How our Minecraft cheat detection actually works

The Thorium plugin streams what your server already knows to our engine: position, tick rate, packets, reach and block state. The engine checks it against vanilla Minecraft in our cloud, so movement that outruns the vanilla cap or an attack landing through a wall is visible without trusting the client. Nothing is installed on player machines.

It doesn't look for the client. A renamed or recompiled build defeats signature lists, but it still has to make the player move, hit or place blocks in ways the server can rule out. We judge the behaviour, so a new client is caught by what it does the first time it does it.

Over 50 checks across movement, combat, packets and world, including Speed, Fly, Prediction, Elytra, Reach, Aim, ThroughWalls, BadPackets, Scaffold and Nuker. The main ones can be switched off or retuned per network from the dashboard; the full list is on the Minecraft page.

Twenty times a second, for every player, Thorium works out what a vanilla client could do next and compares it with what the player did. Anything a vanilla client could not have done is flagged, whatever client produced it. How each check decides is not published: a description precise enough to reproduce is precise enough to evade.

An on-server anticheat plugin spends your TPS budget on its own checks, which is why deep checks and full servers usually trade against each other. Our plugin captures and forwards; the heuristics, history and correlation run on our infrastructure and come back as a verdict.

Paper, Spigot and Folia on Minecraft 1.8 through current, including servers behind a Velocity proxy. Drop the jar into plugins/, paste your network key into config.yml, restart once, and detections start streaming to the dashboard.

Yes. /report <player> [reason] is on by default. Reports appear on the dashboard's Reports page and in your Discord report channel, with how often that player has been reported and detected.

No. Players don't install a mod, accept a resource pack or use a special launcher. They join exactly as they did before, on any client or platform that can reach your server.

Yes. It reads server state and events rather than taking over combat or movement handling, so it runs next to your existing anticheat, combat and world plugins. If you already run an on-server anticheat you can keep it while you compare results.

Yes. Servers are grouped into a network, settings apply per network, and detections are correlated per player across every server in it, so someone hopping between servers reads as one case. Plans are priced by peak concurrent players, and each includes a number of backends.

The plugin captures telemetry and sends it; it does not run detection logic in your tick loop. Analysis happens on our side and a verdict typically returns within seconds, so detection depth does not come out of your TPS.

Checks are tuned against real gameplay, and over a dozen of them are flag-only by default: they raise a flag for an admin to review rather than acting on their own. Every check can be disabled per network, and each detection keeps its context and a replay link so a ban is a decision you can look at rather than take on faith.

Detection logic lives on our side, so a retuned or new check reaches every connected server without a jar swap or restart window. You update the plugin only when the capture side changes.

Your server keeps running normally. The plugin queues what it can and resumes streaming when the connection returns; gameplay never waits on us.

Gameplay telemetry from your server: player identity (UUID and username), positions, actions, timings and the events a check needs. No scanning of player machines, no system information, and nothing from anyone who isn't on your server.

You do, and no. Data is encrypted in transit and at rest, never sold, and shared only with the processors listed in our privacy policy. You can switch IP sharing off per network.

Every plan runs every detection. The tier changes how many concurrent players you can peak at, how many backends you can connect, how far back you can read history, which features are included (replays, live spectate, enforcement) and how fast support answers, from a free tier at 20 players up to custom Enterprise deployments. Your first paid plan starts with a 14-day free trial (one per account; choosing Free first uses it); after it you continue on that plan or drop to the Free tier rather than losing protection.

Yes. Setup is a jar and a key, but if something is odd about your stack, ask in Discord and an engineer will answer. Higher tiers add priority routing and, at the top, a dedicated channel.