CheckHacks

Catch hackers by their mods. 100% server-side, no client mod needed.

Uses the Sign Translation Vulnerability (MC-265322), the same trick DonutSMP uses to catch cheaters. Signs only pop up for a split second, way too fast to read.

❓ What is CheckHacks?

CheckHacks is a server-side anticheat that figures out which mods a player is running by abusing the Sign Translation Vulnerability (MC-265322). The whole check takes a split second. Signs appear and disappear so fast that the player only catches a quick glimpse, and the editor closes before they can read a single line.

🔬 How it works

1. A check starts (manually, on join, or from an anticheat flag)
2. The plugin quietly places a few signs near the player
3. It writes special translation keys on them
4. The client opens and closes the sign editor in a split second
5. The plugin reads back what the client resolved, then removes the signs right away

Mods register their own translation keys, so a vanilla client and a modded client answer differently. That's how the plugin knows exactly what's installed.

👀 The player might spot a sign flashing for a few instants, but by the time they realize what happened, everything is already gone.

💡 One sign can check up to 3 mods. If there are more, signs get sent one after another with a delay you can configure.

✨ Features

🔍 Detection

• Runs fully server-side. No client mod, nothing for the player to install
• Signs stay visible for just a few instants, too fast to be read or screenshotted
• Three detection modes: METEOR, TRANSLATE, KEYBIND. Each mod automatically uses the right one
• Players with exploit protection show up as PROTECTED instead of a false negative
• Players who don't answer at all also count as PROTECTED (they're probably blocking packets)
• Add your own mods to detect in checkhacks.yml
• Bedrock players get skipped automatically if their name starts with your prefix (like . or *)

⚡ Automation

• Auto-check on join, with configurable delay and a first-join-only option
• Auto language check on join, with its own first-join-only option
• Hooks into Grim, Vulcan and Spartan. When they flag someone, a check starts on its own
• Per-player cooldown so automatic checks don't spam
• Different hack lists for normal checks, join checks and anticheat checks
• Run your own commands automatically on DETECTED, PROTECTED or clean results

📢 Alerts & Results

• Results go to everyone with the checkhacks.alerts permission, and each player can toggle them with /chalerts
• If you ran the check but don't have the alerts permission, you still get the result privately
• Every line shows the mod and what happened: DETECTED, NOT_DETECTED, PROTECTED, SKIPPED
• Results include who started the check and why (manual, join check, anticheat flag)

🌐 Web & Discord

• Built-in SQLite database. Every scan gets saved, no setup needed
• Web editor running on your server. Check past scans, browse players, start new checks, all from your browser
• Login works through one-time tokens from /cheditor, no passwords to remember
• Two separate Discord webhooks: one for hack detections, one for language checks
• Webhook placeholders: &name& &checker& &reason& &hacks& &results& &lang&

🎨 Customization

• Configs are split by job: config.yml for general settings, checkhacks.yml for mods, checklang.yml for languages
• Messages live in their own files, switch language with one line in the config
• Every message supports MiniMessage, a custom prefix and PlaceholderAPI

🔍 Detected Mods

➕ Want a mod added? Join the Discord and open a ticket.

⌨️ Commands

🔑 Permissions

⚙️ Configuration

plugins/CheckHacks/
├── config.yml          # General settings
├── checkhacks.yml      # Hack checks and custom mods
├── checklang.yml       # Language checks
├── messages/
│   ├── en.yml          # English messages
│   ├── it.yml          # Italian messages
│   └── ...             # de, es, fr, pt, ru, lolcat, uwu
└── database.db         # Scan history, created on its own

🖥️ Web Editor

The web editor runs straight on your server, no external hosting needed.

• 📊 Look through every past scan and result
• 👤 Browse checked players
• ▶️ Start new checks from your browser
• 🌍 See language check results
• 🔐 Locked behind one-time tokens from /cheditor

⚠️ Warning

Mod devs can patch their clients whenever they want and block or spoof this vulnerability. If that happens, detection for that specific client might stop working. I'll do my best to keep up with patches, find workarounds and keep adding new mods.

It's a cat and mouse game, not a one-time fix.

☕ Support Me

CheckHacks is free and always will be. If it saved your server from cheaters and you want to say thanks, you can buy me a coffee on PayPal. Every donation keeps the project alive and helps me stay ahead of mod patches.

📜 Credits & Support

Made by Branduzzo.

For support, feature requests or mod additions, join the Discord: