Protecting a FiveM server against cheaters

There is no anticheat you can install that makes a badly written server safe. Cheat menus run inside the player’s game, so anything the client decides can be faked. Real protection is layered: scripts that trust the server, events that validate, game events that are filtered, and bans that stick.

OneSync sends some game actions to the server as events you can inspect and cancel with CancelEvent().

AddEventHandler('explosionEvent', function(sender, ev)
    if ev.explosionType == 4 or ev.explosionType == 5 then -- rocket, tank shell
        CancelEvent()
        print(('[ac] %s explosion type %d'):format(GetPlayerName(sender), ev.explosionType))
    end
end)

AddEventHandler('clearPedTasksEvent', function(sender, data)
    -- used by menus to throw players out of vehicles
    local ped = NetworkGetEntityFromNetworkId(data.pedId)
    if IsPedAPlayer(ped) and NetworkGetEntityOwner(ped) ~= sender then
        CancelEvent()
    end
end)

Cheaters make new accounts. Store every identifier a player has (GetPlayerIdentifiers(src): license, license2, discord, fivem, steam, xbl, live, ip) and every token (GetNumPlayerTokens / GetPlayerToken), and refuse connection if any of them match a ban. Tokens are server-specific hardware-derived values, which makes ban evasion much harder than with the licence alone.

AddEventHandler('playerConnecting', function(name, setKickReason, deferrals)
    local src = source
    local tokens = {}
    for i = 0, GetNumPlayerTokens(src) - 1 do
        tokens[#tokens + 1] = GetPlayerToken(src, i)
    end
    local ids = GetPlayerIdentifiers(src)
    -- compare ids and tokens with your ban table here
end)

txAdmin’s built-in ban system already checks identifiers and hardware IDs; many servers use it rather than writing their own — see txAdmin permissions.

Cheat menus fire well-known event names from old or popular scripts. Register a few of those names that your server does not use, and flag anyone who triggers them — no honest client ever will.

local TRAPS = { 'esx_society:withdrawMoney_old', 'admin:giveAllWeapons' }

for _, name in ipairs(TRAPS) do
    RegisterNetEvent(name, function()
        local src = source
        print(('[ac] honeypot %s triggered by %s'):format(name, GetPlayerName(src)))
        -- ban or flag here
    end)
end

Every client script is downloaded to the player’s PC. Anything in it — webhook URLs, API keys, admin lists, “secret” event names — is readable. Keep secrets in server files and convars. Asset escrow protects code from copying, not from being executed or observed.

Paid anticheats add client-side detection of menus, injected code and suspicious behaviour, plus shared ban lists. They are a useful extra layer — but an exploitable fishing:sell event stays exploitable no matter which anticheat runs next to it.