Everything is in config.lua, grouped by section. The per-check settings (severity, action, cooldown, cancel)
are covered in Checks & codes.
General
Option
Default
What it does
Config.Framework
'auto'
'auto', 'qbx', 'qb', 'esx', 'nd', 'ox' or 'standalone'
Config.ServerName
nil
Shown at the top of the staff panel. nil uses your server's project name
Config.PrintFlags
true
Print every flag to the server console. Handy during the shadow week
Rollout
Option
Default
What it does
Config.ShadowMode
false
Everything runs and logs, but no action goes past Shadow.MaxAction
Config.Shadow.MaxAction
'alert'
Highest action in shadow mode
Config.Shadow.StillCancel
4 codes
Codes still blocked in shadow mode: ENT_BLACKLIST, EXPL_SILENT, EXPL_BLOCKED, WEAP_GIVE_OTHER
Config.AutoBan
false
Automatic bans for codes in Config.Certain. With it off, a ban becomes a kick
Config.Cancel
true
Turn every cancel (blocked entity, explosion, damage, task clear) on or off at once
Score and actions
Every flag adds its severity to the player's score. The highest of the code's own action and the score's
action runs.
Option
Default
What it does
Config.Score.Decay
10
Points drained per minute
Config.Score.Alert
40
Score that alerts staff
Config.Score.Screenshot
70
Score that takes a screenshot and alerts staff
Config.Score.Kick
100
Score that kicks, unless staff open or act on the player within KickDelay
Config.Score.KickDelay
60
Seconds staff have to step in before a score kick
Config.StaffMaxAction
'screenshot'
Highest automatic action for staff. nil treats staff exactly like players
Actions, weakest first:
Action
What happens
'log'
Console and the player's history
'alert'
Staff in game, Discord and a case
'screenshot'
An alert plus a screenshot
'kick'
The player is removed
'ban'
Only for certain flags with AutoBan on
Alerts
Option
Default
What it does
Config.Alerts.Cooldown
60
Same player and same code alerts staff at most once per this many seconds
Config.Alerts.Discord
true
Alerts also go to the log
Config.Alerts.LogAll
false
Send every flag to Discord, not just alerts
Config.Alerts.Key
'F10'
Default key for /ac. Players can rebind it
Messages
Config.Messages holds the text players see: Kick (with the reason), Warn, Ban (ban id, reason, expiry
and appeal text) and Checking, shown while a joining player is checked against the ban list.
Exemptions
Config.Exempt is empty by default. Entries are per identifier (players), per ACE (aces) or per code
(codes). Each entry is one mode for every code, or a table of code = mode with '*' for the rest. See
Exemptions.
Panel and permissions
Config.Permissions maps each panel action to an ACE:
Permission
Default ACE
Allows
view
ac.staff
Open the panel, see players, flags and cases
alerts
ac.staff
Get the in-game alerts
case
ac.staff
Mark cases open, cheater or false positive
screenshot
ac.staff
Take a screenshot
warn
ac.staff
Warn a player
teleport
ac.staff
Spectate, goto and bring
clear
ac.staff
Clear a player's score
kick
ac.kick
Kick
ban, unban
ac.ban
Ban and lift bans
ip
ac.ip
See IP addresses
exempt
ac.exempt
The "allow" action: log-only for the session
settings
ac.staff
See the checks screen
Option
Default
What it does
Config.AdminGroups
god, admin, superadmin
Framework groups that get every permission
Config.PanelAllowMode
'log'
What "allow" from the panel does for the rest of the session: 'log' or 'ignore'
Grace windows
Config.Grace sets how long each window lasts and how much flags inside it count. severity scales the
flag: 0 is no flag, 0.25 a quarter, 1 full. Flags inside a window are never certain. The full list is in
Grace windows.
Option
Default
What it does
Config.Grace.<kind>.seconds
varies
Length of the window
Config.Grace.<kind>.severity
varies
Multiplier for flags inside it
Config.Grace.client.max, .window
6, 300
A player's own client can ask at most 6 times per 5 minutes
Config.Grace.<kind>.covers
movement codes
Codes the window applies to
Config.GraceCovers
TP_DIST, SPD, NOCLIP, TP_OOB, SPECTATE
Default codes for windows without covers
Entities
Option
Default
What it does
Config.Entities.Limits.object
15 in 10 s
More created in the window is ENT_SPAM and blocked
Config.Entities.Limits.vehicle
4 in 10 s
Same, for vehicles
Config.Entities.Limits.ped
6 in 10 s
Same, for peds
Config.Entities.SpamCertain
5 in 30 s
ENT_SPAM this often is certain
Config.Entities.Caps
60 objects, 8 vehicles, 20 peds
Most entities one player may own at once (ENT_CAP)
Config.Entities.PopulationTypes
{ [7] = true }
Only script-created entities count. Ambient traffic is never touched
Models with no legit use, blocked before they exist (ENT_BLACKLIST)
The blacklist ships with stunt ramps and oversized props, military and weaponised vehicles (jets, tanks, the
Oppressor Mk II, armed helicopters, cargo planes, blimps) and a few peds such as the juggernaut and whales.
Remove a model if your server uses it legitimately.
Explosions
Option
Default
What it does
Config.Explosions.Allowed
list of type ids
Explosion types anyone may cause. Everything else is EXPL_BLOCKED
Config.Explosions.Ambient
vehicle and fuel types
Checked with the larger AmbientDistance
Config.Explosions.RemoteDistance
150
Weapon explosions further than this from the sender are EXPL_REMOTE
Config.Explosions.AmbientDistance
400
Vehicle and fuel explosions further than this are EXPL_REMOTE
Config.Explosions.RemoteCertain
500
Further than this is certain
Config.Explosions.Rate
4 in 5 s
More is EXPL_RATE
Config.Explosions.CheckSilent
true
Invisible or silent explosions are EXPL_SILENT
The allowed list covers molotovs, vehicles, fuel, pumps, gas canisters, barrels, propane, fire extinguishers,
flares, smoke and BZ gas, snowballs, and flash and stun grenades. Grenades, rockets and explosive ammo are not
on it. Type ids are listed in the FiveM natives docs under eExplosionTag.
Movement
Option
Default
What it does
Config.Movement.Limits
see below
Metres per second by what the player is in
Config.Movement.Slack
0.25
Extra 25% on every limit
Config.Movement.MinDistance
5
Metres always allowed per sample on top
Config.Movement.TeleportRatio
1.5
Over this many times the limit in one second is TP_DIST
Config.Movement.BigRatio, BigSeverity
3, 80
Over 3 times the limit gets severity 80
Config.Movement.ShortDistance, ShortSeverity
300, 10
Jumps shorter than 300 m get severity 10 (elevators, MLO doors, interiors)
Config.Movement.CertainDistance
2000
On foot, outside any grace and none in the last 30 s, is certain
Config.Movement.SpeedSamples, SpeedHits
5, 3
SPD when over the limit in 3 of the last 5 seconds
Config.Movement.NoclipSeconds, NoclipHeight
4, 3.0
NOCLIP when client and server agree the player hangs this long, this high
Config.Movement.MinZ
-800.0
Under this is TP_OOB. Housing shells and some MLOs sit well under the map
Config.Movement.MaxXY
-8000 to 8000, -8000 to 10000
Map bounds for TP_OOB
Config.Movement.SpectateDistance, SpectateSeconds
400, 30
SPECTATE when the camera is this far from the ped for this long
Speed limits in m/s: foot 15, fall 70, cars, bikes, boats, trains and amphibious vehicles 110, heli and
blimp 120, plane 220.
Health
Option
Default
What it does
Config.Health.MaxHealth
200
Player ped max health. Raise it if a script gives more
Config.Health.MaxArmour
100
Max armour
Config.Health.Margin
5
Allowed over the max
Config.Health.CertainHealth
500
GOD_HP at or above this is certain
Config.Health.HealFrom, HealTo
150, 195
HEAL_INSTANT: from under 150 to at least 195 within a second
Config.Health.GodHits
10
GOD_DMG: confirmed hits in a row with no health or armour lost
Config.Health.GodWorkingShare
0.5
Only when at least half the hits on other players hurt them, so servers with friendly fire off never flag
Config.Health.InvincibleChecks
3
GOD_FLAG: client reports invincible this many checks in a row, 10 s apart
Config.Health.SafeZones
empty
{ x, y, z, radius } areas where damage checks don't apply
Weapons and damage
Option
Default
What it does
Config.RestrictedWeapons
15 weapons
Spawn name to label. Removed from anyone holding them (WEAP_BLACKLIST)
Config.WeaponCheckEvery
2
Seconds between server checks of the weapon in hand
Config.Combat.Factor
1.5
Damage over the weapon's damage times this is DMG_AMOUNT
Config.Combat.RangeFactor, RangeExtra
1.2, 10
Hits beyond range times 1.2 plus 10 m are DMG_RANGE
Config.Combat.VehicleFarDistance
300
Vehicle damage from further is DMG_VEH_FAR
Config.Combat.WeaponMismatch
3 in 10 s
DMG_WEAPON after this many hits with a weapon not in hand
Config.Combat.MultiKill
3 victims in 1.0 s
DMG_MULTIKILL
Config.Combat.Headshots
30 hits, rate 0.8, average 0.4
DMG_HEADSHOT compares a player's rate with the server average
Config.Combat.HeadComponent
20
The hit component the game uses for the head
Config.Combat.CancelOutOfRange
false
Also block hits from beyond range
Config.Combat.Weapons
about 45 firearms
Base damage per hit and range in metres. Shotguns use factor = 3
Config.Combat.NonLethal
stun gun, snowball, extinguisher...
Weapons that never count towards GOD_DMG
Restricted by default: RPG, homing, grenade and compact launchers, minigun, railguns, EMP and firework
launchers, the three ray weapons, sticky bombs, pipe bombs and proximity mines. Add a firearm to
Config.Combat.Weapons if an addon weapon trips the damage checks:
custom/shared/weapons.lua
Config.Combat.Weapons.WEAPON_MYADDONRIFLE = { damage = 34, range = 500 }
Event firewall
Option
Default
What it does
Config.Firewall.Enabled
true
Turn the firewall off
Config.Firewall.AutoDiscover
true
Find the net events of every running resource from the files each fxmanifest names
Config.Firewall.Rate
40 in 10 s, certain at 200
Default rate limit per event (EVT_RATE)
Config.Firewall.Limits
empty
Per event: ['my:event'] = { max = 100, window = 10, certain = 1000 }, or false to skip it
Config.Firewall.Watch
empty
Extra events auto discovery can't find, such as ones in globbed files
Config.Firewall.Ignore
4 events
Never rate limited: playerJoining, playerDropped and two internal ones
Config.Firewall.NoisyPlayers, NoisyWindow
2, 600
An event this many players go over in 600 s is the resource's own doing and stops being checked until restart
Config.Firewall.Honeypots
about 35 names
Fake events cheat menus try (EVT_HONEYPOT). Skipped when a running resource owns the name
Config.Firewall.Schemas
empty
Argument checks for any event (EVT_SCHEMA), see below
Config.Firewall.Known
10 events
Known exploitable events and who may fire them (EVT_EXPLOIT)
The honeypots are old ESX, vRP and admin menu money and job events that menus fire blindly. The known list
covers revive, cuff, jail and boss withdraw events from common free resources, limited to the ambulance or
police job or to bosses.
Schemas are opt in. A ? after a type means the argument may be missing:
Attached to another player's ped this long without an attach grace is PLY_ATTACH
Config.Players.TasksCertain
3 in 10 s
PLY_TASKS this often is certain
Config.Players.TasksNear, TasksNearSeverity
5.0, 10
A task clear from this close is likely a script (cuffs, escort): severity 10, never certain
Config.Players.PtfxDistance
150.0
Particle effects further than this are PLY_PTFX
Config.Players.PtfxRate
30 in 10 s
Particle flood limit
Heartbeat and client checks
Option
Default
What it does
Config.Heartbeat.Every
15
Seconds between client heartbeats
Config.Heartbeat.Timeout
60
Missed this long is HB_MISS
Config.Heartbeat.KickAfter
3
Misses in a row before a kick
Config.Heartbeat.FirstWithin
300
A player who never sends one this long after joining counts as a miss
Config.Heartbeat.Watch
empty
Resources whose client stop is reported (RES_STOP). Add your important ones
Config.Heartbeat.IgnoreResources
_cfx_internal
Never reported
Config.Client.CheckEvery
30
Seconds between client menu checks, spread over frames
Config.Client.Textures
18 names
Texture dictionaries known menus load (MENU_TXD)
Config.Client.Commands
15 names
Commands known menus register (MENU_CMD)
Config.Client.CommandOwners
empty
Resources allowed to register those commands
Config.Client.Globals
27 names
Globals known menus leave behind (MENU_GLOBAL)
Config.Client.SuperJumpHeight
4.0
A jump that climbs more is MENU_PEDFLAG
Config.Client.InfiniteAmmoShots
40
Sampled shots with the ammo count never dropping (AMMO_INFINITE)
Bans
Option
Default
What it does
Config.Bans.IdPrefix
'AC'
Ban ids look like AC-7K2Q
Config.Bans.AppealText
'Appeal at: ...'
Shown on the ban screen. Put your appeal link here
Config.Bans.StoreIp
false
Keep the IP with the ban
Config.Bans.MatchIp
false
Also refuse joins from a banned IP
Config.Bans.TokenMatches
2
Hardware tokens that must match. One alone can be shared
Config.Bans.Identifiers
license, license2, fivem, discord, steam, xbl, live
Identifier types that ban on a single match
Config.Bans.UseTxAdmin
false
Also call Bridge.ExternalBan for each ban
Logs and screenshots
Option
Default
What it does
Config.Discord.Webhook
''
Discord webhook for logs. Empty is console only
Config.Discord.Name
'Anticheat'
Name on the webhook posts
Config.Discord.Color
0xD7262C
Embed colour
Config.Screenshots.Webhook
''
Discord webhook screenshots are uploaded to. Empty turns screenshots off
Config.Screenshots.Quality
0.6
JPEG quality
Config.Screenshots.Cooldown
120
At most one per player per this many seconds
To send logs or screenshots somewhere other than Discord, replace Bridge.Log or Bridge.UploadScreenshot.
See Custom servers.
Hooks
The bottom of config.lua lists the Hooks.* functions you can set from custom/ to change any check
without touching the resource. They are covered in Custom servers.