Warden documentation

owners

license-key

stream

How often player positions are sent to staff running the mod, in ticks (20 ticks = 1 second). 2 = 10 updates per second. Higher numbers use less bandwidth but look less smooth.

setback

SETBACK - the only things Warden does on its own A player who VClips or Phases through solid blocks is put back where they started (and it is still reported), and a VClip also kicks them. These two checks are near-proof, so honest players aren't affected. Everything else is only reported. Set both to false for report-only.

auto-kick

AUTO-KICK AND BANS Every check has a level (see "level" under checks below; change it in /wardenserver too): high near-proof cheats (VClip, Fly, Teleport, KillAura...): kicked after high-catches catches medium most checks: kicked after "catches" catches low leads (Input, Aimbot...): kicked after "catches" catches, but never banned off never kicked or banned (hint-only checks) Catches count within "minutes". A kick is not a ban: they can rejoin.

checks

CHECKS Warden REPORTS; staff decide. What it does on its own is set above (setback, auto-kick, bans). For each check: enabled: run it at all chat: alert staff (a line in the mod, or in server chat for staff without the mod) discord: also post it to the Discord channel below A check that is enabled but has chat and discord off still shows on player tags and on the suspects list in the mod. Checks marked "lead" are hints, not proof: look before you act.

alerts

Each check: enabled, chat (staff chat alerts), discord, and optionally level: high, medium, low or off (what auto-kick and bans do; see AUTO-KICK AND BANS above). Without level, the check keeps the level Warden gives it. Moving up or down through a full solid block. Walking sideways through a wall (with no way around). Staying in the air without falling. Moving faster than the speed below. Counted in seconds. The player's game running faster than real time. Melee hit from too far away. Melee hit on a player who is completely behind blocks. (lead) Melee hit on a player they were not looking at, or several players hit at once. Aim that stays glued to a moving player. Works with guns and bows too. (lead) More clicks per second than a hand can do, for several seconds. Digging straight to buried ore veins again and again. Breaking blocks too fast or from too far away. Keeps aiming at a moving player they cannot see. Counted in seconds. (lead) --- Movement, checked against vanilla physics --- The player's game claims to stand on the ground while nothing is under them (NoFall, some fly). Changing speed or direction in mid-air more than the movement keys allow (air strafe, bunny-hop speed). Stepping up a full block or more in one move, without jumping. Walking on top of water or lava. Walking at full speed while eating, drawing a bow or blocking, or through cobwebs, soul sand (without Soul Speed) and honey. Climbing ladders and vines faster than normal. A boat flying up with nothing under it. --- Combat --- Taking almost no knockback, 3 times in a minute (anti-knockback). (lead) Critical hits while standing on the ground, 3 within 10 seconds. (lead) --- World and inventory --- Placing blocks faster than the limit below. Placing blocks without looking at them, 4 within 5 seconds. (lead) Clicking in an inventory while walking (vanilla stops you moving). (lead) --- Added in 1.3 --- Speeding up or turning on the ground more than the player's speed allows (catches small speed hacks the 12 blocks/s Speed check misses). Speed potions, soul speed and ice are taken into account. Jumping higher than jump strength and Jump Boost allow. A new totem in the off-hand faster than a human could react after one popped. Shift-clicking stacks out of chests inhumanly fast. Mouse Tweaks does this legitimately, so it only shows on tags unless you turn chat on. (lead) A player joined with a client brand or mod you listed under client-info below. --- Added in 1.9 --- Movement that doesn't match the keys the player's game says are held: speeding up with no movement keys, or sprinting without holding forward (omni-sprint). Only for 1.21.2+ games. (lead) Head turning to random directions every tick, spinning non-stop, or looking past straight up/down (derp, spin-bot, and silent-aim cheats that snap to a target and back). The game held its movement back while still sending clicks and key presses, then caught up all at once (blink / fake lag). Real lag holds everything back together, so it is never confused with this. Aim landing on the exact centre of the blocks being mined, again and again (Baritone and other mining bots). (lead) Climbing with an elytra without losing speed, or hovering, with no rocket. Dug straight to a fake ore or chest that only this player's game was shown, sealed in stone (see honeypots below). Only x-ray, chest ESP or freecam can reveal one. Breaking a block faster than the tool, enchantments and effects allow (FastBreak, InstantBreak, SpeedMine). GhostHand: opening a chest (or a door, button, lever) or placing a block with a solid block between the eyes and the spot clicked, or clicking the side of a block that faces away from the eyes (chest ESP with interact-through-walls, GhostHand, Surround/AutoTrap/Scaffold placing without aiming). The far side, or two blocks in the way, is reported at once; one block in the way twice. Placing a block against thin air, with nothing to place it on (AirPlace). Hits aimed beside the target, again and again (Hitboxes: cheats that make everyone's hitbox bigger). Falling far enough to get hurt and taking no fall damage (NoFall). Moving further in one step than legs can (ClickTP, teleport and packet speed/fly cheats). Jumping again in mid-air with nothing to stand on (AirJump, double jump, Jetpack). Walking at full speed while sneaking (FastSneak). Moving out of the way of arrows faster than the movement keys allow (ArrowDodge). While fighting: the head turning by amounts no mouse can produce (aim assist nudging the aim). A mouse turns in fixed small steps set by its sensitivity. Smooth camera/zoom mods can look the same, so it's a lead. --- New in 2.0, for crystal PvP and SMP servers. They start at level OFF (report only, never kick or ban) until you've seen them work on your server; then set a level in the menu (Q on a check). Checks that say "game tick" need PacketEvents: games from 1.21.2 on mark the end of each of their ticks, and a real game always handles keys in the same order inside one (hotbar, hit, right-click, move). Cheats act from code and get that order wrong, however good the player. Placing a crystal and breaking it in the same game tick, breaking 7 of 10 crystals in the tick they were placed, 12 crystals in a row at the exact same speed, or obsidian + crystal + hit inside 2 ticks (CrystalAura, AutoCrystal, AutoHitCrystal). Charging and blowing up a respawn anchor in the same tick, or switching item between the two inside one game tick (AnchorAura, AnchorMacro). Placing a bed and blowing it up in the same tick in the Nether or End, 3 times in a minute (BedAura). A totem in the main hand within 100 ms of a totem popping or of dropping to low health, twice (AutoDoubleHand). Off-hand totems are AutoTotem. Several blocks placed in a single tick (one click places one): Surround, AutoTrap, HoleFiller. A cobweb or anvil dropped onto a player the tick they arrived there, 3 times (AutoWeb, AutoAnvil). 11 of 12 hits landing the very tick the crosshair reached the target or the swing became ready, with no misses (TriggerBot). Changing hotbar slot right after a hit in the same game tick (mace/axe AttributeSwap, ShieldBreaker). Right-clicking then changing slot in the same game tick (silent switch), or switching and using an item in the very same tick again and again (AutoWeapon, AutoGap, AutoPearl). (lead) 8 of the last 10 long shots (15+ blocks) at moving players landing (BowAimbot). (lead) 10 arrows in a row drawn for the exact same time, or 8 arrows in a second (BowSpam, FastBow). Shooting itself with a potion arrow after the view snapped straight up for the shot (Quiver). XP bottles thrown like clockwork, or looking down for just the tick of each throw (AutoEXP, AutoMend). Three pieces of armour put on by clicking in one tick, or broken armour replaced within 100 ms (AutoArmor). Leaving the game within 200 ms of being hit low in a fight (AutoLog). Riding a horse, camel, pig or strider faster than it can go (EntitySpeed). A ridden mob that can't fly staying in the air or rising for too long (EntityFly). Going further after a riptide than the trident's level allows (TridentBoost). Falling faster than gravity pulls (ReverseStep, FastFall). Breaking, placing or using blocks further away than the game's reach (BlockReach). Breaking blocks the crosshair isn't on (PacketMine, AutoCity, InstaMine). With PacketEvents also, by the game's own ticks: saying a block is broken far sooner than it can be (the server then breaks it by itself later), or finishing a block it never started on, stopped breaking or already finished (PacketMine, SpeedMine, InstantRebreak). Start and finish in one tick on a slow block is reported at once; the rest twice in a minute. Reeling in fish within 50 ms of every bite, or exactly as fast every time (AutoFish). Jumping or swinging at exact intervals for minutes without going anywhere (AntiAFK). (lead) Using several animals in one tick, or one after another like clockwork (AutoBreed, AutoShearer). 5 inventory clicks in one tick, or 20 like clockwork (InventoryTweaks, AutoArmor; sorting mods like Item Scroller do this too). (lead) Clicking an item in a plugin menu (auction house, shop) faster than a person could see it, ping taken off, 4 times in 5 minutes (auction and shop snipers). The same command at exact intervals 8 times, or 8 commands in a second (AutoSell and other macros). The same message 5 times in a minute, or messages at exact intervals (spam bots). Packets a real game never sends: actions after its movement in the same game tick, a hit on itself, a hotbar slot that doesn't exist (BadPackets). Packets built to lag or crash the server (dropped by crash protection, below). A mace hit after a fall the server counted but that never happened: the game sent one step a few dozen blocks up and straight back down right before the hit, so the smash attack does huge damage (MaceDMG, MaceKill). Compared with the real top of the fall; reported at once. Starts at level OFF.

discord

Discord > channel > Edit Channel > Integrations > Webhooks > New Webhook > Copy Webhook URL. Keep this link private: anyone who has it can post in the channel.

vclip

FINE TUNING (the defaults are fine for most servers)

phase

speed

Walking ~4.3, sprinting ~5.6, sprint-jumping ~7 blocks/second. Flying, elytra, riptide, vehicles, spectators and teleports are ignored. Speed potions and a raised walk speed raise this limit for that player automatically.

fly

placing

timer

combat

autoclicker

NOTE: these read the attack the player's own game sends. Damage dealt by gun or skill plugins is not a melee attack and is never checked (so it cannot be flagged by mistake either).

aimbot

xray

nuker

bedrock

Bedrock players (joining through Geyser/Floodgate). Their movement is translated by Geyser and touch screens attack without aiming, so these checks would misfire on them and never report Bedrock players. VClip, Phase, Speed, XRay, Nuker, FastPlace and AutoTotem still apply. Remove a check from the list to check Bedrock players with it too. Bedrock players are recognised by the account id they log in with (Floodgate ids start with 00000000-0000-0000), which a Java player can't fake.

client-info

Client info: every staff tag shows which client a player uses (the "brand" their game reports, like "vanilla" or "fabric") and the mods it announced. If you know a brand or mod name that only cheat clients use, add part of it here and Warden raises a "Client" alert when someone joins with it. Matching ignores upper/lower case. Cheat clients can hide or fake this, so no match proves nothing. Example: flag-brands: ["somecheatclient"]

mod-scan

Mod scan: checks whether a player has particular client mods installed - freecam, x-ray and cheat clients - by asking their game to translate each mod's own text codes. It finds freecam and ESP/x-ray mods, which no server-side check can see. The player sees an anvil flash open for a moment, so it only runs when staff ask: /wardenscan <player>, or the Scan button / /warden scan in the mod. Big cheat clients and privacy mods can block it; Warden reports that as "blocks mod scans". A mod that is found raises a "Client" alert. Tell your players in your rules that you may scan. A game that says it is "vanilla" but has mods (found by the scan, or announced) is reported too.

anti-esp

Wurst 7.41.1 and newer hide from every translation scan (Wurst moved to its own translation system), so this only finds older Wurst, often joining through ViaVersion. Newer Wurst is caught by the checks instead (Derp, Fly, KillAura, Nuker...). ANTI-ESP - players behind walls aren't sent to other players Every few ticks Warden checks whether each pair of nearby players could see each other. A player fully behind solid blocks isn't sent to the other one until they could be seen again, so ESP cheats have nothing to draw. Staff (warden.view) see everyone. Needs the PacketEvents plugin (it comes with Warden); without it, this stays off.

anti-storage-esp

Anti storage-ESP: chests, barrels, shulker boxes, ender chests, hoppers, furnaces and spawners further than show-within blocks from a player aren't sent to that player at all (air in their place, or the block below if they're sealed in a wall), and are sent for real as the player comes closer. StorageESP, stash finders and spawner finders then can't find bases from far away. Staff (warden.view) and spectators get everything. Off until you switch it on (menu: x-ray, ESP, protection). Needs PacketEvents.

hide-health

crash-protection

honeypots

HONEYPOTS - fake treasure only cheaters can see While a player mines underground, Warden shows THEIR game alone a little fake diamond ore (ancient debris in the Nether) or a fake chest, sealed inside solid stone off to the side of where they dig. Nothing in your world changes and nobody else sees it. A fair player can't know it's there; x-ray, chest ESP and freecam show it. Digging straight to one from 8+ blocks away is a "Honeypot" alert. The fakes are swapped back for the real blocks as soon as anything next to them is dug, so nobody ever sees one up close.

network

WARDEN NETWORK - confirmed cheaters, shared between Warden servers When your staff confirm a cheater (/warden confirm <player> <what>), Warden can share that, and show your staff when a player who joins was confirmed on other Warden servers. Only staff confirmations are shared, never automatic alerts. Shared: the player's account id and name, what they were confirmed for, and when. Never your server's name, address or license key.

freeze

/freeze: commands a frozen player may still use (to talk to staff). Everything else is blocked, so /spawn, /home or /tpa can't get them away.

reports

REPORTS - the review queue Players type /report <player> [what they did]. Warden files it with a recording of the last 30 seconds of what that player did and everything its checks know about them. Staff get a chat line with [Review]; /warden reports lists them (most-reported first) with Play recording, Watch, and a verdict: cheating, not cheating, unsure, or "false alert" (Warden was wrong: the evidence is saved in plugins/Warden/false-alerts for the developer). If another plugin already owns /report, players can use /wreport (or /warden:report).

history

HISTORY - what Warden remembers about each player across logouts and restarts Alerts, staff notes, confirmations, clears, freezes, mod scans and alert recordings, in plugins/Warden/history. See it with /warden history <player>; /warden info shows a summary. Anything older than keep-days is deleted automatically (at start-up and once a day), and so is old staff activity. Each player keeps at most 5 alert recordings. Lower it to use less disk.

alts

ALT DETECTION - accounts that joined from the same address Addresses are never stored, only a scramble of them that can't be turned back into an IP, and they stay on this server. /warden alts <player> lists every linked account (also from a player's page), and /warden info shows them. Addresses shared by more than 6 accounts (proxies, schools, VPNs) are ignored. Behind BungeeCord/Velocity, turn on IP forwarding, or every player has the proxy's address.

punish-buttons

PUNISH BUTTONS - in /warden info, buttons that fill in YOUR ban plugin's command in the staff member's chat box (they press Enter, with their own permissions). Warden never runs them itself. {player} = the player's name, {check} = what Warden caught them for. Remove a line to drop a button.

watch

WATCHING A PLAYER /warden watch puts staff in spectator next to the player. Warden has no vanish of its own: if the server has a vanish plugin (EssentialsX, SuperVanish, PremiumVanish or CMI) it is used, with the staff member's own permission for it, and going back makes them visible again. For another vanish plugin, put its commands here (no slash; {player} = the staff member's name).

wall-tracking

look-cone-degrees

staff-mod

Settings sent to every staff member's Warden mod while they are on this server. Set these once here and your whole staff team is configured; nobody edits files on their PC.