A Minecraft server's scarcest resource is main-thread time: it has 50 ms per tick, and everything that lands there eats headroom from mobs, redstone and other plugins. So the question isn't how much CPU an anticheat uses overall, but how much it takes from the main thread. You measure that with spark: find the anticheat plugin under "Server thread" and look at its share.
Where an anticheat runs: main thread vs network threads
A Paper server has one main thread ("Server thread"): it runs the tick — entity movement, blocks, plugin events. Alongside it run network threads: they receive and send player packets and don't wait for the tick.
An anticheat can check players in either. If it listens to Bukkit events such as player movement, the work happens on the main thread and spends the tick's budget. If it reads packets, for example through PacketEvents, it can run checks right on network threads, and the tick barely notices.
| Main thread | Network threads | |
|---|---|---|
| What runs there | The tick: entities, blocks, plugin events | Receiving and sending packets |
| What heavy work does | MSPT rises, TPS drops for every player | CPU usage rises; TPS is fine as long as there are cores to spare |
| How to see it | spark, "Server thread" | spark with the --thread * flag |
Network threads aren't free either: on cheap hosting where cores are shared with neighbours, extra load there is still felt. But that's a much smaller problem than an anticheat eating the tick.
How to measure the load
- 1
Pick the right time
Peak online, not an empty server: an anticheat's load grows with the number of players, especially in fights.
- 2
Take a profile
/spark profiler start --timeout 600— after 10 minutes spark posts a link to the report. On Paper 1.21+ spark is built in. - 3
Find the anticheat on the main thread
In the report open "Server thread" and switch to the Sources view: each plugin gets its own tree. The anticheat's share of that thread is what it costs your tick.
- 4
Look at the other threads
Take a second profile with
--thread *to see how much the anticheat spends on network threads. - 5
Compare with the anticheat's own numbers
If the anticheat has a built-in measurement, compare. In DGuard it's
/dguard perf, which shows how much time the checks take.
/spark profiler start --timeout 600
/spark profiler start --thread * --timeout 600
/mspt
/dguard perfWhat DGuard costs
DGuard reads packets through PacketEvents and runs its checks on network threads, not the main thread, so TPS stays at 20. On a live server it's 0.03% of one core on the main thread: 0.38 ms of a 10.9 ms tick with 121 players.
That's with 11 checks and 80+ rules watching each player at once across every front: combat, movement, building and world, inventory, packets. Don't take the numbers on faith — profile your own server and compare with /dguard perf.
Network and memory
Memory. An anticheat keeps a history for every player: movement, hits, clicks. The higher your online, the more of that data. If you suspect the anticheat is holding memory, /spark heapsummary shows which classes take it — their names tell you whose plugin it is. How much memory to give the server in general: how much RAM you need.
Network. Some anticheats send players extra service packets to measure latency more precisely. Cloud checks send data out of your server — ask what exactly and how much.
DGuard connects to the DGuard site over HTTPS for the license, updates and the cloud check of aim and TriggerBot rules. For that check the plugin sends game measurements — camera turns, positions relative to a random point without world coordinates, clicks and hits — under random session numbers; they live only in memory and are deleted after 10 minutes of silence. Nicknames, IPs and chat stay on your server, and the punishment log with nicknames reaches the panel only if you turn it on. Without a connection, protection keeps working for up to 72 hours on the saved license, except the cloud-check rules.
How to compare two anticheats fairly
Comparing load by reviews is pointless: everyone has different online, game modes and hardware. It's more reliable to install the second anticheat next to your current one on the same server. Then a single spark profile shows both plugins side by side in the Sources view — same player count, same fights.
That's exactly what DGuard suggests: install it for free next to your current anticheat — up to 30 players online, no time limit, no card — and after a week compare both the logs and the profiles. How to switch afterwards without a gap in protection is covered in switching anticheats.
What to ask any anticheat vendor
- 1Which thread do the checks run on, and what stays on the main thread?
- 2How many milliseconds of the main thread does it take — on a live server, with how many players? A number from an empty server tells you nothing.
- 3Is there a command that shows the load on your own server?
- 4What goes to the cloud, how often, and what happens without internet?
- 5Does it support your server software and version? DGuard is made for Paper and Leaf; the version list is on the versions page.
- 6How does it behave during TPS drops — does it ban for lag? More in why anticheats ban honest players.
To compare what anticheats actually catch, not just what they cost, see the comparison across 47 kinds of cheats and choosing the best Minecraft anticheat.
FAQ
Can an anticheat cause server lag?
Yes, if it does heavy work on the main thread: MSPT rises and TPS drops for everyone. Anticheats that check packets on network threads barely affect the tick.
How do I see how many resources a plugin uses?
Run /spark profiler start --timeout 600 at peak online, open the report, pick "Server thread" and the Sources view — it shows each plugin's share of the tick.
How much does DGuard cost in server resources?
DGuard runs its checks on network threads, so TPS stays at 20. On a live server it's 0.03% of one core on the main thread: 0.38 ms of a 10.9 ms tick with 121 players. Check it yourself with /dguard perf.
TPS dropped after I installed an anticheat. What now?
Take a spark profile during the drop and look at the anticheat's share of "Server thread". If it's the culprit, send the profile link to its developer; if not, look at entities, chunk generation and other plugins.
Does an anticheat need internet access?
Depends on the anticheat. DGuard needs outbound HTTPS to the DGuard site for the license, updates and the cloud check of aim and TriggerBot; without a connection protection works for up to 72 hours, except the cloud-check rules.