Features

• AntiCheat handles multiple types of cheats (violation):
  • Aim (includes Spin cheats): examines hit angle, hit location, and hit range
  • FireRate: examines rate of fire
  • Gravity: examines various fly hacks (weak spider detection)
  • MeleeRate: examines melee rate of fire
  • Recoil: examines recoil compensation
  • Server: examines server AntiHack violations and scans for forged admin clients
  • Stash: examines stash discovery
  • Trajectory: examines forged distance packets (crude silent aim detection)
  • WallHack: examines attacks that bypass colliders (experimental)
• AntiFlood handles multiple macro attacks (violation):
  • Chat: examines chat spam (adds chat cooldown)
  • Command: examines command spam
  • ItemDrop: examines item drops (craft/entity flooding; adds crafting cooldown)
• Ban system:
  • Inheritance: IP based
  • Teleportation: teleports banned players to most recent victim (experimental)
  • Time enforcement: enforces ban durations based on ban history
• Commands (more details below):
  • Comprehensive commands covering all Guardian features
• Configuration (more details below):
  • Comprehensive: changes via commands
  • Dynamic: changes (via commands) do not require plugin reload
• Cripple system:
  • Effect: prevents players from hurting/looting other players
  • Heal: crippled players heal attacked players
  • Inheritance: IP based
• Discord webhooks:
  • Send violation messages to a default webhook URL
  • Filters can disable or route a violation category to a separate webhook URL
• Entity damage (from players) scaling by category
• IP filter (violation, permissive, google for an explanation):
  • Denies: IP or IP ranges
  • Allows: IP or IP ranges (can be subsets of the denied IP's)
  • Block: IP's (volatile block list set by Deny/Allow rules and/or VPN checker)
  • Connection cooldown: connection-based anti-DDOS (naive)
  • Whitelist mode: deny all (0/0), allow specfic IPs
• Logging (intensive):
  • Logs various activities. AntiCheat events are intensive and verbose.
• Projectile Log:
  • Similar to a combat log. Includes AntiCheat details for each projectile.
• Steam account checks/restrictions (violation):
  • Bans: check active, community, economy, recent, game and VAC bans
  • Game: check game count and hours played
  • Profile: check invalid, limited and private profiles
  • Share: check family share status
• Users:
  • Tracking: aliases, ban count, cripple count, play time, IP history, etc.
  • Bypass: acceptable playtime and/or ban history bypasses Steam/VPN checks
• VPN checks (violation):
  • API: 4 different API options
  • Cache: API results may be cached to reduce quotas and/or overheads
• Violations:
  • All features marked with violation have customized limits
  • Online admin broadcast (guardian.admin)
  • Hooks provided for external integrations

Notes

The AntiCheat is a tool for flagging suspicious behavior. It is based on a simple set of effective rules, but it is not always accurate. Various factors such as lag and highly skilled gameplay can and will mislead the AntiCheat into either flagging a suspicious player or missing a real cheater altogether. In most cases, it is a good idea to use a human referee to double check the results.

Permissions

• guardian.all -- Includes all other permissions (handle with care).
• guardian.admin -- User can issue log and user commands, and can see violations in game.
• guardian.bypass.anticheat.aim -- User can bypass AntiCheat.Aim checks.
• guardian.bypass.anticheat.firerate -- User can bypass AntiCheat.FireRate checks.
• guardian.bypass.anticheat.gravity -- User can bypass AntiCheat.Gravity checks.
• guardian.bypass.anticheat.meleerate -- User can bypass AntiCheat.MeleeRate checks.
• guardian.bypass.anticheat.recoil -- User can bypass AntiCheat.Recoil checks.
• guardian.bypass.anticheat.server -- User can bypass AntiCheat.Server checks.
• guardian.bypass.anticheat.stash -- User can bypass AntiCheat.Stash checks.
• guardian.bypass.anticheat.trajectory -- User can bypass AntiCheat.Trajectory checks.
• guardian.bypass.anticheat.wallhack -- User can bypass AntiCheat.WallHack checks.
• guardian.bypass.steam -- User can bypass Steam checks.
• guardian.bypass.vpn -- User can bypass VPN checks.
• guardian.command.config -- User can issue config commands (handle with care).
• guardian.command.ip -- User can issue ip commands (handle with care).
• guardian.command.server -- User can issue server commands (handle with care).
• guardian.command.teleport -- User can issue tp/tpv commands (handle with care).
• guardian.command.vpn -- User can issue vpn commands (handle with care).
• guardian.ignore -- User is ignored by Guardian (handle with care).

Notes

• It is recommended admins/moderators be granted the guardian.admin permission.
• The guardian.bypass.steam permission should be granted only to trusted groups/users.
• The guardian.bypass.vpn permission should be granted only to trusted groups/users.
• It is recommended only owners/operators be granted :
  • guardian.all, or
  • guardian.command.config
  • guardian.command.server
• It is recommended that only owners/operators and senior staff be granted:
  • guardian.command.ip
  • guardian.command.teleport
  • guardian.command.vpn
  • guardian.ignore

Console Commands

All commands are usable in RCON; all commands are usable in the game console, provided the in-game user has the appropriate permissions (see Permissions above). All console command variants behave identically to those described in the Chat Commands section below. Console command syntax and variants are the same as the Chat Commands syntax and variants below, without the preceding /.

Chat Commands

Replace CAPITALIZED parameters with what the name suggests. Replace lowercase parameters with the exact word. Arguments separated by | list a set of valid parameters; select only one. Arguments listed within square braces [] are optional and may be omitted or replaced (e.g omit [HOURS] to see the current setting; replace [HOURS] with 1 to specify one hour; and so on). All command variants that affect a configuration option are persistent (saved to the configuration file). Invoking each of the general commands will return a list of available subcommands.

General

• Configuration Settings (guardian.command.config permission):
  • /g.config
  • /guardian.config
• Help Information (guardian.admin permission):
  • /g.help
  • /guardian
  • /guardian.help
• IP Filtering (guardian.command.ip permission):
  • /g.ip
  • /guardian.ip
• Projectile Log (guardian.admin permission):
  • /g.log
  • /guardian.log
• Server Administration (guardian.command.server permission):
  • /g.server
  • /guardian.server
• Teleportation (guardian.command.teleport permission):
  • /g.tp
  • /g.tpv
  • /guardian.tp
  • /guardian.tpv
• User Administration (guardian.admin permission):
  • /g.user
  • /guardian.user
• VPN Detection (guardian.command.vpn permission):
  • /g.vpn
  • /guardian.vpn

Configuration Settings

Each of these configuration settings subcommands leads to further, more detailed, configuration settings. (See also the Configuration section):

• /g.config admin
• /g.config anticheat
• /g.config antiflood
• /g.config ban
• /g.config cripple
• /g.config discord
• /g.config entity
• /g.config ip
• /g.config log
• /g.config save
• /g.config steam
• /g.config user
• /g.config violation
• /g.config vpn

IP Filtering

IP can be a full or partial IP address, with wildcards (*), and optional range (/BITS):

• /g.ip allow -- display allowed IP/RANGE entries
• /g.ip allow IP[/BITS] -- check this IP/RANGE for matching allow entries
• /g.ip allow add IP[/BITS] -- add this IP/RANGE to the allow list
• /g.ip allow remove IP[/BITS] -- remove this IP/RANGE from the allow list
• /g.ip block IP -- block the specified IP (volatile; not saved)
• /g.ip bypass IP -- bypass the specified IP (volatile; not saved)
• /g.ip deny -- display denied IP/RANGE entries
• /g.ip deny IP[/BITS] -- check this IP/RANGE for matching deny entries
• /g.ip deny add IP[/BITS] -- add this IP/RANGE to the deny list
• /g.ip deny remove IP[/BITS] -- remove this IP/RANGE from the deny list
• /g.ip save -- save the IP allows and denies lists
• /g.ip unblock IP -- unblock the sepcified IP (volatile; not saved)

Projectile Log

• /g.log IP|NAME|STEAMID [LINES] -- Display recent LINES (default = 20) of the user's projectile log.

Server Administration

• /g.server pardon -- For all users, reset ban count, unless user is banned
• /g.server unban -- Unban all users
• /g.server uncripple --- Uncripple all users

Teleportation

Teleport locations are valid only for the current wipe; if a player has not spawned since the latest save file was created, that player's saved locations are forgotten. The server command variants will report teleport locations, but no teleportation will occur:

• /g.tp IP|NAME|STEAMID -- Teleport to the user's last known location
• /g.tpv IP|NAME|STEAMID -- Teleport to the user's last violation location

User Administration

• /g.user IP|NAME|STEAMID [team] -- status of user/team
• /g.user IP|NAME|STEAMID [team.]ban ["REASON"] [TIME[d|h|m|s]] -- ban user/team
• /g.user IP|NAME|STEAMID [team.]ban.reset -- reset ban data for user/team
• /g.user IP|NAME|STEAMID [team.]cripple ["REASON"] [TIME[d|h|m|s]] -- cripple user/team
• /g.user IP|NAME|STEAMID [team.]cripple.reset -- reset cripple data for user/team
• /g.user IP|NAME|STEAMID [team.]kick ["REASON"] -- kick user/team
• /g.user IP|NAME|STEAMID [team.]pardon -- reset ban count, unless banned, for user/team
• /g.user IP|NAME|STEAMID [team.]unban -- unban user/team
• /g.user IP|NAME|STEAMID [team.]uncripple -- uncripple user/team

VPN Detection

• /g.vpn bypass IP -- bypass VPN checking for this IP (also unblocks the IP)
• /g.vpn status IP -- check VPN status for this IP
• /g.vpn unblock IP -- reset VPN checking for this IP (also unblocks the IP)

Configuration

During loading, invalid settings will be clamped to within an allowed range or will be set to a default value.

For all Ban settings, if the value is set to true, a violation of that type will cause a bannable violation; if the value is set to false, a violation of that type will cause a kick violation, unless Warn is set to true. For all Cooldown settings, this specifies the number of seconds that must pass before an older trigger of the event is forgotten. Triggers do not immediately cause violations, but a certain number of triggers within the cooldown period will cause a violation.

The number of triggers varies by the type of violation, and is automatically selected based on the Sensitivity setting. Lower sensitivity settings will require more triggers to cause a violation, while higher sensitivty settings will require fewer triggers to cause a violation. Sensitivity is also used differently by each category of violation (Aim, FireRate, etc.), to adjust various internal parameters that affect when a trigger will eventually cause a violation. Higher values for sensitivity will cause more false positives.

By default, all Sensitivity values are set to 0.5; adjust these values sparingly, and in small increments. It is recommended that only one such setting be modified at a given time, and that it be monitored for adequate true versus false positive detections rates, before going on to modify another Sensitivity value.

Admin

If Broadcast is true, all Guardian violations are broadcast in game to users with the guardian.admin permission. If Bypass is true, all users with the guardian.admin permission are immune to violation kicks and bans; also, they will bypass the connection queue, Steam checks, and VPN checks.

• Broadcast -- (true/false)
• Bypass -- (true/false)

AntiCheat

AntiCheat.Aim

Aim detection is based on weapon range (weapon attachments ammo), the difference between projectile and aim angles, and pvp hit and headshot percentages.

• Aim.Ban -- (true/false)
• Aim.Cooldown -- (seconds > 0)
• Aim.Enabled -- (true/false)
• Aim.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• Aim.Trigger.Animal -- (true/false)
• Aim.Trigger.Bradley -- (true/false)
• Aim.Trigger.Helicopter -- (true/false)
• Aim.Trigger.NPC -- (true/false)
• Aim.Warn -- (true/false)

AntiCheat.FireRate

Fire rate detection is based on the repeat rate of the weapon, including mods from attachments. Fire rate is checked only for repeat hits to the same entity.

At Sensitivity 1.0, a repeat hit will trigger when below 60% of the weapon's modded repeat rate; at Sensitivity 0.0, a repeat hit will trigger when below 30% of the weapon's modded repeat rate.

• FireRate.Ban -- (true/false)
• FireRate.Cooldown -- (seconds > 0)
• FireRate.Enabled -- (true/false)
• FireRate.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• FireRate.Warn -- (true/false)

AntiCheat.Gravity

Gravity detection is based on the server's built-in FlyHack violations. When Gravity detection is enabled, Guardian controls the handling of built-in FlyHack violations. Gravity detection applies further checks to reduce the liklihood of the server accumulating false FlyHack detections, such as when a player jumps out of a flying vehicle.

• Gravity.Ban -- (true/false)
• Gravity.Cooldown -- (seconds > 0)
• Gravity.Enabled -- (true/false)
• Gravity.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• Gravity.Warn -- (true/false)

AntiCheat.MeleeRate

Melee rate detection is based on the repeat rate of melee weapons.

At Sensitivity 1.0, a repeat hit will trigger when below 70% of the weapon's repeat rate; at Sensitivity 0.0, a repeat hit will trigger when below 40% of the weapon's repeat rate.

• MeleeRate.Ban -- (true/false)
• MeleeRate.Cooldown -- (seconds > 0)
• MeleeRate.Enabled -- (true/false)
• MeleeRate.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• MeleeRate.Warn -- (true/false)

AntiCheat.Recoil

Recoil detection analyzes the difference in the player's aim angle before and after a shot is fired.

• Recoil.Ban -- (true/false)
• Recoil.Cooldown -- (seconds > 0)
• Recoil.Enabled -- (true/false)
• Recoil.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• Recoil.Warn -- (true/false)

AntiCheat.Server

Server detection is based on the server's built-in AntiHack violations, excluding Flyhack. When Server detection is enabled, Guardian controls the handling of built-in AntiHack violations.

The server's AntiHack violations trigger this detection category, which in turn can trigger Guardian violations based on the Sensitivity settings for this category. In addition, Guardian will simulate server AntiHack violations for various clipping checks. InsideTerrain violations are issued when a player is out of bounds and below the terrain layer. NoClip violations are issued when a player is inside a solid foundation or when a player is inside a rock formation.

• Server.Ban -- (true/false)
• Server.Cooldown -- (seconds > 0)
• Server.Enabled -- (true/false)
• Server.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• Server.Warn -- (true/false)

AntiCheat.Stash

Stash detection applies several checks whenever a stash is unearthed. If the stash is owned by the player, a team mate, or a friend, the stash is ignored.

Sensitivity affects how far away the next discovered stash must be, before another violation can occur. At Sensitivity 1.0, a stash at least 3m away will trigger a violation; at Sensitivity 0.0, a stash at least 21m away will trigger a violation.

The first stash discovery for a player will not cause a violation. If Ban is false, the second and further stash discoveries will cause kick violations, unless Warn is true. When Warn is true, the first stash discovery for a player will always broadcast a warning.

• Stash.Ban -- (true/false)
• Stash.Cooldown -- (seconds > 0)
• Stash.Enabled -- (true/false)
• Stash.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• Stash.Warn -- (true/false)

AntiCheat.Trajectory

Trajectory detection compares the server's reported projectile distance with the actual projectile distance.

• Trajectory.Ban -- (true/false)
• Trajectory.Cooldown -- (seconds > 0)
• Trajectory.Enabled -- (true/false)
• Trajectory.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• Trajectory.Warn -- (true/false)

AntiCheat.WallHack

WallHack detection checks for intervening building blocks between the attacker and the victim.

Sensitivity does not affect this check; it affects only the number of triggers required to cause a violation.

• WallHack.Ban -- (true/false)
• WallHack.Cooldown -- (seconds > 0)
• WallHack.Enabled -- (true/false)
• WallHack.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• WallHack.Warn -- (true/false)

AntiFlood

AntiFlood.Chat

• Chat.Ban -- (true/false)
• Chat.Cooldown -- (seconds > 0)
• Chat.Enabled -- (true/false)
• Chat.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• Chat.Warn -- (true/false)

AntiFlood.Command

• Command.Ban -- (true/false)
• Command.Cooldown -- (seconds > 0)
• Command.Enabled -- (true/false)
• Command.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• Command.Warn -- (true/false)

AntiFlood.ItemDrop

• ItemDrop.Ban -- (true/false)
• ItemDrop.Cooldown -- (seconds > 0)
• ItemDrop.Enabled -- (true/false)
• ItemDrop.Sensitivity -- [0.0, 1.0] (0.0 = low detection; 1.0 = high detection)
• ItemDrop.Warn -- (true/false)

Ban

If Inherit is true, bans are inherited by other users with the same IP address. If Teleport is true, banned users are teleported to the last victim, when possible (in future, will ask the victim to accept the teleport). If Time.Enforce is true, ban times are enforced; bans cleared outside of Guardian will be restored untill the configured ban time (Time.Seconds) expires. Bans cleared manually with the /guardian.user command will succeed and also decrease the user's recorded ban count. Bans cleared automatically after the ban time expires will not get a reduction in recorded ban count. If Time.Multiply is true, users are banned for the amount of time specified in Time.Seconds multiplied by the users' recorded ban count. For example, if a user accumulates 3 recorded bans, and the configured ban time is 30 days, the user's enforced and multiplied ban will last 90 days .

• Inherit -- (true/false)
• Teleport -- (true/false)
• Time.Enforce -- (true/false)
• Time.Multiply -- (true/false)
• Time.Seconds -- (seconds >= 0) (0 = permanent)

Cripple

Crippled players may not damage other players, and they may not loot other players. If Heal is true, crippled players will heal victims (work in progress; needs to exclude clan/friend/team). If Inherit is true, cripple status is inherited by other users with the same IP address. Users with the IsAdmin flag (auth level > 0) bypass the cripple restrictions.

• Heal -- (true/false)
• Inherit -- (true/false)

Discord

When Enabled is true, violation messages will be forwarded to the webhook URL specified by WebHook.

WARNING: Do not enable the Discord webhook for a public channel; IP and VPN violation messages include the player's IP address

• Enabled -- (true/false)
• WebHook -- "URL" (search online for how to setup a webhook in Discord)

Discord.Filters

When a filter category's Enabled setting is true, violation messages for that category will be forwarded to the webhook URL specified by that category's WebHook setting; if a category is enabled, and that category's WebHook is empty, violation messages will instead be forwarded to the global webhook URL specified by Discord.WebHook.

• AntiCheat.Enabled -- (true/false)
• AntiCheat.WebHook -- "URL" (search online for how to setup a webhook in Discord)
• AntiFlood.Enabled -- (true/false)
• AntiFlood.WebHook -- "URL" (search online for how to setup a webhook in Discord)
• IP.Enabled -- (true/false)
• IP.WebHook -- "URL" (search online for how to setup a webhook in Discord)
• Steam.Enabled -- (true/false)
• Steam.WebHook -- "URL" (search online for how to setup a webhook in Discord)
• VPN.Enabled -- (true/false)
• VPN.WebHook -- "URL" (search online for how to setup a webhook in Discord)

Entity

Scales damage dealt by players, depending on the type of target. Users with the IsAdmin flag (auth level > 0) bypass the damage scaling system.

• Damage.Animal -- [0.0, 100.0] (0.0 = no damage, 1.0 = normal damage)
• Damage.Bradley -- [0.0, 100.0] (0.0 = no damage, 1.0 = normal damage)
• Damage.Building -- [0.0, 100.0] (0.0 = no damage, 1.0 = normal damage)
• Damage.Entity -- [0.0, 100.0] (0.0 = no damage, 1.0 = normal damage)
• Damage.Friend -- [0.0, 100.0] (0.0 = no damage, 1.0 = normal damage)
• Damage.Helicopter -- [0.0, 100.0] (0.0 = no damage, 1.0 = normal damage)
• Damage.NPC -- [0.0, 100.0] (0.0 = no damage, 1.0 = normal damage)
• Damage.Player -- [0.0, 100.0] (0.0 = no damage, 1.0 = normal damage)
• Damage.Team -- [0.0, 100.0] (0.0 = no damage, 1.0 = normal damage)
• Damage.Trap -- [0.0, 100.0] (0.0 = no damage, 1.0 = normal damage)

IP

If Violation.Ban is true, IP blocks will cause a bannable violation; if it is false, IP blocks will just deny the connection.

• Filter.Cooldown -- [0, 60] (0 = no reconnect cooldown)
• Violation.Ban -- (true/false)
• Violation.Enabled -- (true/false)

Log

Log settings are verbose and will generate a lot of console text on a busy server. In particular, AntiCheat logs will generate at least one line for each attack and/or hit. AntiCheat logs are intended mainly for continued development of this plugin, and as such will contain some obscure numbers related to the internal workings of the AntiCheat subsystem. In general, the AntiCheat will consider higher values (near 1.0) as GOOD numbers, and will consider lower values (near 0.0, or lower) as SUSPECT numbers. A player exhibiting a lot of low numbers, in a variety of categories, might be worth some scrutiny. The Projectile.Collapse setting trims trajectory and aim details from Projectile Log entries that have no valid target. The Projectile.Verbose setting includes all multi-projectile attacks in the Projectile Log, including entries without a valid target.

• AntiCheat.Aim -- (true/false)
• AntiCheat.Gravity -- (true/false)
• AntiCheat.MeleeRate -- (true/false)
• AntiCheat.Recoil -- (true/false)
• AntiCheat.Server -- (true/false)
• AntiCheat.Stash -- (true/false)
• AntiFlood.ItemDrop -- (true/false)
• IP.Fiter -- (true/false)
• Projectile.Collapse -- (true/false)
• Projectile.Verbose -- (true/false)
• User.Bypass -- (true/false)
• User.Connect -- (true/false)
• VPN.Check -- (true/false)

Steam

If API.Enabled is true, all connected users are verified against all of the enabled Steam checks, unless User.Bypass is also true and the user meets the bypass criteria (see the User configuration section below). If Violation.Ban is true, Steam verifications will cause a bannable violation; if it is false, Steam verifications will cause a kick.

• API.ApiKey -- "API KEY" (API Key Signup Page)
• API.Enabled -- (true/false)
• Ban.Active -- (true/false)
• Ban.Community -- (true/false)
• Ban.Days -- (days >= 0) (0 = disabled)
• Ban.Economy -- (true/false)
• Ban.Game -- (bans >= 0) (0 = disabled)
• Ban.VAC -- (bans >= 0) (0 = disabled)
• Game.Count -- (games >= 0) (0 = disabled)
• Game.Hours -- (hours played >= 0) (0 = disabled)
• Profile.Invalid -- (true/false)
• Profile.Limited -- (true/false)
• Profile.Private -- (true/false)
• Share.Family -- (true/false)
• Violation.Ban -- (true/false)
• Violation.Enabled -- (true/false)
• Violation.Warn -- (true/false)

User

If Bypass.Multiply is true, Bypass.DaysSinceBan and Bypass.HoursPlayed are multiplied by the user's ban count on record, when assessing the user's right to bypass Steam and VPN checks.

• Bypass.DaysSinceBan -- (days > 0)
• Bypass.Enabled -- (true/false)
• Bypass.HoursPlayed -- (hours > 0)
• Bypass.Multiply -- (true/false)
• Friend.Damage -- (true/false)
• Team.Damage -- (true/false)

Version

Do not modify this setting.

Violation

This setting specifies what Guardian will do when various subsystems (AntiCheat, AntiFlood, Steam, VPN, etc,) cause a violation. When Ban is true, and the subsystem's Ban is also true, violations will cause a certain number of warnings to be issued, followed by a ban when the warning count gets high enough. The number of warnings that trigger a ban is based on the Sensitivity setting; a higher setting gives fewer warnings before issuing a ban. The Cooldown setting indicates the number of seconds that must pass before Guardian will forget about a past violation. When Ban is false, and the subsystem's Ban is true, all violations will cause warnings.

• Violation.Ban -- (true/false)
• Violation.Cooldown -- (seconds > 0)
• Violation.Sensitivity -- [0.0, 1.0] (0.0 = more warnings; 1.0 = less warnings)

VPN

If Check.Enabled is true, all APIs that have Enabled set to true will be checked in order. If any API returns a suspected VPN status, all further checks are cancelled and the IP is cached as VPN detected; this IP is also blocked in the IP Filter. If no API returns a suspected VPN status, the checked IP is cached as clean IP. If Check.Strict is true, stricter criteria are used to decide whether an address is clean; this can lead to more false positives. If Violation.Ban is true, VPN detections will cause a bannable violation; if it is false, VPN detections will cause a kick.

• API.GetIpIntel.APiKey -- "API KEY" (a valid email address)
• API.GetIpIntel.Enabled -- (true/false)
• API.IpApi.APiKey -- "API KEY" (not required)
• API.IpApi.Enabled -- (true/false)
• API.IpHub.APiKey -- "API KEY" (API Key Signup Page)
• API.IpHub.Enabled -- (true/false)
• API.IpQualityScore.APiKey -- "API KEY" (API Key Signup Page)
• API.IpQualityScore.Enabled -- (true/false)
• Cache.Hours -- (hours >= 0) (0 = permanent; not recommended)
• Check.Enabled -- (true/false)
• Check.Strict -- (true/false)
• Violation.Ban -- (true/false)
• Violation.Enabled -- (true/false)
• Violation.Warn -- (true/false)

Default Configuration

{
  "Admin": {
    "Broadcast": true,
    "Bypass": true
  },
  "AntiCheat": {
    "Aim": {
      "Ban": false,
      "Cooldown": 300,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Trigger": {
        "Animal": false,
        "Bradley": false,
        "Helicopter": false,
        "NPC": false
      },
      "Warn": true
    },
    "FireRate": {
      "Ban": false,
      "Cooldown": 10,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Warn": true
    },
    "Gravity": {
      "Ban": false,
      "Cooldown": 10,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Warn": true
    },
    "MeleeRate": {
      "Ban": false,
      "Cooldown": 300,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Warn": true
    },
    "Recoil": {
      "Ban": false,
      "Cooldown": 10,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Warn": true
    },
    "Server": {
      "Ban": false,
      "Cooldown": 300,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Warn": true
    },
    "Stash": {
      "Ban": false,
      "Cooldown": 3600,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Warn": true
    },
    "Trajectory": {
      "Ban": false,
      "Cooldown": 90,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Warn": true
    },
    "WallHack": {
      "Ban": false,
      "Cooldown": 300,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Warn": true
    }
  },
  "AntiFlood": {
    "Chat": {
      "Ban": false,
      "Cooldown": 30,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Warn": false
    },
    "Command": {
      "Ban": false,
      "Cooldown": 30,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Warn": false
    },
    "ItemDrop": {
      "Ban": false,
      "Cooldown": 300,
      "Enabled": true,
      "Sensitivity": 0.5,
      "Warn": false
    }
  },
  "Ban": {
    "Inherit": true,
    "Teleport": false,
    "Time": {
      "Enforce": false,
      "Multiply": false,
      "Seconds": 0
    }
  },
  "Cripple": {
    "Heal": false,
    "Inherit": true
  },
  "Discord": {
    "Enabled": false,
    "WebHook": "",
    "Filters": {
      "AntiCheat": {
        "Enabled": true,
        "WebHook": ""
      },
      "AntiFlood": {
        "Enabled": true,
        "WebHook": ""
      },
      "IP": {
        "Enabled": true,
        "WebHook": ""
      },
      "Steam": {
        "Enabled": true,
        "WebHook": ""
      },
      "VPN": {
        "Enabled": true,
        "WebHook": ""
      }
    }
  },
  "Entity": {
    "Damage": {
      "Animal": 1.0,
      "Bradley": 1.0,
      "Building": 1.0,
      "Entity": 1.0,
      "Friend": 1.0,
      "Helicopter": 1.0,
      "NPC": 1.0,
      "Player": 1.0,
      "Team": 1.0,
      "Trap": 1.0
    }
  },
  "IP": {
    "Filter": {
      "Cooldown": 30
    },
    "Violation": {
      "Ban": false,
      "Enabled": true
    }
  },
  "Log": {
    "AntiCheat": {
      "Aim": false,
      "Gravity": false,
      "MeleeRate": false,
      "Recoil": false,
      "Stash": false,
      "Trajectory": false
    },
    "AntiFlood": {
      "ItemDrop": false
    },
    "IP": {
      "Filter": true
    },
    "Projectile": {
      "Collapse": false,
      "Verbose": false
    },
    "User": {
      "Bypass": false,
      "Connect": true
    },
    "VPN": {
      "Check": true
    }
  },
  "Steam": {
    "API": {
      "ApiKey": "",
      "Enabled": false
    },
    "Ban": {
      "Active": false,
      "Community": false,
      "Days": 0,
      "Economy": false,
      "Game": 0,
      "VAC": 0
    },
    "Game": {
      "Count": 0,
      "Hours": 0
    },
    "Profile": {
      "Invalid": false,
      "Limited": false,
      "Private": false
    },
    "Share": {
      "Family": false
    },
    "Violation": {
      "Ban": false,
      "Enabled": true,
      "Warn": false
    }
  },
  "User": {
    "Bypass": {
      "DaysSinceBan": 10,
      "Enabled": false,
      "HoursPlayed": 6,
      "Multiply": false
    },
    "Friend": {
      "Damage": false
    },
    "Team": {
      "Damage": false
    }
  },
  "Version": {
    "Major": 1,
    "Minor": 7,
    "Patch": 8
  },
  "Violation": {
    "Ban": true,
    "Cooldown": 7200,
    "Sensitivity": 0.5
  },
  "VPN": {
    "API": {
      "GetIpIntel": {
        "ApiKey": "",
        "Enabled": false
      },
      "IpApi": {
        "ApiKey": "",
        "Enabled": false
      },
      "IpHub": {
        "ApiKey": "",
        "Enabled": false
      },
      "IpQualityScore": {
        "ApiKey": "",
        "Enabled": false
      }
    },
    "Cache": {
      "Hours": 72
    },
    "Check": {
      "Enabled": false,
      "Strict": false
    },
    "Violation": {
      "Ban": false,
      "Enabled": true,
      "Warn": false
    }
  }
}

Hooks

Generic

Note: This hook is called when any Guardian violation occurs. The category string identifies the subsystem that triggered the violation. DO NOT EXPOSE the details string to public channels; for IP and VPN violations, this string contains an IP address

void OnGuardianViolation(string playerid, Dictionary<string, string> details)
{
    //details["action"];
    //details["actionicon"];
    //details["category"];
    //details["categoryicon"];
    //details["color"];
    //details["details"];
    //details["playername"];
    //details["type"];
}

AntiCheat

AntiCheat.Aim

Note: Weapon type, attachments, range, hip fire, movement, hit and headshot percentages should be evaluated to decide whether an attack is a false positive. For example: attacks with spread, such as buckshot, should not all hit the same bodypart at a distance greater than 10m; hip fired headshots at 150m, while moving at 5m/s with an unmodified SAR, are probably suspect.

void OnGuardianAntiCheatAim(string playerid, Dictionary<string, string> details)
{
    //details["headshot_percent"];
    //details["hip_fire"];
    //details["hit_angle"];
    //details["hit_area"];
    //details["hit_distance"];
    //details["hit_percent"];
    //details["movement_speed"];
    //details["projectile_id"];
    //details["ricochet"];
    //details["swing_angle"];
    //details["violation_id"];
    //details["weapon_ammo"];
    //details["weapon_attachments"];
    //details["weapon_type"];
}

AntiCheat.FireRate

Note: In general, false positives should only ever occur with a high rate-of-fire weapon and a lagged network connection. For example: an MP5, with a muzzle boost mod, fired by a player with high ping, may trigger false positives.

void OnGuardianAntiCheatFireRate(string playerid, Dictionary<string, string> details)
{
    //details["attack_rate"];
    //details["movement_speed"];
    //details["projectile_id"];
    //details["rate_percent"];
    //details["violation_id"];
    //details["weapon_ammo"];
    //details["weapon_attachments"];
    //details["weapon_type"];
}

AntiCheat.Gravity

Note: False positives are rare, but they can occur when the server emits a FlyHack violation in unusual locations such as around entities that are placed on sides or on steep angles.

void OnGuardianAntiCheatGravity(string playerid, Dictionary<string, string> details)
{
    //details["elevation"];
    //details["movement_speed"];
    //details["violation_id"];
}

AntiCheat.MeleeRate

void OnGuardianAntiCheatMeleeRate(string playerid, Dictionary<string, string> details)
{
    //details["attack_rate"];
    //details["movement_speed"];
    //details["rate_percent"];
    //details["violation_id"];
    //details["weapon_type"];
}

AntiCheat.Recoil

Note: Although the Sensitivity setting affects the recoil trigger thresholds, the reported pitch and yaw percentages for a given violation are raw values; these percentages estimate the liklihood of recoil compensation being used by the player.

void OnGuardianAntiCheatRecoil(string playerid, Dictionary<string, string> details)
{
    //details["movement_speed"];
    //details["recoil_pitch"];
    //details["recoil_repeats"];
    //details["recoil_yaw"];
    //details["violation_id"];
    //details["weapon_ammo"];
    //details["weapon_attachments"];
    //details["weapon_type"];
}

AntiCheat.Server

Note: The AntiHack amount and type values are raw values from the server.

void OnGuardianAntiCheatServer(string playerid, Dictionary<string, string> details)
{
    //details["antihack_amount"];
    //details["antihack_type"];
    //details["movement_speed"];
    //details["violation_id"];
}

AntiCheat.Stash

void OnGuardianAntiCheatStash(string playerid, Dictionary<string, string> details)
{
    //details["stash_distance"];
    //details["movement_speed"];
    //details["violation_id"];
}

AntiCheat.Trajectory

Note: Although the Sensitivity setting affects the trajectory trigger thresholds, the trajectory percentage for a given violation is a raw value; this percentage estimates the liklihood of a forged projectile distance.

void OnGuardianAntiCheatTrajectory(string playerid, Dictionary<string, string> details)
{
    //details["hit_distance"];
    //details["movement_speed"];
    //details["projectile_distance"];
    //details["projectile_id"];
    //details["trajectory_percent"];
    //details["violation_id"];
    //details["weapon_ammo"];
    //details["weapon_attachments"];
    //details["weapon_type"];
}

AntiCheat.WallHack

void OnGuardianAntiCheatWallHack(string playerid, Dictionary<string, string> details)
{
    //details["hit_distance"];
    //details["movement_speed"];
    //details["projectile_id"];
    //details["violation_id"];
    //details["weapon_ammo"];
    //details["weapon_attachments"];
    //details["weapon_type"];
}

Localization