Install an anticheat on your FiveM server

Introduction

FiveM is heavily client-modded, so heavily cheated. Without anticheat, your public server is a target for paid menus (Eulen, Stand, Redengine) that wreck gameplay. Cfx.re doesn't provide an official anticheat. The market is dominated by a few community/commercial solutions: FiveMGuard, Wasabi, BoiiAC, etc.

Prerequisites

• A FiveM server at VeryCloud
• Access to Files in Wisp
• License/payment for chosen AC (most are paid)

Step 1: Anticheat types

Commercial ACs combine several approaches.

Step 2: Solutions comparison

2026 recommendation: Wasabi or Adler for serious public servers. BoiiAC or EmZi to start / friend server.

Step 3: Install commercial AC (Wasabi example)

After purchase, you get an encrypted resource folder + a license.

1. Upload wasabi_anticheat/ to /resources/[security]/
2. Edit config.lua with license and params
3. In server.cfg:

# IMPORTANT: load AC first
ensure wasabi_anticheat
ensure oxmysql
ensure ...

Order matters: AC must start before resources it protects.

Step 4: Configure DB (if AC needs)

Most commercial ACs store bans in MySQL. Create dedicated table or let AC do it via query_database.

Typical (Wasabi):

CREATE TABLE wasabi_acbans (
  id INT AUTO_INCREMENT PRIMARY KEY,
  player_identifier VARCHAR(64),
  banned_at DATETIME,
  reason VARCHAR(512),
  detection_type VARCHAR(64),
  evidence TEXT
);

Check AC docs for exact schemas.

Step 5: Event whitelists

Most ACs include an event whitelist. Add your legitimate resources' events:

Config.EventWhitelist = {
    'esx:giveInventoryItem',
    'esx:removeInventoryItem',
    'qb-inventory:server:addItem',
    'mygamemode:saveProgress',
}

💡 Any non-whitelisted event = auto ban. You must list all server events from your resources, or you ban legit players.

Step 6: First tuning round (1-2 weeks)

Calibration phase:

1. Run AC in kick mode first (not permanent ban)
2. Watch logs: who gets kicked? why?
3. Many false positives initially on poorly coded legit resources
4. Adjust whitelist and sensitivity
5. Once stable, switch to ban mode

Longest step. Plan 1-2 weeks of tuning on an active server.

Step 7: Resource anti-leak

Independently of AC, protect critical resources from copying:

• Encrypted resources: Cfx.re escrow — resource only runs on your server
• Build process: Lua minify + bytecode compile if possible
• Strict permissions: limited SFTP account for external devs
• Audit logs: who accessed what

Step 8: Persistent bans and appeals

When AC bans:

1. Player gets a custom message
2. IP/Steam ID added to bans DB
3. Optional: Discord log (see webhook tutorial)

Appeal system:

• Dedicated Discord channel #ban-appeal
• Discord form (Slash Command) opening a ticket
• Clear process: manual admin decision, never auto

Step 9: Updates

ACs receive near-weekly updates as menus evolve. Keep your AC up-to-date:

• Many have auto-updaters (notably Wasabi)
• Otherwise check the dev's Discord regularly
• Update = few minutes downtime, schedule off-peak

Step 10: Measure effectiveness

Metrics to track in your dashboard or Discord logs:

• Bans per week
• Detection types
• False positives (= appeal-reversed bans)
• Player complaints vs legit bans

50% false positives → readjust. 0 bans → AC not configured or server already clean (rare).

Troubleshooting

AC bans legit players en masse — too sensitive, lower in config.lua. Incomplete whitelist. Kick mode during tuning. AC doesn't ban anyone — not started (check ensure order). Invalid license — re-verify activation. Conflict with a resource (ESX, QBCore) — many ACs have presets for ESX/QBCore. Load AC first. Performance degraded — monitor with resmon. Heavy ACs can take 5-15% CPU on main tick.

Useful commands

restart wasabi_anticheat

# View bans in DB
SELECT * FROM wasabi_acbans ORDER BY banned_at DESC LIMIT 50;

# Manual unban
DELETE FROM wasabi_acbans WHERE player_identifier = 'steam:...';

Conclusion

Anticheat = mandatory for any public FiveM server. Invest in a proven commercial (Wasabi, Adler) if going serious, or start with free BoiiAC. The real work is tuning (1-2 weeks), not install. Combine with resource encryption + Discord logs and you have a solid security stack.

Going further: custom AC rules for your business logic, Discord/Steam ban integration, custom behavioral analysis.

Resources

• Wasabi Scripts
• BoiiAC — GitHub
• Cfx.re — Resource encryption (escrow)
• Cfx.re Forum — Anti-cheat