Minecraft anticheat guide

Anticheat Symptom Triage After a Major Minecraft Update

A symptom-first checklist for anticheat problems after a major Minecraft update, covering startup errors, alert spikes, client splits, lag, and rollback.

Updated 2026-11-07 · ~5 min read

minecraft update anticheat problemsanticheat alerts after updateminecraft update anticheat triagepaper update anticheat errorsanticheat false flags after minecraft update

Short answer: triage in a fixed order

After a major Minecraft update, check anticheat symptoms in this order: startup errors, plugin version mismatch, a spike in one alert type, alerts tied to new items or mechanics, and performance changes. Match each symptom to its likely cause, confirm it in the logs, and roll back only the part the logs point to. Pre-update staging is covered in the update staging checklist.

Start with the symptom, not the fix

Post-update problems often look the same from the player side: alerts, kicks, or lag. The cause can be a plugin that does not match the new server build, a new mechanic that a check does not expect, or a translation layer that changed client behavior. Read the symptom first, then choose the first check.

The table maps common symptoms to the first place to look. Use it to decide the order of your checks, not as a list of confirmed causes.

Keep one note per symptom, even when the first check solves it. Two symptoms can share a cause, and a short note makes that link visible at the next update.

First checks for common post-update anticheat symptoms.
Symptom	Likely area	First check
Anticheat does not enable	Plugin or library version mismatch	Startup log and plugin versions against the new build
One check spikes	New mechanic or changed default	Alert timestamps and the items in use at those times
Alerts from Bedrock players only	Translation layer version	Geyser and Floodgate versions in the log
Lag after the update	Anticheat cost or unrelated server load	Profiler output for the same window
Alerts from one client version only	Client or translation split	Alert count grouped by client version

Post-update triage procedure

Work through the steps in order. Stop at the first step that explains the symptom, but still record the later steps you skipped and why.

Read the startup log for errors from the anticheat, its packet library, and any hook plugin. Use the PacketEvents startup guide if the error mentions a packet library.
Confirm each plugin has a release that supports the new server build. Read its release notes before you assume a bug.
Compare alert counts per check for the same time window before and after the update. Adjust for player count, because a busier hour can look like a spike.
Check whether alerts cluster around new items or mechanics. Use the mace and wind charge article or the riptide and elytra article for the matching checks.
Check server performance with your profiler for the same window. Use the Spark and timings guide if lag appears with the alerts.
Group alerts by client version and by Bedrock or Java. A split by client points to translation or client support, not to the update itself.

Stop when no step explains the symptom

If no step explains the symptom, stop changing settings. Changing several settings at once makes the original cause harder to find. Collect logs for the same window, attach the incident note, and ask the plugin's developer or your server community for help with the logs as evidence.

Roll back only the part the logs point to

Rollback is the last step, not the first. If the logs point to one plugin, restore that plugin's previous jar from your backup and leave the rest of the server on the new build. Do not roll back the Minecraft version to fix an anticheat problem unless the anticheat's documentation says its builds support the older version.

Keep the previous jar and its configuration until the alert counts return to the expected range for at least one full peak period. Then remove the old files.

Incident note template. Fill one note for each symptom.

Date and time: <timestamp>
Symptom: <what staff or players saw>
Minecraft build before and after: <build> -> <build>
Plugin versions changed: <name and version>
Alert counts before and after, same window: <numbers>
Cause found in logs: <yes or no, and the log line>
Action taken: <restore, configure, or wait>
Checked by: <role>

What we have not verified

This article does not list which checks changed in any specific Minecraft release, and it does not say how any anticheat responds to a given update. Read the release notes for your Minecraft version, and the release notes of each plugin. The triage order above is a process, and it does not predict which symptom you will see.

FAQ

How long should we watch alerts after an update?

Watch at least one full peak period, and longer if your players are spread across time zones. Compare the same weekday and hour range from earlier weeks, so the comparison is fair.

Our alerts doubled after the update. Should we ban less?

Not by default. First split the alerts by check, client version, and item. A doubled count from one client version points to a different cause than a doubled count across every player.

Can we roll back Minecraft without rolling back the anticheat?

Usually only if the anticheat's current build still supports the older server build. Check the supported-version list in its documentation, then restore the matching jar if you need to.

Who should own the post-update review?

Name one staff member who reads the logs and one admin who can change plugin versions. Record both names in your handover notes, so the next update has a clear owner.