The best Minecraft server anti cheat in 2026, and how to run it without banning honest players

The best Minecraft server anti cheat for most owners in 2026 is GrimAC, and the reason is not that it is free. It is that it is open source, updated for current Minecraft versions, built around movement prediction rather than hard-coded limits, and honest about what it can do. The paid options, Vulcan, Matrix and the subscription-based Polar, are worth their money on servers with a specific cheating problem, a large PvP population, or a staff team that wants a vendor to call. Themis is the one to look at if most of your players are on Bedrock through Geyser.

Whatever you pick, the first week matters more than the plugin. Every anti-cheat ships with thresholds that were tuned on someone else's server, and every one of them will flag a lagging player or a Bedrock player if you let it. Run it in alert-only mode, read the alerts, then turn on punishments for the checks you have watched.

What an anti-cheat can and cannot catch

An anti-cheat sees packets: where the player says they are, how fast they clicked, what they hit. It compares that to what the game rules allow. That means:

The practical consequence: an anti-cheat reduces cheating, it does not end it, and it works best next to staff who can spectate and a reporting path players actually use. Our staff guide covers the human half.

The options, with status checked

Statuses and prices as of the end of September 2026. Check the linked pages before buying; this market changes.

The Bedrock column comes from Geyser's community-compiled compatibility list, which the Geyser team says to use at your own risk. Every paid vendor above sells a Discord support channel as part of the price; on a free plugin, the GitHub issues page is your support.

Grim: install and the first three things to change

1. Download the jar from Grim's Modrinth or GitHub releases page and drop it in plugins/. It bundles what it needs. Restart the server; a reload is not enough.
2. If you run Geyser, install Floodgate on this backend, not only on the proxy. Grim asks the Floodgate API "is this player Bedrock?" and if Floodgate is not on the same server, the answer is always no, and every Bedrock player gets flagged for movement they cannot avoid.
3. Give staff the alert permission so they see flags in chat. Grim's alerts are the whole point of week one.
4. Open plugins/GrimAC/punishments.yml and make sure every group only alerts. The file is a list of check groups; each has a violation timeout, the checks it covers, and commands that run at thresholds.

# plugins/GrimAC/punishments.yml (one group, alert-only)
Punishments:
  Simulation:
    remove-violations-after: 300
    checks:
      - "Simulation"
      - "GroundSpoof"
      - "Timer"
      - "!NegativeTimer"
      - "NoFall"
    commands:
      - "100:40 [alert]"
      - "100:100 [webhook]"
      # - "200:0 kick %player% incorrect movement!"   (enable after a week of reading alerts)

The syntax is threshold:interval command: the first number is how many unexpired violations a player needs before the line fires, the second is how often it fires again while they keep flagging. remove-violations-after is the number of seconds until old violations expire. [alert] messages staff, [webhook] posts to the Discord webhook in discord.yml, and anything else is run as a console command with %player%, %check% and %vl% filled in. Grim's own punishments wiki page documents every group.

False positives, and how to tune them out

A false positive is not the player's fault, and a ban for one costs you more than a cheater ever will. The usual causes, and the fix for each:

• Server lag. When TPS drops, movement arrives in bursts and prediction breaks. Fix the lag first; our lag guide is the order to do it in. No threshold change compensates for a server at 12 TPS.
• High ping. Players at 300 ms trigger timer and knockback checks. Grim compensates, but look at the ping of anyone who flags before you act. A staff /ping check is a one-second habit.
• Version translation. Players on old clients through ViaVersion move slightly differently. Grim supports 1.8 clients directly and lists ViaVersion as recommended, but a spike of flags after you widen the version range is a tuning job, not a cheating wave.
• Bedrock players. Covered below. Symptom: every flag has a dot or a prefix from Floodgate in the name.
• Plugins that move players. Elytra boosts, custom mounts, jump pads and knockback plugins produce motion the anti-cheat did not predict. Exempt the check in that world or region, or lower the punishment for that group rather than for everyone.
• Thresholds copied from a PvP server. A practice server bans at a low violation count because its players are all fighting; a survival server should not. Raise the threshold before you lower it.

Bedrock and Geyser players

Bedrock clients move differently: different sprint acceleration, different jump timing, touch controls that produce inputs Java never sends. A Java anti-cheat that treats them as Java players will flag them constantly. Three approaches, in order of how much protection you keep:

1. Use an anti-cheat that understands Bedrock. Geyser's list names Themis and Boar as fully compatible. If most of your players are Bedrock, that is the deciding factor.
2. Exempt Bedrock players from movement checks. This is Grim's default when Floodgate is on the backend. You keep reach and packet checks and lose movement checks for that group.
3. Do nothing and ban your Bedrock players by accident. Common, and the fastest way to lose the crossplay audience. On our list, Java servers that also answer a Bedrock ping have a median of 26 players online against 6 for Java-only servers.

The crossplay setup, including where Floodgate lives on a Velocity network, is in the crossplay guide.

Pair it with staff tools and a report path

An anti-cheat is one input. The servers that actually keep cheaters out combine it with:

• A Discord webhook for alerts so staff off the server still see patterns. Grim's [webhook] command is built in; most paid options have the same.
• A way for players to report that takes ten seconds: a /report command from any moderation plugin, or a pinned Discord form. Players report what the anti-cheat cannot see, which is exactly the X-ray and ESP list above.
• Spectate before you ban. Vanish into spectator on a flagged player for two minutes. Killaura and fly are obvious to a human; a laggy player is too.
• Written rules that say what happens. "Cheating is a permanent ban, appeals in Discord" in your rules stops the argument before it starts.
• Ban with evidence. The alert log line, the spectate clip, the date. Appeals go faster and your staff stay consistent.

Why "no anti cheat" servers exist

Some owners run without one on purpose. Anarchy servers (80 on our list) treat hacked clients as part of the game, and their players pick them for that; our anarchy guide explains the appeal. Creative and build servers have little to protect. Small whitelisted SMPs with ten friends have a social anti-cheat that works better than any plugin. And some technical servers turn anti-cheat off because their players use movement mods for legitimate reasons and the flags are pure noise.

If you go that route, say so in your listing description. Players searching for a no-anti-cheat server are a real audience, and players who assume every server has one deserve to know before they join. Conversely, if you do run one, a single line ("GrimAC, alerts reviewed by staff") answers a question many players have and takes you toward the 250-character description that counts for listing strength. Add or claim your listing from its server page to set it.

Quick questions