Detecting cheaters on your FiveM server: how to spot them and what actually works against them

Every public FiveM server gets visits from cheaters, usually on the first evening. That is not a matter of luck but of reach: servers are in the list, mod menus are freely available, and whoever has one tries it everywhere. The question is not whether they come but whether your server believes them. This article explains what cheaters do, how you notice and why only server-side checks make a difference.

What a mod menu can do

A mod menu is a program loaded into the player's client that sends commands to the game there as if they came from a script. The usual functions: give money and items, spawn vehicles and weapons, teleport, become invulnerable, throw other players into the air, blow them up or put them into vehicles, read scripts and trigger their events. The last point is the most dangerous: a menu that has found the event "give player X 10,000 euros" can call it as often as it likes if the server does not check whether the call is plausible.

How to spot cheaters

• Money from nowhere: an account jumps by amounts no job and no sale explains. Your bank's ledger shows it, if there is one.
• Vehicles without plates or with models the dealership does not sell, often several within seconds.
• Teleport: a player is in the log at two places within one second, or inside a building that has no door.
• Explosions and flying players with no weapon or vehicle nearby.
• Invulnerability: a player takes no damage in a firefight although hits are registered.
• Events with wrong values: a sale event with a negative quantity, an inventory event from a player who is not even at the storage.

Why client-side checks are useless

Many anti-cheats check in the client: is a mod menu loaded, does the player have god mode on, is their speed too high. The problem: the client belongs to the player. Anyone who can load a mod menu can also switch off the anti-cheat, feed it false values or suppress its reports. Every client-side check is a request, not a control. It catches the inexperienced and is a guide for everyone else on what to bypass.

What actually helps: decisions on the server

The server belongs to you. Everything decided there cannot be faked by the player. That is why every rule belongs on the server: a player receives money because the server knows they finished a job, not because the client claims so. A vehicle appears because the server booked the purchase. A weapon sits in the inventory because the server put it there. Scripts that do it the other way round, believing the client, are the entry point no matter how good the anti-cheat is.

A server-side anti-cheat then does two things. First, it checks every event for plausibility: can this player have this money, this weapon, this vehicle at this spot? Are they really at the storage they are taking something from? Second, it watches what happens on the server: entities appearing without a script, explosions without a cause, positions changing faster than a vehicle drives. Anything suspicious lands in the admin menu with evidence, and the team decides. Automatic bans on every suspicion hit the wrong people too often, for instance a player with a bad connection whose position jumps.

Bans that stick

FiveM knows several identifiers per player: the Cfx.re licence, Steam, Discord, the hardware ID. txAdmin bans all it sees by default. A new licence is quickly created, new hardware is not. So whoever bans should always lock all identifiers plus the Discord account the whitelist runs through. And: bans with reason and evidence into the log. A year later nobody remembers why player 4711 was banned.

Checklist for the first evening

1. Anti-cheat on before the server enters the list. Not on day two.
2. Whitelist via Discord, even on an open server: whoever gets banned loses their Discord access too.
3. At least two admins online who know the admin menu and where the reports land.
4. Logs for money, inventory and vehicles active, with timestamp and player. Without a log there is no evidence.
5. Database backup before opening. If a cheater has handed out money, the previous state is the only rescue.
6. Check scripts that believe the client: every event called "give me X" that does not verify server-side whether X is allowed is a hole.

Sentinel at 5MCustoms

Sentinel is our anti-cheat and part of every licence. It works by the principle above: decisions on the server, plausibility instead of suspicion, evidence in the admin menu instead of automatic bans. Because all modules come from us, Sentinel knows their events and what values are normal: how much money a job pays, where a storage stands, which weapons the police armoury hands out. A third-party script cannot surprise it because it is not allowed to talk to the core directly. What Sentinel does not replace: admins who pay attention. It just means they do not have to pay attention all night.

Justin Beil

Founder of 5MCustoms

Justin has been building FiveM servers, vehicles and scripts for years. 5MCustoms is the framework that grew out of it. What you read here comes from practice, not from a product sheet.

Discord