FiveM server security: anticheat, permissions and server-side validation

An unsecured FiveM server is an open invitation for cheaters. Players who spawn money, go invisible or teleport others ruin the experience for everyone. This article covers the essential security measures: from the permission system to server-side validation.

ACE permissions: the foundation

The ACE system (Access Control Entry) is the built-in permission system of FiveM. It determines who can execute which commands and access which functions.

How ACE works

ACE uses three concepts:

• Principals: identities, such as a player ID or a group.
• ACE entries: permissions attached to a principal.
• Groups: collections of principals, so you can grant rights to a group instead of individual players.

An example in server.cfg:

add_ace group.admin command allow
add_ace group.moderator command.kick allow
add_principal identifier.steam:110000xxxxxxxxx group.admin

This gives the admin group access to all commands, the moderator group only to the kick command, and links a specific Steam ID to the admin group.

Common ACE mistakes

• Giving everyone admin: never grant command allow to all players. Use specific groups.
• Not using groups: assigning rights per player instead of per group becomes unmanageable with more than a handful of admins.
• Forgetting txAdmin roles: txAdmin has its own role system. Make sure it aligns with your ACE configuration.

Anticheat resources

An anticheat resource monitors player behavior and detects anomalies that indicate cheats or exploits.

What a good anticheat does

• Entity monitoring: detects spawning of objects, vehicles or weapons without server permission.
• Teleport detection: flags when a player moves impossibly fast.
• Resource injection: blocks attempts to run unapproved client scripts.
• Explosion filtering: filters unauthorized explosions that cheaters use to kill other players.
• Weapon monitoring: detects weapons a player did not obtain through the framework.

Popular anticheat options

Both free and paid anticheats are available:

• FiveGuard: a comprehensive paid anticheat with server-side detection and a web dashboard.
• Open-source anticheats on GitHub: several free options exist. Check the date of the last update; an anticheat that is not maintained misses new cheat methods.

No anticheat is bulletproof. It is a layer on top of other security measures, not a replacement for them.

Server-side validation

The most important security rule in FiveM: never trust the client. Everything the client sends to the server can be manipulated.

Examples of proper server-side validation

• Money transactions: verify server-side that the player has enough money before deducting it. Do not trust the client to report the balance.
• Inventory: verify server-side that an item exists in the player's inventory before using or transferring it.
• Vehicle spawns: only let the server spawn vehicles. A client event requesting a vehicle spawn must be checked against the player's permissions.
• Position checks: when a player performs an interaction (shop, garage, NPC), verify that the player is actually at that location.

How to audit existing scripts

Many free scripts do not validate server-side. For every script you install, check:

1. Open the server-side code (the server.lua or server.js file).
2. Look for event handlers (RegisterNetEvent).
3. Check whether validation takes place: does the handler verify that the player has permissions, is at the right location and owns the right items?
4. If the event handler processes data directly without checks, the script is vulnerable.

Ban systems

A ban system is essential for removing rule breakers. txAdmin includes a built-in ban system, but you can extend it:

• txAdmin bans: ban players directly from the web panel based on their identifiers (Steam, Discord, license, IP).
• Shared ban lists: some communities share ban lists. This can be useful, but verify the source; adopting false bans damages your reputation.
• Multi-identifier bans: ban on Steam ID, Discord ID and license key simultaneously. Players who change their IP are still recognized.

Additional measures

• Require Steam/Discord: require that players connect with a Steam and/or Discord account. This makes it harder to return with a new account after a ban.
• Whitelist: a whitelist prevents unknown players from entering your server. More effort, but very effective against random cheaters. More on whitelists in building an RP community.
• Logging: log important actions (money transactions, weapon use, admin commands) to Discord via webhooks. This makes it easier to investigate incidents after the fact.
• Resource encryption: sensitive server-side code can be encrypted using tools like Cfx.re's escrow system. This prevents bad actors from analyzing your scripts for vulnerabilities.

Security checklist

1. ACE permissions configured and tested
2. Anticheat resource installed and configured
3. Server-side validation in all critical scripts
4. Ban system active with multi-identifier support
5. Steam and/or Discord required for connecting
6. Discord logging set up
7. Regular updates of artifacts and scripts

All FiveM plans at HostValues include DDoS protection and full control over your server settings. See also our txAdmin setup guide for managing your server.