How to stop X-Ray on a Minecraft server

To shut X-Ray down, enable Paper's built-in anti-xray: in config/paper-world-defaults.yml, under anticheat.anti-xray, set enabled: true, pick an engine-mode, check the block lists and restart the server. The server will hide ores behind fake blocks, and X-Ray will show the player stone or junk instead of diamonds. Players who mined before you turned it on are found through their mining numbers.

Why an anticheat can't see X-Ray#

X-Ray is a mod or resource pack that makes stone transparent and highlights ores. The server never gets a single unusual packet: the player walks, mines and looks around exactly like an honest one. A plugin anticheat only sees what the client sends, so X-Ray is invisible to it.

That's true of every anticheat, not just DGuard. X-Ray isn't in our comparison, and neither are ESP, Freecam or FullBright: these cheats only change the picture. A different approach works — if the client doesn't know where the ore is, there's nothing to highlight.

Anti-xray in Paper#

Paper has an obfuscation-based anti-xray built in: before sending a chunk, the server swaps out the chosen blocks, and sends the real ones when the player interacts with blocks nearby. It's off by default (enabled: false). The settings live in two places:

• config/paper-world-defaults.yml, section anticheat.anti-xray — defaults for every world;
• paper-world.yml in a specific world's folder — an override for that world. The path depends on the version: on 1.21.x each dimension has its own folder in the server root (world_nether/paper-world.yml, world_the_end/paper-world.yml), and from 26.1 Paper moved these files into the dimension folders (world/dimensions/minecraft/the_nether/paper-world.yml, world/dimensions/minecraft/the_end/paper-world.yml).

The three modes

The settings

• enabled — turns anti-xray on.
• engine-mode — mode 1, 2 or 3.
• hidden-blocks — in mode 1, what to hide: ores, their deepslate variants, chests. In modes 2 and 3 these blocks are also scattered at random in place of hidden-blocks and replacement-blocks, so block entities such as chests can't go on this list.
• replacement-blocks — in modes 2 and 3, ordinary blocks that also get swapped for fakes; unused in mode 1.
• max-block-height — the height anti-xray works up to; only multiples of 16 are accepted. Ores above it aren't hidden.
• update-radius — the radius in which the server sends real blocks when a player interacts with a block; only 0, 1 and 2 are accepted, and 0 is for testing only.
• lava-obscures — whether to hide blocks touching lava; false is recommended.
• use-permission — whether players with paper.antixray.bypass and operators bypass it; false is recommended.

The recommended config from Paper's docs#

Paper's docs provide ready configs for all three modes. Below is mode 2 for the overworld, the nether and the end. For mode 3 the lists are the same; only the engine-mode: 3 line changes. YAML is whitespace-sensitive: don't let tabs slip in, and back the file up before editing.

anticheat:
  anti-xray:
    enabled: true
    engine-mode: 2
    hidden-blocks:
    # You can add air here such that many holes are generated.
    # This works well against cave finders but may cause client FPS drops for all players.
    - air
    - copper_ore
    - deepslate_copper_ore
    - raw_copper_block
    - diamond_ore
    - deepslate_diamond_ore
    - gold_ore
    - deepslate_gold_ore
    - iron_ore
    - deepslate_iron_ore
    - raw_iron_block
    - lapis_ore
    - deepslate_lapis_ore
    - redstone_ore
    - deepslate_redstone_ore
    lava-obscures: false
    # As of 1.18 some ores are generated much higher.
    # Please adjust the max-block-height setting at your own discretion.
    # https://minecraft.wiki/w/Ore might be helpful.
    max-block-height: 64
    replacement-blocks:
    # Chest is a tile entity and can't be added to hidden-blocks in engine-mode: 2.
    # But adding chest here will hide buried treasures, if max-block-height is increased.
    - chest
    - amethyst_block
    - andesite
    - budding_amethyst
    - calcite
    - coal_ore
    - deepslate_coal_ore
    - deepslate
    - diorite
    - dirt
    - emerald_ore
    - deepslate_emerald_ore
    - granite
    - gravel
    - oak_planks
    - smooth_basalt
    - stone
    - tuff
    update-radius: 2
    use-permission: false

anticheat:
  anti-xray:
    enabled: true
    engine-mode: 2
    hidden-blocks:
    # See note about air and possible client performance issues above.
    - air
    - ancient_debris
    - bone_block
    - glowstone
    - magma_block
    - nether_bricks
    - nether_gold_ore
    - nether_quartz_ore
    - polished_blackstone_bricks
    lava-obscures: false
    max-block-height: 128
    replacement-blocks:
    - basalt
    - blackstone
    - gravel
    - netherrack
    - soul_sand
    - soul_soil
    update-radius: 2
    use-permission: false

anticheat:
  anti-xray:
    enabled: false

The comments come from the docs. air in hidden-blocks creates lots of holes and works well against cave finders, but may cause FPS drops for every player. Tune max-block-height: 64 yourself: since 1.18 some ores generate much higher.

What anti-xray doesn't cover#

• Ores exposed to air. Ores open to caves or water are visible in every mode. In modes 2 and 3, adding air to hidden-blocks helps — at the cost of FPS.
• Range extension. Because of how anti-xray has to work, real ores can be seen from noticeably farther than intended. Paper's docs note there's no protection against this out of the box.
• The world seed. With the seed, a client can work out where ores generated. feature-seeds in Paper's world config, together with the structure seed options in spigot.yml, helps partly, but there's no full fix; a different seed per world also helps.
• An outdated config. If nothing gets hidden below y = 0, replacement-blocks is probably missing deepslate or biome blocks such as basalt.

Orebfuscator as an alternative#

Orebfuscator is a standalone plugin against X-Ray clients and X-Ray resource packs. It modifies network packets without touching the world itself, can hide block entities such as chests and furnaces, and caches chunks it has already processed. Its main difference from the built-in option is the proximity hider: it also hides surface blocks and reveals them only once a player gets close enough, with distance and line-of-sight checks.

Requirements per its README: Java 17 or newer; Spigot, Paper, Folia or compatible forks from 1.16.5; and ProtocolLib 5.4.0 or newer. Players with the orebfuscator.bypass permission aren't affected — make sure regular groups don't have it. One of the two is usually enough: Paper's anti-xray is simpler since it's already in the server; Orebfuscator is more flexible but adds two plugins to your setup.

How to spot players using X-Ray#

Anti-xray protects you from the moment it's on, but it doesn't punish anyone. An X-Ray user gives himself away in the numbers: too many diamonds and too much ancient debris for too little stone mined, and tunnels that run straight from ore to ore. With CoreProtect it takes a minute — its lookups search the whole server by default:

/co lookup i:diamond_ore,deepslate_diamond_ore t:7d a:-block #summary
/co lookup i:ancient_debris t:7d a:-block #summary
/co lookup u:Name i:stone,deepslate t:7d a:-block #count

Watch a suspect live: switch to spectator mode (/gamemode spectator) and follow him with /spectate Name. An X-Ray user mines without searching: he turns straight toward ore through solid stone and doesn't waste time on caves. How to check players for other cheats — in how to check a player for cheats.

X-Ray is proven by the overall pattern, not one lucky find: lucky miners exist. Put the punishment for X-Ray in your rules — the rules generator helps.

What DGuard catches in the mines#

To be straight: DGuard has no X-Ray check — it isn't a packet cheat, and nobody in our comparison has one. But the mines aren't only about X-Ray. DGuard catches what arrives as packets: Nuker, which breaks everything around, FastBreak, PacketMine, and GhostHand, which uses and hits through walls.

It's a simple combo: anti-xray stops players finding the ore, DGuard stops them mining it faster than possible, and CoreProtect shows who mined how much.

FAQ#