Detect and fight the exploitation of various flaws/bugs in Minecraft!

Features Permissions Commands Configuration Jenkins


NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.

NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.

Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).

NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.

The following plugins might be useful to have a look at.

CompatNoCheatPlus (cncp)

Make plugins like mcMMO, Citizens, MagicSpells or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or ticket request for cncp.


Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have".

Downloads and History of Changes

  • Download officially approved versions on the Files page at BukkitDev.
  • Development builds have been moved over to the Jenkins at EcoCityCraft.
  • Do not download from any other source, do not use jars other people send you.
  • Changes by build number can be examined in the Jenkins changes list.
  • All commits can be seen in the GitHub commit history.
  • Plugin statistics are no longer reported to


Documentation Resources

Contact us

  • Quick questions can be asked on this page,
    or on IRC (Server: | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC)
  • For real issues or feature requests please create a new ticket or add to an existing ticket.
  • To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.

Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).

You must login to post a comment. Don't have an account? Register to get one!

  • Avatar of Adrenalineq Adrenalineq Oct 22, 2012 at 14:57 UTC - 0 likes
    • Bukkit: 1.3.2 R2.0
    • NoCheatPlus: v3.7.5-b164
    • CommandsEx: v1.98
    2012-10-21 18:48:21 [SEVERE] Could not pass event PlayerTeleportEvent to NoCheatPlus v3.7.5-b164
    	at org.bukkit.plugin.RegisteredListener.callEvent(
    	at org.bukkit.plugin.SimplePluginManager.fireEvent(
    	at org.bukkit.plugin.SimplePluginManager.callEvent(
    	at org.bukkit.craftbukkit.entity.CraftPlayer.teleport(
    	at org.bukkit.craftbukkit.entity.CraftEntity.teleport(
    	at com.github.zathrus_writer.commandsex.helpers.Common$
    	at org.bukkit.craftbukkit.scheduler.CraftScheduler.mainThreadHeartbeat(
    	at net.minecraft.server.MinecraftServer.q(
    	at net.minecraft.server.DedicatedServer.q(
    	at net.minecraft.server.MinecraftServer.p(
    Caused by: java.lang.NullPointerException
    	at fr.neatmonster.nocheatplus.checks.moving.MovingData.resetPositions(
    	at fr.neatmonster.nocheatplus.checks.moving.MovingListener.onPlayerTeleport(
    	at sun.reflect.GeneratedMethodAccessor27.invoke(Unknown Source)
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(
    	at java.lang.reflect.Method.invoke(
    	... 13 more
  • Avatar of asofold asofold Oct 22, 2012 at 14:56 UTC - 0 likes

    @ShakyTom: Go

    Thanks for notice, i will add some basic information very soon.

    At a glance: The minimum and maximum penalty value for yawrate means milliseconds that the player can't attack. Setting to such llow values might still prevent some force-field use in case of the player turning a lot automatically, but the very short durations mean that the player can soon hit again, so the efficiency against cheating will be lower.


    Latest release (1.7.2-1.7.10, approved) NoCheatPlus 3.11.1-RC-sMD5NET-b743
    (Development builds, 1.8: Jenkins)

  • Avatar of ShakyTom ShakyTom Oct 22, 2012 at 10:10 UTC - 0 likes

    Where can I find information on what all of these actually mean?

          active: true
          level: 300
          actions: cancel log:improbable:2:8:f
          active: true
            always: false
            falldistance: true
            join: -1
          - FALL
            all: 0
          rate: 380
            factor: 1.0
            minimum: 10
            maximum: 20
          improbable: true

    I can't find much on the pinboard.

    Owner and developer of

  • Avatar of MyPictures MyPictures Oct 21, 2012 at 12:55 UTC - 0 likes

    @CubieX: Go

    Does that happen to every player? CB and NC+ version? TPS ?

    You could also make a well explained ticket, would help a lot :)

    Last edited Oct 21, 2012 by MyPictures


  • Avatar of CubieX CubieX Oct 21, 2012 at 10:34 UTC - 0 likes

    NCP blocks some movemets that are legit. For example: Build a block on the ground, build another one 3 blocks ahead and 1 block to the left of the first block. Make this second pillar 2 blocks high.

    When you now try to jump from the lower to the higher pillar (by quickly using "sprint" to be fast enough), NCP resets the player before he reaches the higher block.

    This often happens on sprint/jump actions of players who do not have override permissions for NCPs moving checks. Can something be done to prevent these false positives without deactivating the moving checks completely? Because some players are complaining because their "jump and run" parcours are not usable because of this.

  • Avatar of asofold asofold Oct 21, 2012 at 03:22 UTC - 0 likes

    @LlmDl: Go

    Config is being updated somehow. We are not at full man-power resources right now, though.

    Minecraft / CB does hold you back for repeaters some times though, it might get confused with NCP (unless passable alerts).

    Some server / client mods also optimize things like that by allowing moving onto those blocks freely, which then mght conflict with NCP (simlar with fence-corners and SPout it seems).

  • Avatar of LlmDl LlmDl Oct 21, 2012 at 03:17 UTC - 0 likes

    @asofold: Go I did use /ncp reload, twice after it didnt work. The players were running over redstone repeaters and being TP'd back to their starting point. I guess I'll be updating to your dev sooner than later.

    A comment meant to be constructive only, the configuration page is a bit lacking, maybe outdated. If I knew the plugin better I would be willing to help out more. Do you maintain an IRC channel you're active on?

    Edit: I did start with a completely fresh config, I always do when I update NCP.

    Last edited Oct 21, 2012 by LlmDl
  • Avatar of asofold asofold Oct 20, 2012 at 23:57 UTC - 0 likes

    @chrishillz: Go

    Level 90 for normal is pretty fast, though, also banning right away.

    You might set player.prefixes to active, so the "hi"-"there" spam will get faster banning, in that case however you will have to test if the levels have to be raised slightly, because prefixes will add a little bit on the average message.

    For testing out the scores you might set "debug: true" in the chat or chat.text sections, then info about scoring will be printed to the console before each message. Probably that is too much undocumented as well.

    The next iterations for NCP will focus on configuration and documentation issues unless there is other critical stuff...

  • Avatar of chrishillz chrishillz Oct 20, 2012 at 23:46 UTC - 0 likes

    @asofold: Go

    Yeah I think I know what you mean, but it's hard to configure something when you don't know what all of the values mean since it's not documented. If you have time, would you mind sending me a copy of a configuration that would ban players that are spamming chat as fast as possible?

    I set up something like this so far:

          active: true
              minimum: 0.0
              factor: 0.9
              weight: 6
              level: 90
              actions: cancel cmd:bannormal:0:5
              minimum: 2.0
              factor: 0.7
              weight: 3.0
              level: 20.0
              actions: cancel cmd:banfast:0:5
    Last edited Oct 20, 2012 by chrishillz: code
  • Avatar of asofold asofold Oct 20, 2012 at 22:24 UTC - 0 likes

    @chrishillz: Go

    True, though that is something you could try to tackle with the extended engine use !

    The chat.text.player and sections allow to enable extended checking methods which add extra weights for word repetition and/or similarity. For the given example the simple words engine could be activated and would make the repetition of words more expensive. Those are currently paused in development because of other stuff being more important, but they do work, though they take some more memory. The best trade-off might be the prefixes method, the similarity method is heaviest in terms of CPU while words is just a dumb 1:1 comparison of words and prefixes just compares letters (somewhat pre digested) and assigns a weight on base of how many match.

    The extended methods all use the time as weighting factor which has passed since last use of that word/letter, and they also account for some number of words/letters, global usually thousand(s), player usually few hundreds at most.

    @Liger_XT5: Go

    So fixing the config did it?

    Last edited Oct 20, 2012 by asofold


Date created
Apr 02, 2012
Last update
Sep 21, 2014
Development stage
GNU General Public License version 3 (GPLv3)
Curse link
Recent files