Minecraft anticheat guide
Paper Server Combat Anticheat Checklist
A staging-first checklist for Paper combat protection: legitimate controls, staff permissions, mitigation order, and rollback ownership.
Stage first, then tune against legitimate controls
Paper servers combine fast PvP, plugin-heavy environments, and staff workflows that break under noisy alerts. Before production, stage the exact Paper build with the exact FairPlay and PacketEvents artifacts and run legitimate controls: known-clean fighters across ping bands, teleport and velocity sequences, block-interaction bursts, and inventory-heavy sessions.
A check that flags a control session stays alert-only. Only checks that stay quiet on controls and flag planted abuse graduate to mitigation.
| Control | What it clears | If it flags |
|---|---|---|
| Clean duels across ping bands | Reach, hitbox, click, and rotation false positives | Keep the family alert-only and retune |
| Teleport and velocity sequences | Correction and knockback handling | Review setback and damage paths before enforcement |
| Block bursts and inventory sessions | Scaffold, FastBreak, and inventory noise | Separate observation checks from enforcement checks |
Staff permissions and alert discipline
Gate diagnostics behind the documented nodes: the dispatcher checks fairplay.command before any subcommand, diagnostics such as /fp latency and /fp rotations need their own fairplay.command.latency and fairplay.command.rotations grants, and fairplay.notify scopes who receives violation alerts. Review fairplay.admin child grants before assigning it anywhere broad.
Keep the global alert-cooldown-ms default of 1000 ms in mind: it throttles staff chat, not violation accounting. Document per-decision context — check name, timestamp, ping, measured values, mitigation action, and any hook contribution — so appeals and audits have a record.
Roll back with a named owner
Name one rollback owner before enabling enforcement. That owner holds the pre-change backups of config.yml, punishments.yml, and mitigations.yml, knows the previous artifact versions, and can revert one layer at a time when a check misbehaves in production.
Never assert a startup passed without reading the actual console: confirm both plugins loaded without dependency or class-loading errors from the real log, and preserve the exact log with artifact versions if anything fails to enable.
FAQ
What is the first Paper deployment step?
Stage the exact build with legitimate controls — clean duels, teleports, velocity, block bursts, and inventory sessions — before any enforcement.
Who can roll back a bad tuning change?
A named rollback owner holding pre-change configuration backups and artifact versions, reverting one layer at a time.