guide · anti-cheat
How FiveM anti-cheat actually works
On FiveM, “anti-cheat” is not a single box. The client runs on the player’s machine, resource code is open, and no single tool can see every kind of cheat. What serious servers do is not hunt for one magic solution but stack layers that cover each other’s blind spots. This guide walks through those layers, what each one misses, and where the identity layer fits.
Why anti-cheat is hard on FiveM
The problem is architectural. The FiveM client runs on the player’s computer, which means the cheat software sits on the same machine, at the same privilege, as the defence. On top of that, most of the resources running your server are Lua and readable; an attacker can see exactly what they are playing against. This does not mean you are defenceless — it means there is no single wall you can install and forget.
The practical consequence: protection is a process, not a product. The four layers below are how real servers build that process. None is sufficient alone; together, they make a cheater’s job expensive and risky.
Four layers, and each one’s blind spot
Client-side detection
Resources that try to catch the cheat running on the player’s machine: mod menus, injectors, known signatures, abnormal function calls. It catches a great deal. Its blind spot: memory-only cheats, obfuscated injection, and an attacker reading the source and working around it. And because it runs on the machine, whoever controls that machine can work against it.
Server-side behaviour
Checks the server has authority over: impossible speed, teleporting, money or items the server never granted, events that should never be called. It is hard to bypass because it does not trust the client. Its blind spot: cheats that play “human” — light aim assist, exploits that stay near the rules — sit under the behaviour threshold.
Connect-time screening
A check performed as the player connects, before they enter the game. Unlike in-game detection, it looks not at what the person does this session but at who they are. It stops a known identity at the door. Its blind spot: it only catches identities it recognises — without an archive of history behind it, a new face is invisible to it.
Cross-server identity intelligence
The archive that gives connect-time screening its power. A single server’s own ban list knows only what it caught; the identity layer merges the records of many communities. Even if a player appears on your server for the first time, if they are banned elsewhere, carry a customer role in a cheat community, or are the alt of a banned account, this layer knows. Its blind spot: it only sees public traces in monitored communities; a cheater who has left no trace anywhere, it cannot see.
How the layers work together
The strength is in the overlap. A player who plays clean then turns cheats on is caught by client-side detection and behaviour checks. A player who is banned elsewhere and should be recognised the moment they connect is caught by the identity layer and connect-time screening — before the first shot. The first asks “what are they doing now”, the second “what did they do before”, and a cheater stays inside only if they can beat both at once.
So the right question is not which layer to swap for another, but which one is missing. Most servers already have the first two (a detection resource plus txAdmin/framework checks). What is usually missing is the third and fourth — because they require a shared archive that no single server can build on its own.
Where Argos fits — and where it does not
Argos is the third and fourth layers: identity intelligence and connect-time screening. Guard screens every connecting player against the archive — cross-server ban records, cheat-community memberships, customer and seller roles, alt-account clusters — and applies the action you choose: alert, kick, or reject the connection. The archive currently spans 262,000 tracked identities, 29,000+ ban records and 35 monitored communities, which is exactly the kind of data no single server can gather alone.
What Argos is NOT
Argos is not a client-side anti-cheat. It does not detect mod menus, injectors, memory tampering or aim cheats; nothing is installed on the player’s machine and it does not watch in-game behaviour. It does not replace the first two layers — it completes them. You still need a client-side detection resource and server-side behaviour checks on your server; Argos adds the history those layers structurally cannot see.
free tier · no card required
Frequently asked
Is there a single anti-cheat that is enough on FiveM?
No. The FiveM client runs on the player’s machine and resource code is open even on the server side; no single layer can see every kind of cheat. Serious servers solve it with layers: client-side detection, server-side behaviour checks, connect-time screening, and cross-server identity history. Each layer covers another’s blind spot.
Is Argos a client-side anti-cheat?
No, and the distinction matters. Argos does not detect mod menus, injectors, memory tampering or running processes; nothing is installed on the player’s computer. Argos is the identity layer: it screens a connecting player against cross-server ban records, cheat-community memberships and alt-account links. If you want client-side detection, separate resources exist for that; Argos does not replace them, it runs alongside them.
I already run txAdmin and a detection resource — what does Argos add?
txAdmin and detection resources look at the player’s current session — what is running on the machine, how they behave in game. Argos looks at the player’s history before the session: are they banned on other servers, do they hold a customer role in cheat-selling communities, are they the alt of a banned account. One sees the present, the other the past. The first catches a player who plays clean then turns cheats on; the second catches the one who should be recognised the moment they connect.
Does connect-time screening slow players down?
Argos Guard screening runs during the connection handshake and the decision is measured in milliseconds — players do not notice it. For a player over the threshold you choose the action: alert only, kick, or reject the connection. A rejected player never enters the server, so there is no in-game delay either.
Which layer catches someone who bought a cheat but was never banned?
Client-side detection cannot — they may not have turned the cheat on yet. A ban list cannot — they have not been caught yet. The only trace that makes them visible is the customer role in the cheat sellers’ Discord, and that shows only at the identity layer. That is why Argos reads those roles.
Can FiveM anti-cheat be bypassed entirely?
Any single layer can always be bypassed: client-side detection by memory-only cheats, behaviour checks by careful play, a single server’s ban list by a fresh account. Stacking layers does not make bypass impossible, but it makes it expensive — and the identity layer is the hardest to beat, because a new Discord account cannot rewrite its history, its alt links or its customer roles.
Related: Argos Guard — connect-time screening · Pre-whitelist vetting · Player lookup · Alt account detection