Signed event transport
Protected events travel in an HMAC-SHA256 envelope bound to the session, a monotonic counter, the calling resource and the exact payload. Forged and replayed triggers are rejected before your handler runs.
Anti-cheat for FiveM
Stop trusting the client.
Enforce on the server.
ac-stuck signs every protected event, checks gameplay against data your server owns, and fails closed when the guard goes quiet. Cheats get loud. Your players keep playing.
- 128
- counter replay window
[ac-stuck] license: verified :: ip 203.0.113.24 :: lifetime
[ac-stuck] secure transport online :: window=128
[ac-stuck] heartbeat health online :: interval=5000ms
[ac-stuck] Ghost secure_bad_token (+30) score=30
[ac-stuck] kick Ghost :: secure_bad_tokenWhat it enforces
Every decision runs where the cheat can't reach it
A Lua executor lives inside the player's game. ac-stuck doesn't try to win a race in there; it moves the decisions to your server and treats client reports as evidence, not proof.
Discord logging & reports
Every detection and action goes to your Discord with the player's license ID, paced under Discord's rate limit, plus a local reports file for review.
How it works
From purchase to protected in four steps
- 1
Purchase
Your license is created automatically and you receive the ac-stuck buyer role on Discord.
- 2
Register your server IP
Sign in with Discord, open the dashboard and set the public IP of your FiveM server.
- 3
Install
Drop
ac-stuckinto your resources and add your license key toserver.cfg. - 4
Verified at boot
The loader checks your key and server IP with the ac-stuck API, then the guard starts. Wrong IP? It tells you exactly which one it saw.
ensure ac-stuck
set ac-stuck_license "ACS-XXXXX-XXXXX-XXXXX-XXXXX"
add_ace group.admin ac-stuck.bypass allow
add_ace group.admin ac-stuck.admin allowStraight talk
No magic, no kernel driver
Nothing written in Lua can stop kernel-level cheats, and we won't pretend otherwise. ac-stuck closes the cheap attack classes (forged events, replays, event spam, invisible explosions, injected resources) and makes the rest loud enough to act on. Your server stays the source of truth.
- Ships in dry-run: score-based kicks and bans are only logged until you switch them on
- Every detection is posted to your Discord with the player's license ID
- Kicks and bans are written to a local report file for review
- Staff are exempted with a single ACE permission
FAQ
Questions server owners ask
Do I need txAdmin?
No. txAdmin is used for permanent bans and for the optional fail-closed watchdog. Without it, ac-stuck still guards, scores and kicks.
Can I move my server to a new IP?
Yes. Update the IP in your dashboard, wait about a minute and restart the server. You can change the IP once every 3 hours, so one license can't hop between servers.
What happens if the ac-stuck API is down?
A server that has already been verified keeps running for up to 24 hours. A fresh start keeps retrying for 10 minutes before the guard stops.
Can I test it before it starts kicking players?
Yes. It ships in dry-run mode: score-based kicks and bans are only logged. Review the console and your Discord log, tune the thresholds for your server, then switch enforcement on.
What does the Discord login ask for?
Your username, avatar and email to create your account, and permission to add you to the ac-stuck Discord server so your buyer role can be applied.
Ready to lock your server down?
Sign in with Discord to create your account. Your license appears in the dashboard as soon as your purchase is confirmed.
Login with Discord