How to check a player for cheats on your Minecraft server

Checking a player for cheats means collecting evidence, not trusting a moderator's gut. The order: open the anticheat's evidence, spectate the player unseen, record it, look at the block logs, and only then decide. Each step covers the weak spot of the one before: on video lag looks like Speed, and a single anticheat flag doesn't prove a cheat.

The order of a check#

1. 1

   Open the anticheat's evidence

   What flagged for this player and when. If the anticheat already punished them, read the report attached to the punishment.

2. 2

   Spectate unseen

   Spectator mode or a vanish plugin: the player mustn't know they're being watched, or they'll turn the cheat off.

3. 3

   Record

   A video or a replay with the date, nickname and server. A recording can be rewatched, shown to a colleague and attached to the decision.

4. 4

   Check the block logs

   For X-Ray and suspicious mining, a CoreProtect lookup: what the player mined, where and how much.

5. 5

   Decide and document

   Punish by the rules and log links to every piece of evidence. Then anyone on the team can handle the appeal.

Start with the anticheat's evidence#

A good anticheat doesn't just ban — it explains why. In DGuard every ban comes with a report breaking down the evidence: which checks flagged, how many points piled up and across how many episodes. A single flag decides nothing: each piece of evidence weighs VL × the rule's weight, halves every day, and a ban comes only when the player has 400 points across three separate episodes.

The punishment log in the panel shows bans and kicks from all your servers: filter by nickname, server, check and period, and export the records to CSV. The log contains player nicknames, so it's off by default — turn it on in the config and run /dguard reload. Records are kept for 90 days.

cloud:
  punishment-log: true

Reports about a player but no punishment yet don't mean they're clean — there may simply not be enough evidence so far. That's when you move on to spectating.

Spectating: spectator mode and /spectate#

Vanilla gives you two commands. /gamemode spectator puts you in spectator mode: you pass through blocks and players can't see you. /spectate <player> attaches your camera to a player so you see through their eyes. It only works in spectator mode, and /spectate with no arguments stops it.

/gamemode spectator
/spectate PlayerName
/spectate
/gamemode survival

Don't hand out OP for these commands: the permissions are minecraft.command.gamemode and minecraft.command.spectate, granted to a group through LuckPerms. Keep in mind that the /gamemode permission unlocks every mode, creative included.

Watch from two angles. Through the player's eyes you see the aim: does the camera glide onto targets too smoothly, does it snap to someone behind them? From the side you see movement better: speed, jump height, bridges appearing under their feet.

What to watch for on each front#

Record what you see#

Evidence only you have seen is worth nothing in an appeal. Any screen recorder will do. Client-side replay mods such as ReplayMod and Flashback are even handier: they record what your client sees, and you can rewatch the scene later from any angle. Nothing needs to be installed on the server.

Label the recording: nickname, server, date and time, and what exactly looked off. A week later you won't remember which report it belonged to.

X-Ray: checking with CoreProtect logs#

X-Ray only changes what the client draws: the player sees ore through stone while the server receives ordinary mining packets. A plugin anticheat can't see this cheat directly — Paper's ore obfuscation is what fights it, see X-Ray protection. To check a player you already suspect, use CoreProtect block logs.

/co lookup u:PlayerName t:3d a:-block i:diamond_ore,deepslate_diamond_ore,ancient_debris
/co lookup u:PlayerName t:3d a:-block #summary
/co inspect

The first lookup lists broken ore blocks with coordinates, the second gives totals per material. Look at the ratio: hundreds of diamond ore blocks with almost no plain stone, and tunnels running straight to veins, are a reason to spectate. /co inspect turns on the inspector: click a block to see who placed or broke it.

Screenshare checks#

Some servers, especially PvP ones such as HCF, run screenshare checks ("SS"). Staff freeze the player, ask them to join a voice channel and either share their screen in Discord or connect through a remote desktop tool such as AnyDesk. The moderator then looks through the computer — running programs, game folders, recent files — for cheat clients. There are also dedicated screenshare scanners such as Echo: the player runs a program and staff get a report of what has been running on the PC.

It's a heavy measure, and it touches the player's privacy: they let a stranger into a computer that holds personal files, messages and payment details, and a scanner sees what has been running on that machine. If you use it, set the boundaries in advance:

• Only trusted staff run checks, not every helper.
• They look only at what concerns the game: processes, client folders, downloads. No personal photos, messages, passwords or banking apps.
• The player sees everything the moderator does and can end the session at any moment.
• The moderator never downloads, deletes or installs anything on the player's computer.

Most importantly, players must know about such checks in advance: the procedure goes into your server rules — who can call a check, with which tools, how long the player has to connect, what gets checked and what happens on refusal. If you don't have rules yet, build them with the rules generator.

When a player refuses a check#

Nobody can be forced to open up their computer — it's always the player's call. A server can only announce the consequences in advance. Many treat a refusal, or logging out during a check, as an admission. If that's your policy, it must be written in the rules and apply equally to everyone, new players and paying ones alike.

Log refusals too: who called the check, when, what the player said. And don't forget the other evidence — an anticheat report and a fight recording are often more convincing than any screenshare.

Document the decision#

Every punishment should survive the question "why?" a month later. Write down:

• the player's nickname and UUID, the server, date and time;
• which rule was broken;
• the evidence: anticheat report, video or replay, CoreProtect lookup;
• who decided, which punishment and for how long.

DGuard bans go into the log on their own, with the report. Keep manual punishments in your punishment plugin or a dedicated staff channel. How to split permissions and handle appeals is covered in building a moderation team; how not to punish an honest player — in false bans.

FAQ#