CheckHacks

---

🆕 What is new in 1.3.0

This is a pretty big update, so here is a quick rundown of what has changed:

• 10 new detections - we added Trouser Streak, Ui Utils, SeedCrackerX, Simple World Downloader, Glazed, Litematica, Item Scroller, Xaeros Minimap and a few more
• Auto updater - the plugin now checks GitHub when the server starts, but only if you have internet. If there is a newer version, anyone with checkhacks.update will get a message when they join. You just click it, it runs /checkhacksupdate, downloads the new jar, replaces the old one and asks you to restart. That is all
• Matrix support - we already supported Grim, Vulcan and Spartan, and now Matrix is included as well. You can enable or disable each one under detect-flag.anticheats.matrix
• DoubleCheck - if someone gets flagged as DETECTED or PROTECTED, we run a second confirmation scan right after. It really helps cut down on false positives
• About 3 times faster - we optimized the Folia scheduler, signs are now handled more efficiently and we lowered between-sign-ticks. A full scan finishes in roughly a third of the time it used to
• Fewer false flags - we hardened the whole evaluateResponse logic, including empty replies, the key + letter edge case, and the METEOR vs TRANSLATE vs KEYBIND exploit preventer check. Bedrock, Geyser and Floodgate skipping is also more reliable now
• Better webhooks - you can now enable Discord Components V2 with discord.use-components-v2: true. It sends a clean Container with your accent color, text blocks, a separator and a timestamp. If you prefer the old style, just set it to false and you will get the classic embeds
• Smarter rules - command-rules lets you set a command per mod and per result. We also added &hack& so you can write something like tempban %player% 7d Hack %hack% and it will expand to Meteor, Wurst if both were detected. It works with %hack%, &hack&, {hack}, and for global commands you get a comma separated list of all flagged hacks
• General optimizations - single SQLite connection with WAL, cached messages, async webhooks, cached reflection and NMS fixes for 1.21.4 and up. It just runs smoother and uses less resources

---

❓ So what is CheckHacks?

CheckHacks is a server side anticheat that can tell which mods a player is running without them having to install anything. It works by using the Sign Translation Vulnerability (MC-265322).

Here is how it works in practice:

1. You start a check, or it starts automatically when someone joins or your anticheat flags them
2. The plugin quietly places a couple of signs near them
3. It writes special translation keys on those signs
4. Their client opens the sign editor for a split second and then closes it
5. We read what their client sent back and immediately remove the signs

Every mod registers its own translation keys, so a vanilla client and a modded client will respond differently. That difference is what tells us exactly what they have installed.

👀 The player might see a sign flicker for a moment, but by the time they notice, it is already gone. It is too fast to read or screenshot.

💡 One sign can check up to 3 mods. If you have more, we just send them one after another. You can set the delay yourself.

---

✨ Features

🔍 Detection

• Fully server side, your players do not need to download anything
• Signs are visible for just a couple of ticks, so they cannot be read
• Three modes, METEOR, TRANSLATE, KEYBIND, and each mod automatically uses the right one
• If someone has exploit protection, they show up as PROTECTED instead of being marked as clean by mistake
• If someone does not respond at all, they are also marked as PROTECTED. They are probably blocking packets
• The DoubleCheck system rechecks every DETECTED or PROTECTED result to avoid false positives
• You can add your own custom mods to detect in checkhacks.yml
• Bedrock players are skipped automatically if their name starts with your prefix like . or *

⚡ Automation

• Auto check on join, with a delay you can configure and an option to run only on first join
• Same for auto language check, also with a first join only option
• Hooks directly into Grim, Vulcan, Spartan and Matrix. If they flag someone, we check that player right away
• Cooldown per player so you do not get spammed with automatic checks
• You can set different hack lists for normal checks, join checks and anticheat checks
• Run your own commands when someone is DETECTED, PROTECTED or clean, plus per mod command-rules with a result filter
• Simple placeholders for commands: %player%, %hack%, &hack&, {hack}. If two hacks are found you will get Meteor, Wurst automatically

🔄 Auto Updater

• On startup we check https://github.com/branduzzo/CheckHacks/releases/latest in the background. If you are offline we just skip it, nothing gets spammed in console
• If we find a newer vX.Y.Z, everyone with checkhacks.update will see a message when they join: CheckHacks 1.3.1 is available! Click here to download. It is already translated in every messages/*.yml
• If they click it, it runs /checkhacksupdate, downloads CheckHacks-X.Y.Z.jar into plugins/, backs up or removes the old jar and says Download completed! Restart the server
• You need checkhacks.update to see the message and to run the command. It is already included in checkhacks.* so server operators have it by default

📢 Alerts and Results

• Results go to everyone with checkhacks.alerts, and anyone can toggle them with /chalerts
• If you started the check but do not have the alerts permission, you still get the result in private so you do not miss it
• Every line tells you the mod and what happened: DETECTED, NOT_DETECTED, PROTECTED, SKIPPED
• We also show who started the check and why, like manual check, join check or anticheat flag

🌐 Web and Discord

• SQLite is built in. Every scan gets saved, you do not need to set anything up
• Web editor runs right on your server. You can browse old scans, look up players and start new checks from your browser
• Login is a one time token from /cheditor. No passwords to remember
• Two separate Discord webhooks, one for hack checks and one for language checks, both now with the Components V2 toggle
• Webhook placeholders you can use: &name& &checker& &reason& &hacks& &results& &lang&
• With Components V2 we send flags: 32768 Container with your accent_color, Text Display blocks, a Separator and a timestamp footer

🎨 Customization

• Configs are split up cleanly: config.yml for general settings, checkhacks.yml for mods, checklang.yml for languages
• Every message is in its own file, you can switch language with one line in the config
• Everything supports MiniMessage, your own prefix and PlaceholderAPI
• 9 languages included plus all the updater strings: update-available, update-downloading, update-complete, update-restart-required, update-failed, update-no-update

🌍 Languages included (click to expand)

en.yml · it.yml · de.yml · es.yml · fr.yml · pt.yml · br.yml · ru.yml · lolcat.yml · uwu.yml

---

🔍 Detected Mods

Mod	Mode
Meteor Client	METEOR
Freecam	KEYBIND
XRay (Fabric)	KEYBIND
ChestESP	KEYBIND
KillAura (Fabric)	KEYBIND
AutoFish	KEYBIND
Lumina	KEYBIND
AutoSwitch	KEYBIND
BleachHack	TRANSLATE
Coffee Client	TRANSLATE
World Downloader	TRANSLATE
AutoClicker (Fabric)	TRANSLATE
AntiAFK	TRANSLATE
Auto Clicker (p1k0chu)	KEYBIND
Trouser Streak	TRANSLATE
Trouser Streak (NewerNewChunks)	TRANSLATE
Trouser Streak (AnHero)	TRANSLATE
Ui Utils	TRANSLATE
SeedCrackerX	TRANSLATE
Simple World Downloader	TRANSLATE
Glazed	TRANSLATE
Litematica	TRANSLATE
Item Scroller	TRANSLATE
Xaeros Minimap	TRANSLATE

➕ Want us to add a mod? Join our Discord and open a ticket, we will take care of it.

---

🎬 Showcase

▶️ Click to watch it on YouTube (3:15).

---

⌨️ Commands

Command	What it does
/checkhacks <player>	Checks every mod you have configured
/checkhacks <player> meteor-client,freecam	Only checks the mods you list
/checklang <player>	Tries to figure out their client language using signs
/checklang <player> en_us,it_it	Only checks those languages
/cheditor	Gives you a one time link to the web editor
/chalerts	Toggles detection alerts on or off (you can also use /checkalerts or /alerts)
/checkhacksupdate	Gets the latest CheckHacks from GitHub (needs checkhacks.update) - just click the update message
/chreload	Reloads all configs, no restart needed

---

🔑 Permissions

Permission	What it is for
checkhacks.check	Lets you run hack checks
checkhacks.checklang	Lets you run language checks
checkhacks.reload	Lets you reload configs
checkhacks.alerts	Lets you get alerts and toggle them
checkhacks.editor	Lets you create web editor tokens
checkhacks.update	Lets you see update notices and run /checkhacksupdate
checkhacks.*	Gives all of the above

---

⚙️ Configuration

plugins/CheckHacks/
├── config.yml          # General stuff + discord.use-components-v2 + prefix and language
├── checkhacks.yml      # Hack checks, your custom mods, detect-flag, command-if-*, command-rules, doublecheck, matrix
├── checklang.yml       # Language checks + discord.use-components-v2
├── messages/
│   ├── en.yml          # English messages plus all the update-* keys
│   ├── it.yml          # Italian
│   └── ...             # de, es, fr, br, ru, lolcat, uwu
└── database.db         # Scan history, it just shows up by itself

Stuff you will actually use

# config.yml and checklang.yml
discord:
  use-components-v2: true # false gives you classic embeds, true gives you the new Components V2 Container

# checkhacks.yml
detect-flag:
  anticheats: { grim: true, vulcan: true, spartan: true, matrix: true }
doublecheck: true
timeout-ticks: 200
between-sign-ticks: 5 # lower it if you want that faster scan speed
command-if-positive: { enabled: false, command: "tempban %player% 14d Cheating &hack&" }
command-rules:
  meteorclient1: { mod: meteorclient, result: DETECTED, command: "tempban %player% 31d Meteor &hack&" }
# you can use %player%, %hack%, &hack&, {hack}, {player} - they all work

---

🖥️ Web Editor

The web editor runs right on your server, you do not need to host it somewhere else.

• 📊 Scroll through every old scan and result
• 👤 Look up players you checked before
• ▶️ Start new checks right from your browser
• 🌍 Check language results too
• 🔐 It is locked behind one time tokens from /cheditor, so no shared password

---

⚠️ Heads up

Mod developers can patch their clients whenever they want and try to block this trick. If they do, detection for that specific client might stop working for a while. We keep chasing patches, finding bypasses and adding new mods as they come out.

It is a cat and mouse game, not a one time fix.

---

☕ Support Me

CheckHacks will always be free. If it saved your server from cheaters and you want to say thanks, you can buy me a coffee on PayPal. Every donation keeps this project going and helps me stay ahead of those mod patches.

---

📜 Credits and Support

Made by Branduzzo.

Need help, want to request a feature or need a mod added? Come hang out on Discord:

---