Detect and fight the exploitation of various flaws/bugs in Minecraft!

Features Permissions Commands Configuration Jenkins


NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.

NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.

Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).

NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.

The following plugins might be useful to have a look at.

CompatNoCheatPlus (cncp)

Make plugins like mcMMO, Citizens, MagicSpells or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or ticket request for cncp.


Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have".

Downloads and History of Changes

  • Download officially approved versions on the Files page at BukkitDev.
  • Development builds have been moved over to the Jenkins at EcoCityCraft.
  • Do not download from any other source, do not use jars other people send you.
  • Changes by build number can be examined in the Jenkins changes list.
  • All commits can be seen in the GitHub commit history.
  • Plugin statistics are no longer reported to


Documentation Resources

Contact us

  • Quick questions can be asked on this page,
    or on IRC (Server: | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC)
  • For real issues or feature requests please create a new ticket or add to an existing ticket.
  • To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.

Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).

You must login to post a comment. Don't have an account? Register to get one!

  • Avatar of ceagle2 ceagle2 Jul 05, 2015 at 22:21 UTC - 0 likes

    @asofold: Go Good thing you found that out - thank you for that and in general for being so public with all those more or less internal things. :-)

    If also Slimeblock elevators were detectable more easily for NCP, so SurvivalFly wouldn't stop them from working (I absolutely understand that it's hard to detect, since you've explained it to me before), I could finally put SurvivalFly back on active duty. :) We just recently had a few people who love their slimeblock elevators, and they even wondered why slimeblock elevators actually work properly on our server. It's just that they trigger 12k SurvivalFly VLs with them, which is confusing at times. ;-) But well, everything else works perfectly fine, so... NCP is excellent the way it is. :-)

  • Avatar of asofold asofold Jul 05, 2015 at 22:03 UTC - 0 likes

    @ceagle2: Go

    I can confirm the problem is on Spigot/CraftBukkit side built a moment ago - it's the "to" location of the PlayerTeleportEvent and the "last location" used for the "from" location of a PlayerMoveEvent. Those are set wrongly - the Minecraft entity is set to the correct location. Just plugins using the location of the teleport or checking the moving event (from .... to) have an issue here, in vanilla you could just move normally.


    Latest beta release (+ 1.8.3, approved) NoCheatPlus 3.12.0-RC-sASO-b813
    (Development builds, 1.8: Jenkins)

  • Avatar of ceagle2 ceagle2 Jul 05, 2015 at 21:51 UTC - 0 likes

    @asofold: Go

    Whoa, that's the issue then. And it's probably a Mojang-sided issue - because when bukkit:tp was still part of Spigot, it worked flawlessly, even though it lacked rotation parameters. I wonder... is it the same with the latest Vanilla server software? I don't really have the means to test that without any plugin at all.

  • Avatar of asofold asofold Jul 05, 2015 at 18:13 UTC - 0 likes

    @ceagle2: Go

    With my tests, the command "tp @p ~ 255 ~" would teleport an opped player (!) to the y coordiante 255 leaving x and z as is, while it would teleport to 0, 255, 0 if you are not OP. With 1.8.7 Spigot - clearly a bug.

    Last edited Jul 05, 2015 by asofold
  • Avatar of ceagle2 ceagle2 Jul 05, 2015 at 15:12 UTC - 0 likes

    @asofold: Go Yup, absolutely all teleports are initiated using Commandblocks. Concerning the z +3.85 teleport, there are multiple Commandblocks doing it at the same time, so potentially upto two of them could affect the player within the same server tick. Each one contains: /tp @a[r=2,ry=-90,rym=90,m=0] tilde0 tilde0 tilde3.85

    But the issue is the same for situations where only a single Commandblock-TP would hit a player.

    Edit: Damn, the tilde sign isn't being rendered here. I just replaced them.

    Last edited Jul 05, 2015 by ceagle2
  • Avatar of chrishillz chrishillz Jul 05, 2015 at 06:27 UTC - 0 likes

    @asofold: Go

    Well thought out answer – makes sense. It's just a shame, I've always thought, that security was such an afterthought with Minecraft. It's the Windows of games, think about it...

  • Avatar of asofold asofold Jul 04, 2015 at 20:26 UTC - 0 likes

    @ceagle2: Go

    It clearly looks like the server is firing the event and updating the PlayerConection to the relative amount of the position change and fires the teleport event with that as the target location as well, while the player itself is reset to the correctly calculated position.

    Should be worth a ticket with spigot. I'll ask on spigot-dev IRC later.

    Was it command blocks for the relative teleport?

    Last edited Jul 04, 2015 by asofold
  • Avatar of ceagle2 ceagle2 Jul 04, 2015 at 19:35 UTC - 0 likes

    @asofold: Go

    Building the latest Spigot version every 2-4 days - the debug log has been created with the latest one running, according to /bukkit:ver. (git-Spigot-f928e7a-e91aed8)

  • Avatar of asofold asofold Jul 04, 2015 at 17:05 UTC - 0 likes

    @ceagle2: Go

    Wonderful - allviolations + trace really shows the details in this case :) .

    This (almost - because there could be other plugins interfering) certainly is a server side bug. It seems the server is setting the "last location" of the player to the relative amount of the teleport and is also passing that to the teleport event, resulting in "from" in the moving event showing the 0,0, 3.85 as well as the teleport event just before showing that coordinates. The server side must pass the correctly calculated coordinates there.

    Are you running the latest Spigot version available?

  • Avatar of ceagle2 ceagle2 Jul 04, 2015 at 15:39 UTC - 0 likes

    @asofold: Go It contains mostly Non-Violations, and there are a few SurvivalFly Violations with about 150k upon relativ teleports like "/tp 0 0 3.85" - since teleported players seem to teleport to about 0/0/0 for a brief moment, there may be something that ignores the relative nature of the teleports. Don't know if NCP is the cause for those 0/0 teleports, but it even happens with NCP as the only plugin. Might still be something CB- or Spigot-related though.


Date created
Apr 02, 2012
Last update
Mar 21, 2015
Development stage
GNU General Public License version 3 (GPLv3)
Curse link
Recent files