Minecraft anticheat guide
Anticheat Vendor Due Diligence: Questions to Ask
Ask an anticheat vendor about ownership, release history, support terms, licence transfer, and data flows before you depend on its plugin on your server.
Short answer
Ask an anticheat vendor who maintains the plugin, how it ships fixes for your server version, how support works, what licence you receive, what data leaves your server, and what happens if the developer stops. Request written answers and date them. These questions judge the vendor as a business and a dependency. They do not measure detection quality, which needs evidence from your own staging tests.
Check ownership and continuity
A plugin with one maintainer depends on that person's time and health. Ask what happens when that changes. A written answer is more useful than a general reassurance.
Read the release record
Past releases show how a vendor handles new Minecraft versions. Compare the support the vendor states with the dates and notes it has published.
| Evidence | Where to look | What to note |
|---|---|---|
| Changelog | Vendor page, listing, or release notes | Dates, Minecraft versions named, and whether fixes are described |
| Supported versions | Vendor documentation or compatibility notes | Exact version range, and whether it is stated as tested or expected |
| Time to support | Dates of the last two Minecraft version releases | Days between a Minecraft release and the vendor's support note |
| Dependencies | Installation documentation | Required libraries, such as PacketEvents where the vendor's docs state it |
| Bug response | Public tracker or support history | Whether reports get replies and whether fixes ship |
Ask about support and response
Write down every response target as a sentence in the vendor's written terms. A target that exists only in a sales chat is hard to enforce.
Ask about licence and transfer
A licence can be tied to a server, a network, or an IP address. Each choice affects what happens when you rebuild a network. Keep a copy of the licence text with the purchase date, so a renewal dispute can be checked against the terms you bought.
Map the data and network calls
Ask what the plugin sends outside your server. Some plugins check licences online, send telemetry, or post alerts to a webhook you configure. Each outbound call is a data flow you must describe to your players and to your own policy.
Record the answers
The record matters more than the first answer. A vendor that answers a question differently a month later has changed its position, and only a dated record shows that.
What this review cannot show
Due diligence does not verify detection quality, performance, or resistance to bypasses. Those need staging evidence on your server. Seller-published listings describe the seller's view. FairPlay's listing is seller-published, so ask FairPlay the same questions as any other vendor, and check its answers against the FairPlay configuration docs. Use the answers to decide which risks you accept, and write those risks into your decision record.
FAQ
Is an older anticheat vendor safer than a newer one?
Age tells you little on its own. Look at the release record, the continuity answers, and whether the vendor kept your server version supported. A long history with no recent updates can be a weaker signal than a short history with clear ownership.
Do we need the source code to judge a vendor?
Not always. Source access helps when your team can review code. Most server owners rely on documentation, the release record, and written terms. Ask for source only if someone on your team can review it.
What if a vendor will not answer in writing?
Record the refusal with the date. Treat the open question as a risk in your decision record, and do not assume the answer is yes.
How often should we repeat the review?
Repeat it before each renewal, after a change of ownership, and after a major Minecraft update that took the vendor a long time to support.