Operators.** From the FAQ, you will still see ores if *"the `use-permission` option is enabled and you have the Anti-Xray bypass permission (`paper.antixray.bypass`) or you have operator status."* When anti-xray appears not to work while you test it from your admin account, this is usually why. Test from a second, non-op account.

### Two fixes that are widely recommended and do not work

**Requiring a server resource pack.** `require-resource-pack=true` disconnects players who decline your pack, and the reasoning goes that your textures then overwrite their x-ray textures. Modern x-ray is a *mod* that changes how the world is rendered, which a resource pack cannot touch. A required pack is a fine tool for branding and custom models; it is not an anti-cheat.

**Banning "fullbright".** You cannot see it, you cannot detect it server-side, and on its own it reveals nothing a torch would not.

### Catching x-ray after the fact

The most reliable evidence you will ever get is a block log, because it does not depend on catching anyone in the act. With CoreProtect installed — as [Minecraft Grief Protection and Rollback](/knowledge-base/minecraft/grief-protection-and-rollback/) recommends — the query is a one-liner:

```text title="Console — who has been mining diamonds this week?"
co lookup i:diamond_ore t:7d a:-block
```

```text title="One player, one week, ores only"
co lookup u:Steve t:7d a:-block i:diamond_ore,ancient_debris
```

What matters is not the raw count but the **ratio**. An honest miner breaks hundreds of stone and deepslate blocks for every ore; an x-rayer breaks tens. Compare a suspect against your known-honest players over the same window and the distribution separates them clearly. Adding `#count` to a lookup returns just the number of matching rows, which makes that comparison quick across several names.

This is also the evidence that survives an appeal. "Your ore-to-stone ratio is twelve times the server median over three weeks" is a conversation you can have. "It looked like you knew where to dig" is not.

## Movement and Combat Cheats

The second family is harder, because there is no equivalent of "just don't send them the data". The client has to tell the server where it is and what it is hitting, and a cheat client simply lies. Everything the server can do is a judgement about whether a claim is plausible.

The categories worth knowing, because they are what any anti-cheat's logs will name:

| Cheat | What it looks like in-game |
|---|---|
| **Reach** | Being hit from outside melee range |
| **Killaura** | Spinning, hitting several players at once, never missing |
| **Fly / NoFall** | Hovering, or gliding down cliffs unharmed |
| **Speed / Timer** | Sprinting past everyone, or the whole world reacting too fast |
| **NoSlow** | Never slowing down while eating, blocking or in cobwebs |
| **Autoclicker** | Perfectly even attack intervals at 20+ clicks per second |

### What the plain server already does

Not nothing, but close. Vanilla kicks a player for sustained flight, and it performs two sanity checks on movement packets that are exposed for tuning in `spigot.yml`:

```yaml title="spigot.yml"
settings:
  moved-too-quickly-multiplier: 10.0
  moved-wrongly-threshold: 0.0625
```

Paper documents them as *"controls how fast a client can move in one packet"* and *"controls how far the client can move per move-packet, defined as the distance in blocks squared"*, and in both cases *"if triggered, the server logs to console and prevents the move."*

Two things follow that are widely misreported. **Neither check bans or kicks** — the server writes a `moved too quickly!` or `moved wrongly!` line to the log and puts the player back at their last known-good position. What players experience is a rubber-band, not a punishment. And the default multiplier is **ten times** expected movement, which makes it a desync guard rather than a detector: it catches a client claiming to have crossed roughly ten blocks in a single movement packet, says nothing about a player moving 15% too fast, and says nothing at all about reach, aim or autoclicking.

> [!WARNING] Do not lower these to "tighten security"
> These thresholds have to tolerate lag, elytra, boats, ice, riptide tridents and every entity a player might be riding. Tighten them and you will start rubber-banding legitimate players in exactly the situations the game is already unforgiving about. Real detection is a plugin's job, not a smaller number here.

### The anti-cheat landscape, checked today

This ecosystem churns badly, and a recommendation that was right two years ago is often actively harmful now: an unmaintained anti-cheat is a false sense of security plus a plugin that breaks on the next server update. Everything below was verified on **19 August 2026** against each project's own distribution page or repository. Check it again before you install anything — including this table.

| Project | Cost | Current for 26.2? | Last updated | Folia |
|---|---|---|---|---|
| **Grim Anticheat** | Free, GPL-3.0 | Yes | 19 Aug 2026 | Yes |
| **Lightning Grim** (a Grim fork) | Free, GPL-3.0 | Yes | 27 Jun 2026 | Yes |
| **Vulcan** | Paid, $19.99 one-off | Yes | 14 Jul 2026 | Experimental |
| **Spartan** | Paid; limited free build | Yes | 29 Jul 2026 | Yes |
| **Matrix** | Paid, $22 one-off | Yes — 7.24.x builds | Listing says Apr 2025 — see below | Yes |
| **Intave** | Free tier, source-available | Lists 26.1.2 | 18 Aug 2026 | No |
| **Themis** | Free, closed source | **No** — tops out at 1.21.11 | 14 Dec 2025 | No |
| **NoCheatPlus** | Free, GPL-3.0 | **No** — 1.5 to 1.21 | 29 May 2026 | No |
| **AAC / Advanced AntiCheat** | — | **Discontinued** | — | — |

**Grim** is the default recommendation for most servers: free, open source under GPL-3.0, running on Bukkit, Paper, Purpur, Folia and Fabric, with over 600,000 downloads on Modrinth. Two things about it trip people up. Its **GitHub releases page is misleadingly stale** — the newest release there is from March 2026 and lists 1.21.11 as its ceiling — while the live distribution channel is Modrinth, where the current build was published today and supports 26.2. And **almost every Grim build is on the alpha channel**: 726 of its 736 published versions. "Alpha" there means "the current build", not "an experimental branch to avoid". A paid Grim Premium has been discussed for years; the project's own FAQ still says it *"is not currently available for purchase."*

**Vulcan** is the usual paid alternative, a one-off $19.99, with 26.2 in its tested versions. It **requires PacketEvents installed alongside it** and does not bundle it — that missing dependency is the commonest reason a fresh Vulcan install appears to do nothing.

**Spartan** is sold direct at €21.99. There is a free build, but read its terms rather than assuming: it is badged for servers of five players or fewer, and its detections run for two hours per server start. Topping that up is not a console command: you run `/spartan charge` and click items in an inventory menu, and each click buys five seconds.

**Matrix** is the cheapest paid option here — $22 for a lifetime licence on BuiltByBit, with a $129 tier for larger networks and a $15-a-month cloud add-on — and it is the one most round-ups leave out, because its own paperwork is misleading. Both the store listing and the vendor's documentation still name **1.21** as the newest version supported, and the listing's "updated" field reads April 2025. Neither is current: builds ship from the vendor's own panel rather than being re-uploaded to the store, and the project's public issue tracker shows 7.24.x running on 26.2 servers through July and August 2026 — one report is filed against Matrix 7.24.3 on a Paper 26.2 build. Confirm the build with the vendor rather than trusting the listing. One thing it does not do, despite a store tagline advertising GeyserMC support: its own Q&A says *"Can it detect bedrock players? No, it can't. Matrix just ignores bedrock players."*

**Intave** is the notable change since most guides were written. It was a subscription anti-cheat until April 2026, when it was republished source-available under the PolyForm Perimeter licence — free to use, including commercially, but not to resell. The repository is genuinely active. Two caveats: it declares no Folia support, and "free" is not the whole story — the vendor still sells paid tiers priced per player-hour, the free tier is listed without combat-automation or build-automation detection, and its own pricing page notes that some detections require an active internet connection.

> [!CAUTION] Two names you will still be told to install
> **AAC (Advanced AntiCheat)** is discontinued by its author's own statement — the project's issue tracker opens with the heading *"Konsolas has stopped working on AAC"*, and its store listing is gone.
>
> **NoCheatPlus** is the other. The original stopped in 2021. A community fork still receives commits, but it has published no release since 2020, and its own build server labels the output *"For testing purposes. Do not use in a live server!"* Those are the maintainers' words, not ours. It supports 1.5 to 1.21 and does not know about 26.x.

**Three more names you will run into, and what is actually wrong with each.** **Polar** is a real, running SaaS with a live status page, but its own documentation caps server support at **26.1.x**, and you cannot simply buy it: it requires a legally registered business where applicable, an established playerbase, a working website and social presence, and an evaluation over Discord, and the vendor reserves the right to refuse any server. **Verus** publishes prices ($60, $125 and $200 lifetime) on a site whose footer still reads © 2021, and its own front page says it runs on "any server version between 1.7 and 1.20.1" — five majors behind. **Karhu** is simply gone: the domain still resolves but nothing answers on either port, and the last archived copy of the site, from April 2026, is a registrar placeholder reading *"It has expired and is currently for sale at auction."*

One more trap when you go looking yourself: **a "Bedrock-only" anti-cheat protects nobody on the Java side.** Searching "anticheat" on Modrinth returns 82 projects, seven of which mention Bedrock or Geyser — but only two of those, Boar and AstroX, are Geyser extensions, which run inside Geyser and see Bedrock players only. Boar's own page warns in capitals that it is *"ONLY FOR BEDROCK PLAYER NOT JAVA PLAYER"* and that you must pair it with a Java anti-cheat. A third, Penguin AntiCheat LITE, is an ordinary Paper plugin rather than a Geyser extension but has the same hole — *"It does NOT detect any java players"* — and is no longer updated. The other four are ordinary Java anti-cheats that have added Bedrock handling, Spartan among them, and they protect Java players normally. Read the description before you count one as coverage. On SpigotMC the trap does not arise at all: none of the 239 results there is Bedrock-only.

### Running one without making the server worse

Anti-cheats sit in the packet path for every player, so they are not free. Install it with nothing else changing and compare MSPT before and after, using the method in [Diagnosing Minecraft Server Lag](/knowledge-base/minecraft/diagnosing-lag-and-low-tps/). Then start in **log-only mode** — every anti-cheat worth using can alert without punishing — and read what it flags for a week. You want to discover that your PvP regulars trip it before you discover it by banning one.

Compatibility is the other half. Anything that manipulates movement or combat — custom knockback, elytra boosters, grappling hooks, mcMMO-style abilities, magic and bending plugins — produces flags on players doing nothing wrong, and so do ViaVersion clients on a different protocol and Bedrock players arriving through [Geyser](/knowledge-base/minecraft/geyser-crossplay/), whose input model genuinely differs. Most anti-cheats ship exemptions for all of these. Find them before you turn punishments on.

## Repeat Offenders

Detection is the easy half. The awkward half is that a banned account costs roughly the price of a new one.

Your ban list is keyed on UUID, so a ban stops that account and nothing else. The vanilla tools and their limits — including that `/ban-ip` cannot ban an IPv6 address at all, and cannot look up an offline player's last address — are in [Minecraft Whitelist and Ban Management](/knowledge-base/minecraft/whitelist-and-ban-management/), along with temporary bans, which vanilla can store but has no command to set.

**The whitelist is the strongest control you have.** It is not sophisticated and it is not exciting, and it ends the alt-account problem completely: a new account is not on the list. Every server that grows past its friend group rediscovers this. If cheating is persistent and moderation time is not free, whitelisting is the thing that actually works, and the cost is an application process.

**Keep evidence, not impressions.** Before you act, save the anti-cheat's violation log with check names and timestamps, a CoreProtect lookup per [Minecraft Grief Protection and Rollback](/knowledge-base/minecraft/grief-protection-and-rollback/), and the `logs/latest.log` lines around the incident. Two independent sources beat one strong one: an anti-cheat flag *and* an ore ratio twelve times your median is a decision you can defend. Either alone is a coin flip.

## The Limits, Honestly

**No anti-cheat catches everything.** The server sees packets. A well-written cheat sends packets that are individually legal and only suspicious in aggregate — a statistical judgement, and statistical judgements have error rates in both directions. PaperMC says the same of its own anti-xray: *"it is not by any means infallible."* That is the honest ceiling for all of it.

**Aggressive settings cost you real players.** This is the failure mode nobody plans for. Turn the sensitivity up and the extra flags are not extra cheaters — they are your regulars on bad connections, your Bedrock players, and everyone who was in a boat during a lag spike. A player kicked once for something they did not do tells their friends; a player kicked twice does not come back. A false positive costs far more than a false negative, because the cheater will be caught next week and the honest player will not return.

**So split the thresholds.** Alerts to staff at a low threshold, automatic action only at a high one, is the arrangement most servers converge on: a human looking at a flagged clip catches things no threshold does, and never bans anyone for lag.

**It is an arms race with a schedule.** Cheat clients update against the popular anti-cheats specifically. Whatever you install will be bypassed by something, so the real commitment is keeping it current — which is why the maintenance check above matters more than which project you picked. On a small server, a whitelist and players who know each other will stop more cheating than any plugin, with no false positives at all.

## Common Issues

- **Anti-xray is on and I can still see ores.** Test from a non-op account; operators bypass it. Then check `max-block-height` against where the ore actually generates, and check `hidden-blocks` includes the `deepslate_` variants.
- **I changed the anti-xray config and nothing happened.** You reloaded instead of restarting. Paper requires a full restart and explicitly says not to use `/reload`.
- **Anti-xray does not work below y=0.** Almost always a config carried over from before 1.18, missing `deepslate` in `replacement-blocks`. Compare it against a freshly generated file.
- **The console is full of `moved too quickly!`.** That is the vanilla desync guard rubber-banding someone, usually a lag spike or a vehicle, not a cheater. Investigate the lag rather than the player.
- **The anti-cheat flags my whole PvP team.** A movement or combat plugin is fighting it. Use the anti-cheat's exemption list rather than lowering thresholds globally.
- **Bedrock players get kicked constantly.** Geyser players send a different input model; find the Geyser or Floodgate exemption. See [Setting up CrossPlay for Minecraft](/knowledge-base/minecraft/geyser-crossplay/).
- **The anti-cheat will not load after a version update.** It is built per Minecraft version; check its download page for a build listing your version.

## FAQ

### How do I stop x-ray on my Minecraft server?

Turn on Paper's built-in anti-xray in `config/paper-world-defaults.yml` under `anticheat.anti-xray`, start with `engine-mode: 1`, add per-dimension settings for the Nether, and restart the server fully. It stops the overwhelming majority of casual x-ray, and Paper is clear that it is not infallible.

### What is the best Minecraft anti-cheat right now?

For most servers, Grim: free, open source, actively developed, and running on Paper, Purpur, Folia and Fabric. Vulcan is the usual paid alternative. Whichever you pick, open its own download page and confirm there is a build listing your Minecraft version before you install.

### Is NoCheatPlus still usable, and what happened to AAC?

NoCheatPlus's maintained fork still gets commits, but it has published no release since 2020, its own build server labels the output as not for live servers, and it supports 1.5 to 1.21 rather than the current 26.x. AAC is discontinued outright — its author's issue tracker states he has stopped working on it, and the store listing is gone. Both are still recommended in a lot of old guides.

### Will an anti-cheat stop x-ray as well?

Partly, and differently. Anti-cheats detect the *behaviour* — mining straight to ore — while Paper's anti-xray removes the *information*, so they complement each other. Paper's own docs name an anti-cheat as the mitigation for the range-extension bypass obfuscation cannot close.

## What to Read Next

- [Minecraft Whitelist and Ban Management](/knowledge-base/minecraft/whitelist-and-ban-management/) for the whitelist, the ban lists, the UUID trap and temporary bans
- [Minecraft Grief Protection and Rollback](/knowledge-base/minecraft/grief-protection-and-rollback/) for CoreProtect lookups, rollbacks and WorldGuard regions
- [Minecraft server.properties: The Complete Reference](/knowledge-base/minecraft/server-properties-reference/) for `online-mode`, `enforce-secure-profile` and every other key
- [Diagnosing Minecraft Server Lag](/knowledge-base/minecraft/diagnosing-lag-and-low-tps/) for measuring what an anti-cheat costs you
- [How to install plugins for Minecraft Java Edition](/knowledge-base/minecraft/java-plugins/) for installing any of the plugins above
- [Minecraft Scheduled Restarts and Server Automation](/knowledge-base/minecraft/scheduled-restarts-and-automation/) for the restart you now need after every anti-xray config change

---

Made with 💜 by GameServerKings