HackDetector works out what a player is running. It does not watch how players move, aim or click; that is what a movement anti-cheat (GrimAC, Vulcan and others) does. The two work well together, and HackDetector can read their flags and tell staff when both agree.
Features
- Five independent detection methods: client brand, plugin channels, data packs, translations and key bindings, and resource-pack replies
- Nobody is punished on one hint: a mod has to be identified by at least 2 different methods before anything happens
- 31 cheat clients are kicked on sight, and 11 more mods (minimaps, fullbright and similar) are reported to staff instead
/hdcontrol panel: detected, suspicious and online players, profiles with all evidence, staff log and stats- Kick, tempban, warn and false-positive buttons right on a player's profile
- Bans go to LiteBans, AdvancedBan or VexCore when one is installed
- Discord webhooks per type, with a role ping on confirmed cheats
- New cheat-client signatures arrive from our licence server every 6 hours, with no jar update needed
- Bedrock players (Floodgate): device, input and account checks for the review queue
- Messages in English, Spanish, German, French, Portuguese and Russian
Requirements
- Paper 1.21.11 or Folia, Java 21
- PacketEvents 2.14 or newer, installed as its own plugin
- Optional: PlaceholderAPI, Floodgate/Geyser, LiteBans or AdvancedBan
Install
- Install PacketEvents first, then put
HackDetector-1.0.jarinpluginsand start the server once. - Open
plugins/HackDetector/config.ymland put your licence key inlicense.key(see Getting started). Leaveserverandsecretas they are. - Restart the server and run
/hd selftest. It checks the licence, PacketEvents, signatures, your ban plugin, Discord and PlaceholderAPI. - Give your staff
hackdetector.notifyso they see alerts, then type/hdin game.
Cheaters are punished by default. For your first day you can watch alerts only: set punish-cheaters: false in config.yml or run /hd enforcement alerts-only.
Commands
/hd is short for /hackdetector. Typing /hd in game opens the control panel, where everything below is also a button.
| Command | What it does | Permission |
|---|---|---|
/hd | Control panel | hackdetector.gui |
/hd view <player> | A player's profile: what they run and the evidence | hackdetector.gui |
/hd info <player> | The verdict and every piece of evidence in chat | hackdetector.use |
/hd list | Online players and their verdicts | hackdetector.use |
/hd recent [page] | Latest detections; click one to open it | hackdetector.use |
/hd history <player> | Every detection on a player, online or offline | hackdetector.use |
/hd clients | Every blocked client and mod | hackdetector.use |
/hd alerts [sounds] | Mute or unmute alerts (or just the sound) for yourself | hackdetector.use |
/hd probes | Which detection methods are producing evidence | hackdetector.use |
/hd env | Server, plugins, anti-cheats and hook status | hackdetector.use |
/hd selftest | Checks the whole setup | hackdetector.use |
/hd enforcement [alerts-only|enforce] | Show or switch punishing on and off | hackdetector.admin to change |
/hd learn | Block every mod jar placed in the learn folder | hackdetector.admin |
/hd suggest | Write a tuning report | hackdetector.admin |
/hd reload | Reload every file | hackdetector.admin |
/hacksdetected [page] | Menu of players that were detected and acted on | hackdetector.gui |
/hackssus [page] | Menu of suspicious players that were never acted on | hackdetector.gui |
Permissions
| Permission | Default | What it allows |
|---|---|---|
hackdetector.use | op | Use /hd |
hackdetector.notify | op | See detection alerts |
hackdetector.gui | op | Open the review menus (includes hackdetector.use) |
hackdetector.punish | op | Kick, tempban, warn, clear strikes and false-positive buttons |
hackdetector.admin | op | Change enforcement, reload, learn mods, tuning reports |
hackdetector.bypass | nobody | Never punished (still detected and logged) |
Configuration
config.yml is only a few lines: your licence, punish-cheaters, repeat-offender bans, the kick message and a Discord webhook. Every other setting is listed, with what it does, in reference.yml. To change one, copy its line into config.yml.
| File | What it holds |
|---|---|
config.yml | The settings most servers change |
blockedcontrol.yml | Which mods are kicked, alerted or off, plus your own blocked mods |
messages.yml | Every message, alert, sound and kick screen |
lang/ | The same messages in other languages |
gui/ | Every menu: titles, items, slots, lore and sounds |
reference.yml | Every advanced setting, explained (rewritten on each start) |
To block a mod that isn't on the list, put its jar in the learn folder and run /hd learn. The jar is read, never run.
Discord and placeholders
- Put a webhook URL in
discord-webhook, or give each type its own channel underwebhook.urlsinreference.yml. - PlaceholderAPI:
%hackdetector_client%,%hackdetector_status%,%hackdetector_strikes%.
Good to know
Treat a detection as strong evidence, not proof. Everything a client sends can be faked or held back, and a client built to leave no trace looks like a plain Fabric install. That is why HackDetector waits for two independent methods, and why pairing it with a movement anti-cheat gives the best coverage.
Bedrock players can't be checked for mods (a Bedrock client has none), so HackDetector never kicks them. It reports impossible device data to the review queue instead.