Anticheat starts in your server.cfg: the convars to set today

A paid anticheat is no substitute for a properly configured server. Many of the best-known cheats can be stopped with a few lines in your server.cfg. A popular guide by wjuton on the Cfx.re forum (viewed more than 17,000 times) lists them. We explain what each setting does and what to watch out for.

1. Turn off networked sounds

Cheaters who blast sirens or loud sounds across the entire server abuse the PlaySoundFrom* natives. One line turns that off. Legitimate use stops working too, but most scripts play audio through NUI anyway.

sv_enableNetworkedSounds false

2. Filter control requests

sv_filterRequestControl decides whether clients may take control of entities owned by other players. It stops cheaters from making someone else's car fly or deleting it.

• 0: off
• 1: blocks requests on occupied vehicles that have existed longer than the settle timer (30 seconds by default)
• 2: blocks requests on all entities controlled by players (also the default)
• 3: like 2, plus "settled" entities that don't belong to players
• 4: never forwards REQUEST_CONTROL_EVENT at all

The guide's author recommends 4. We'd start with 2 or 3 and only go further once you know your scripts can handle it.

sv_filterRequestControl 3

3. Entity lockdown

This decides whether clients may create entities themselves: inactive (anything goes), relaxed (entities created by client-side scripts are blocked) or strict (the client can't create anything). strict breaks a lot of existing scripts, so relaxed is a good place to start.

sv_entityLockdown relaxed

4. Sanitization convars

FiveM has a few game_ convars that add extra checks to game mechanics cheaters like to abuse:

# against forced ragdolls
setr game_sanitizeRagdollEvents true
# no attaching vehicles or objects to players
setr game_sanitizePlayerAttachment 2
sv_enableNetworkedScriptEntityStates false

There's also the optional game_enableVehicleHijackFix. It stops players from hijacking other players' cars, but it also means nobody can pull a driver out of a car with F. On a roleplay server, that's often too big a change.

5. Block dangerous game events

Several old GTA V network events were never designed with security in mind. Cheaters use them to give or take weapons. Block them like this:

block_net_game_event "GIVE_PICKUP_REWARDS_EVENT"
block_net_game_event "NETWORK_GIVE_PICKUP_REWARDS_EVENT"
block_net_game_event "REMOVE_ALL_WEAPONS_EVENT"
block_net_game_event "NETWORK_PICKUP_CARRIABLE_EVENT"
block_net_game_event "REQUEST_MAP_PICKUP_EVENT"
block_net_game_event "REQUEST_PICKUP_EVENT"
block_net_game_event "REMOVE_WEAPON_EVENT"

6. Pure mode (only if your community accepts it)

sv_pureLevel 1 blocks modified client files, except audio and known graphics mods. sv_pureLevel 2 blocks everything. Among other things, this stops modified RPFs that crash other players. It also means players have to give up their own mods.

What convars don't fix

Config is your first line of defence, not your last. The most important rule is still: never trust the client. Always check amounts, items and distances on the server. Limit how often sensitive events can be triggered per second, and log everything that involves money. We compare anticheats that build on this foundation in our anticheat reviews.