An anticheat is not a shield: how to build layered protection

Every week we see the same question in Discord servers: "which anticheat catches mod menu X?" Understandable, but it's the wrong question. Most of the damage on FiveM servers, from spawned money to duped items, isn't done by brilliant cheats. It's done by server events that blindly trust the client.

Layer 1 — Never trust the client

Anything that comes from the client can be manipulated. An injector can trigger any event with any value. This is the classic hole:

-- WRONG: the client decides the price
RegisterNetEvent('shop:buy', function(item, price)
  local src = source
  Framework.RemoveMoney(src, price)   -- price = -50000? Free money.
  Framework.AddItem(src, item, 1)     -- item = 'weapon_rpg'? Here you go.
end)

And this is how it should look: prices on the server, a distance check, a rate limit and logging.

-- RIGHT: the server is in charge
local PRICES = { water = 5, bread = 8 }
local SHOP = vector3(25.7, -1347.3, 29.5)
local lastBuy = {}

RegisterNetEvent('shop:buy', function(item)
  local src = source
  local price = PRICES[item]
  if not price then return end -- unknown item: ignore (and log it)

  local now = GetGameTimer()
  if lastBuy[src] and now - lastBuy[src] < 500 then return end
  lastBuy[src] = now

  local ped = GetPlayerPed(src)
  if #(GetEntityCoords(ped) - SHOP) > 5.0 then
    return print(('[shop] %s tried to buy from a distance'):format(src))
  end

  if Framework.RemoveMoney(src, price) then
    Framework.AddItem(src, item, 1)
  end
end)

AddEventHandler('playerDropped', function()
  lastBuy[source] = nil
end)

Layer 2 — Clean resources only

Leaked or "nulled" scripts regularly contain backdoors. A backdoor gets past every anticheat, because it simply runs as your own code. Buy from the creator, use open source from repositories you know, and read what you install.

Layer 3 — An allowlist

An application or a Discord check keeps most throwaway accounts out. Since the May client update, the server list even shows a padlock next to servers with an allowlist (sv_appearAllowlisted).

Layer 4 — Staff tools

txAdmin plus a good in-game admin menu, so your team can act on reports quickly. Keep permissions tight: not every moderator needs noclip.

Layer 5 — Logging

Log economy actions (large transactions, item spawns) and admin actions. You won't catch everything as it happens, but you can look back afterwards, and roll things back.

Layer 6 — Only then, the anticheat

A good anticheat catches mod menus, aimbots and injectors, and gives your staff evidence. Which one suits you? Read our anticheat reviews. And remember: DDoS protection isn't your anticheat's job. That's up to your host.