Minecraft anticheat guide

Minecraft Anticheat Terms Glossary for Server Admins

Plain definitions of core Minecraft anticheat terms, including check, violation level, alert, mitigation, and ban wave, with the log and config names.

Updated 2026-11-07 · ~6 min read

minecraft anticheat termsanticheat glossaryviolation level meaningminecraft anticheat alert termsFairPlay checks glossary

What do the core Minecraft anticheat terms mean?

Core anticheat terms describe how a detection is recorded, shown to staff, and acted on. A check is one detection rule, a violation is one failed check, and a punishment is the action taken once violations build up. The table defines each term in one or two sentences and names where it appears in FairPlay files or alerts.

Core anticheat terms, plain definitions, and where to find them.
Term	Plain definition	What you will see in logs or config
Check	One detection rule that looks for a specific pattern. FairPlay documents 169 checks, grouped by category.	A check name in the alert text, which you can look up in the checks reference.
Violation (VL)	One recorded failure of a check. Violation level is the running count for one player and one check.	A VL value in staff alerts and in the threshold settings of webhook.yml.
Violation expiration window	The time after which an old violation stops counting toward a player's level. The documented default is 10,000 ms.	A millisecond window value in punishments.yml.
Alert	A message sent to online staff who have the notify permission when a check fails.	A staff message that names the player and the check.
Alert cooldown	The minimum delay before staff see another alert for the same player and check. The default is 1,000 ms. Violations still count while alerts are suppressed.	alert-cooldown-ms, set in milliseconds.
Target filter	A per-viewer setting that hides alerts for chosen players, so one staff member can focus on others.	The alertsTarget value saved for a staff viewer.
Mitigation	An action FairPlay can take on a failed check to limit its effect. Mitigations are set per check.	Per-check groups in mitigations.yml.
Punishment	An action taken after violations, such as a kick or a ban, defined as tiers.	Action and tier entries in punishments.yml.
Ban wave	A queued batch of ban actions that staff run with a command. Scheduling is off by default, and the queue holds up to 5,000 players.	The schedule and queue values in banwave.yml, and the /fp banwave run command.
False positive	An alert against a player who did not break a rule. FairPlay's docs do not publish a rate, so measure it yourself.	Found through staff review and appeals. It is not a single log value.

How do you read these terms in a real alert?

Start with one alert line from your own server and trace each part back to a term. The line below uses an illustrative format only. Copy the text your server actually prints, because wording varies by version.

PlayerName identifies the target. If the alert is missing, check the viewer's target filter and alert cooldown before you assume the check did not run.
The check name points to a category in the checks reference, which tells you what kind of behavior was measured.
VL 4 is the running violation level. Compare it with the thresholds you set, such as minimum-vl in webhook.yml if Discord alerts are on.
Violations older than the expiration window stop counting, so a level can fall between two alerts without any action.
Choose a punishment from the tiers in punishments.yml. The level alone does not decide the action.

Illustrative alert line. Replace it with a line from your own console or staff chat.

[FairPlay] PlayerName failed <check name> (VL 4)

Which terms are easy to mix up?

Several terms in this glossary sound alike but control different parts of the system. Use the table to decide which setting you are changing before you edit a file.

Commonly confused anticheat term pairs.
Pair	The difference	Where to check
Violation vs alert	A violation is recorded on each failure. An alert is only the staff message, and the cooldown can suppress it.	The VL in the alert text versus the message itself.
Alert cooldown vs expiration window	The cooldown limits how often staff see messages. The expiration window decides when old violations stop counting.	alert-cooldown-ms and the expiration window in punishments.yml.
Mitigation vs punishment	A mitigation is set per check and limits that check's effect. A punishment is a tiered action taken after violations.	Per-check groups in mitigations.yml versus tiers in punishments.yml.
Kick or ban gate vs punishment tier	A gate is an on or off switch with its own allowlist. A tier picks the action for a given level.	Gate settings in mitigations.yml versus tier entries in punishments.yml.
Ban wave vs single ban	A ban wave is a queued batch run by a command. A single ban acts on one player when a tier reaches that action.	banwave.yml and the /fp banwave run command versus punishment tiers.
Check vs cheat name	A check is a FairPlay detection rule. A cheat name describes what a client does, and one name can relate to several checks.	The checks reference versus the cheat glossary.

How should you use this glossary?

Use the table as a lookup, then confirm each value in the generated file. Cheat names such as KillAura are covered in the cheat glossary.

Copy the exact term from the alert or log line.
Find the matching row in the table and note the file or command named in the last column.
Open the generated file and confirm the value before relying on a default.
Change one setting at a time and record the old and new values.
Review the alert against appeal history before any punishment decision.

What we have not verified

This glossary does not state detection rates, false positive rates, or performance numbers for any term. Test each setting on a staging server before you rely on it in production.

FAQ

Is a violation the same as a ban?

No. A violation is one recorded failure of a check. Kicks or bans follow only when your punishment tiers and enabled gates say so.

Why does one alert appear when a player fails many times?

The alert cooldown suppresses repeat staff messages for the same player and check. Violations still count on every failure, so check the level first.

Does FairPlay publish a false positive rate?

No. The documentation does not publish one. Measure false positives with your own staging tests and appeal records.

What does a ban wave do on my server?

It runs a queued batch of ban actions. Staff need the fairplay.command.banwave permission, scheduling is off by default, and the queue is capped at 5,000 players.

Why does a violation level drop without any punishment?

Old violations expire after the configured window, which defaults to 10,000 ms. Check the window in punishments.yml on your server, since an old count can fall out of the total without any staff action.