FiveM server security glossary: 34 terms every server owner should know

FiveM security discussions are full of jargon. This glossary explains the terms you will meet when you run a server, hire a developer or compare anticheats. Each entry is short; follow the links for depth.

Platform

• Cfx.re: The company and platform behind FiveM (GTA V) and RedM (Red Dead Redemption 2). Runs the server list, the forum and the portal where server licence keys are created.
• FXServer: The server software that runs a FiveM or RedM server. Updated through numbered builds called artifacts; Cfx.re marks one as recommended.
• txAdmin: The web panel that comes with FXServer: restarts, console, player management, bans, whitelist and staff accounts. Not an anticheat. See txAdmin and an anticheat.
• Resource: A folder with an fxmanifest.lua that adds scripts, maps, vehicles or UI to the server. Started with ensure in server.cfg.
• Framework: A base resource that provides characters, money, jobs and inventories: ESX, QBCore, Qbox, vRP, NDCore. Servers without one are called standalone.
• OneSync: FiveM's server-side state sync. With OneSync on, the server knows about every player and entity, which supports more players and makes server-side checks possible. Turn it on with set onesync on.
• Routing bucket: A separate "dimension" of the game world on the same server. Players and entities in different buckets don't see each other. Used for instances, apartments and character selection.

Scripting

• Net event: A message between client and server, registered with RegisterNetEvent. Any client can trigger any server event with any arguments, which makes them the most common exploit target. See securing FiveM server events.
• Callback: A request-response pair built on net events (ESX server callbacks, QBCore callbacks, ox_lib callbacks). Needs the same validation as an event.
• source: Inside a server event handler, the id of the player who triggered it. Set by the server, so it cannot be faked by the client.
• State bag: Key-value data attached to a player, entity or the server that FiveM syncs automatically. Values a client is allowed to write are client input and must be treated as such.
• Export: A function a resource makes available to other resources. How frameworks and anticheat SDKs are called from your own scripts.
• Server-side vs client-side: Server-side code runs on your machine and is trusted. Client-side code runs on the player's PC and can be read, changed or skipped by a cheat.

Server settings

• ACE (Access Control Entries): FiveM's permission system. add_ace grants permissions to groups, add_principal puts an identifier into a group. Admin rights should always be tied to a stable identifier.
• Pure mode (sv_pureLevel): Blocks modified game files on the client. Level 1 allows only audio and graphics mods, level 2 blocks all modified files.
• Entity lockdown (sv_entityLockdown): Limits which entities clients may create. strict blocks all client-created entities, so everything must be spawned by the server.
• sv_scriptHookAllowed: Whether ScriptHookV-based mods may be used on the server. Set it to 0.
• Endpoint privacy (sv_endpointPrivacy): Hides player IP addresses from the server's public information.

Players and identity

• Identifiers: The accounts a player connects with: license (Rockstar), fivem (Cfx.re forum account), discord, steam, xbl, live and the IP address. Most can be changed by creating a new account.
• Hardware tokens: Values FiveM derives from a player's hardware, available on the server through GetPlayerTokens. Harder to change than identifiers, so used to catch ban evasion.
• Ban evasion: A banned player returning on a new account. Bans that rely on one identifier alone don't stop it.
• HWID ban / HWID spoofer: A ban on hardware tokens, and the tools cheaters use to change what the hardware reports in order to get around one.
• Whitelist: Only approved players may connect, for example by Discord role or approved licence. Common on serious roleplay servers.

Cheating

• Cheat menu / mod menu: A program that adds features to the game client: spawning, teleporting, god mode, weapons, money exploits through server events. The core thing an anticheat exists to stop.
• Executor: Software that injects and runs the cheater's own Lua code inside the game, often with a menu built on top. Many "menus" are executors with a script loaded.
• Aimbot / triggerbot: Cheats that aim at players automatically, or shoot the moment the crosshair is on a player.
• ESP / wallhack: Shows players, vehicles or items through walls and at any distance.
• Trigger exploit: Calling a resource's server event directly to get money, items or powers. Not a game cheat at all, but a scripting bug. Fixed mainly in your scripts.
• Backdoor: Hidden code in a resource, often in leaked or "free premium" scripts, that lets a stranger run commands on your server.

Anticheat

• Detection: One check of an anticheat that recognises a cheating behaviour. Each should have its own action.
• Action (log, kick, ban): What happens when a detection fires. Logging first and banning later is the safe way to roll out new detections.
• False positive: A detection firing on a player who was not cheating, usually because of a server script doing something unusual. The main cost of a careless anticheat.
• Evidence: The screenshot, video clip and details attached to a detection, used for ban appeals and to catch false positives.
• Ban migration: Importing the ban list of your previous anticheat so known cheaters stay banned after switching.

---

Want to see these pieces working together? Open the Parity demo dashboard, or read how to protect your FiveM server from cheaters.