How to Set Up Anti-Cheat on Your Minecraft Server

Why Your Server Needs Anti-Cheat

Cheating in Minecraft is pervasive. Hacked clients are freely available, easy to install, and give users abilities like fly hacking, speed hacking, killaura (auto-attacking nearby players), reach (hitting from farther than normal), x-ray (seeing through blocks to find ores and bases), and auto-clicking. On a server without anti-cheat, a single cheater ruins the experience for dozens of legitimate players. PvP becomes pointless when someone has killaura. Economy loses meaning when someone x-rays to diamond veins. Builders lose motivation when someone flies into their base and griefs it.

No anti-cheat is perfect. The arms race between cheat developers and anti-cheat developers is ongoing. But a properly configured anti-cheat catches 90%+ of casual cheaters and makes blatant hacking impractical. That alone transforms the server experience.

Plugin Comparison

Feature	Vulcan	Grim	Matrix	Spartan
Price	Premium ($20)	Free (open source)	Premium ($15)	Premium ($25)
Detection quality	Excellent	Very good	Good	Moderate
False positive rate	Low (well tuned)	Low	Moderate	Moderate-High
Performance impact	Low	Very low	Low	Moderate
Active development	Yes	Yes	Yes	Sporadic
Bedrock (Geyser) support	Needs exemptions	Built-in exemptions	Needs exemptions	Needs exemptions
1.8 PvP support	Yes	Yes	Yes	Yes
Prediction engine	Server-side	Full client prediction	Server-side	Server-side

Vulcan

Vulcan is widely considered the best premium anti-cheat for Minecraft servers. It has excellent detection for movement cheats (fly, speed, phase, nofall), combat cheats (killaura, reach, autoclicker), and packet-based exploits. Its false positive rate is low out of the box, and the config allows granular tuning. Vulcan costs around $20 on SpigotMC, which is cheap insurance for any serious server. It works on 1.7 through 1.21+.

Grim (GrimAC)

Grim is a free, open-source anti-cheat that takes a fundamentally different approach. Instead of checking individual hack signatures, Grim runs a full client prediction engine on the server side. It predicts where the player should be based on inputs and physics, then flags deviations. This makes it very effective against custom or private cheats that signature-based systems miss. Grim has built-in Geyser/Floodgate awareness, which is a major advantage for crossplay servers.

Matrix

Matrix is a solid mid-tier option. It catches common cheats reliably and has a reasonable price point. Its detection quality has improved significantly in recent versions, but it tends to generate more false positives than Vulcan or Grim in certain scenarios (high-latency players, specific movement patterns). Good for smaller servers that want decent protection without extensive tuning.

Spartan

Spartan has been around for a long time and has a large installed base, but its detection quality has fallen behind Vulcan and Grim. It generates frequent false positives, especially in modern Minecraft versions. It is listed here for completeness, but for new server setups, Vulcan or Grim are better choices.

Installation and Basic Configuration

Installation is standard for all options: drop the jar into /plugins and restart. The plugin generates its config files on first run. For Vulcan:

/plugins/Vulcan/config.yml   <-- main settings
/plugins/Vulcan/checks.yml   <-- individual check tuning

Start with the default configuration. Do not immediately tighten all checks to maximum sensitivity. Run the anti-cheat in "alert only" mode for the first few days, it logs violations to staff chat but does not kick or ban players. This lets you observe detection patterns, identify false positives, and understand how the plugin behaves with your server's specific lag characteristics and plugin set.

Tuning and False Positives

False positives are the biggest challenge with any anti-cheat. Legitimate players getting flagged, or worse, kicked, destroys trust faster than actual cheaters do. Common causes of false positives:

• High latency: Players with 200+ ms ping trigger movement checks because the server sees delayed position updates. Lower the sensitivity of speed and fly checks for high-ping players, or set a ping threshold above which checks become more lenient.
• Plugin interactions: Abilities from custom plugins (double jump, grappling hooks, custom enchantments with knockback) can trigger fly and velocity checks. Whitelist these plugins in the anti-cheat config or add bypass permissions for specific checks.
• Server lag: TPS drops cause the anti-cheat's timing assumptions to break. Most quality anti-cheats automatically reduce sensitivity during lag. Verify this setting is enabled.
• Elytra and tridents: Elytra flight and riptide tridents create rapid movement that some checks flag. Make sure your anti-cheat version supports these mechanics, older configs may not account for them.

When you receive false positive reports from trusted players, check the anti-cheat's violation log, reproduce the scenario if possible, and adjust the specific check that triggered. Never dismiss a false positive report, one unfair kick does more reputation damage than a cheater who gets caught an hour late.

Bedrock Player Exceptions

If your server supports Bedrock crossplay via Geyser, Bedrock players will trigger false positives constantly. Bedrock's movement physics, combat timing, and packet behavior differ from Java. A Bedrock player's normal gameplay looks like cheating to a Java-focused anti-cheat.

Grim handles this natively, it detects Floodgate-authenticated players and applies separate check profiles. For Vulcan and Matrix, add Bedrock player exemptions:

• Give Bedrock players a permission node that bypasses specific checks (e.g., vulcan.bypass.movement).
• In LuckPerms, create a group for Bedrock players and assign bypass permissions to that group.
• Use Floodgate's built-in group assignment to automatically add Bedrock players to this group on join.

This reduces protection for Bedrock players, which is an accepted trade-off. Bedrock hacked clients exist but are far less common and less capable than Java hacked clients.

Combining Anti-Cheat with Staff Monitoring

Anti-cheat plugins are a tool, not a replacement for active moderation. Train your staff to recognize cheating behaviors: snapping aim (killaura), impossible reach distances, moving too fast, or finding hidden bases suspiciously quickly. Plugins like Vulcan send staff alerts in chat, teach moderators to act on these alerts by spectating the flagged player (use vanish and spectator mode) before punishing.

Consider a screen-sharing policy for competitive servers (Factions, PvP). When a player is suspected of cheating and anti-cheat flags are ambiguous, a staff member can request a Discord screen share to verify. This is standard practice in the competitive Minecraft community and catches sophisticated cheaters that bypass anti-cheat software.

Performance Impact

Anti-cheat plugins process every player's movement packets, which means they add CPU overhead per online player. On a well-optimized server (see our optimization guide), the impact is typically 2-5% CPU increase. Grim is particularly lightweight because its prediction engine is efficient. Vulcan is similarly lean. Avoid running two anti-cheat plugins simultaneously, they conflict with each other and double the performance cost without improving detection.

Need a server for this? Astroworld Hosting offers NVMe SSD, Pterodactyl panel, and DDoS protection on every plan. See features , plans from €6.39/mo.