Best Free Minecraft Anti-Cheat Plugins (2026)

Every Minecraft server with PvP and any kind of competitive ranking will eventually face cheaters. The market has roughly two answers: pay for a polished commercial anti-cheat (Vulcan, Polar, Grim Premium tiers), or run a free one and accept that you'll do more manual tuning and triage.

This post focuses on the free side, because if you're a small server with no recurring revenue, dropping $40 a month on anti-cheat isn't realistic. Here's what's actually worth running in 2026, what it catches, what it misses, and how to combine them.

What "good" anti-cheat actually means

Before naming names, set expectations.

Anti-cheat is a moving target. The cheat client developers iterate faster than anti-cheat developers; the gap is constantly closing and reopening. Even paid anti-cheats have detection gaps. A "good" anti-cheat in 2026 means:

• Low false-positive rate (legit players don't get banned for lag spikes)
• Catches blatant cheats reliably (KillAura, Reach, Speed, Fly when not warranted)
• Active maintenance (updates within weeks of new cheat client releases)
• Configurable (you can tune sensitivity per gamemode)
• Doesn't tank server TPS (some are remarkably expensive)

Free anti-cheats can hit 3 or 4 of these. They almost never hit all 5. Plan accordingly.

The free options worth considering

There are dozens of dead or abandoned anti-cheat plugins on SpigotMC. Below are the ones with active maintainers and meaningful user bases in 2026.

Vulcan (free tier)

Vulcan ships both a free version and a paid one. The free tier is more capable than most projects' paid tiers.

Catches well: KillAura, basic Reach, Fly, Speed, Scaffold, AutoBlock.

Where it falls short: Combat checks are tuned for vanilla Paper PvP - if your server runs heavily customized combat (cooldown changes, custom hit registration), false positives spike. Has limited Folia support.

Verdict: Best free option for most pure-PvP servers. Start here.

Negativity

Open-source, community-developed, long-running project. Steady release cadence.

Catches well: Movement-based cheats (Speed, Fly, NoFall), inventory cheats (FastEat, FastPlace).

Where it falls short: Combat detection is weaker than Vulcan's. KillAura catches are mostly aim-pattern based, which sophisticated clients defeat.

Verdict: Good complement to a combat-focused anti-cheat. Runs well alongside Vulcan to cover movement that Vulcan undertunes.

Matrix (community fork)

Original Matrix went dormant; a few community forks have picked it up. The most active fork as of 2026 is still maintained and ships occasional updates.

Catches well: Aimbots with detectable smoothing patterns, basic NoSlowdown.

Where it falls short: Configuration is gnarly - hundreds of values across many YAML files. Default settings produce false positives on laggy servers. Performance impact is non-trivial on busy networks.

Verdict: Skip unless you've outgrown Vulcan and Negativity and want a third layer. The tuning cost is high.

Polar (free version)

Polar is mostly a paid product, but offers a free tier with limited detection. The free tier mostly handles obvious cases.

Catches well: Blatant KillAura, blatant Fly, NoSlow.

Where it falls short: The interesting detections (reach checks, click pattern analysis, advanced movement) are paywalled. Free tier won't catch anyone running a modern paid cheat client.

Verdict: Only useful as a "free trial" before you decide whether to buy the paid version. As a standalone free solution, it's weaker than Vulcan free.

AAC (legacy, no longer recommended)

Mentioned because people still ask. AAC's last meaningful update was years ago. The original developer has moved on. Various forks exist with limited maintenance.

Verdict: Don't run this in 2026. Cheat clients have explicit AAC-bypass routines built in. You're not protected.

The combination most servers actually use

The realistic free stack for a small-to-medium PvP server in 2026:

1. Vulcan free as the primary - covers most combat detection
2. Negativity as the secondary - tightens movement detection
3. No third anti-cheat - diminishing returns, increasing false positives, increasing CPU cost

Layering more than two anti-cheats almost always backfires. They flag the same events, you get duplicate punishments, and tuning becomes impossible because you can't isolate which one fired.

Configuration patterns that prevent rage-quits

Whatever anti-cheat you install, these settings matter more than which one you picked:

Start with warn-only mode

Every anti-cheat has a "log only" or "warn only" flag. Run for at least a week with no kicks or bans - just collect the data. You'll see which checks fire on legitimate players (laggy / high-ping) versus actual cheaters.

Tune per-check thresholds

Default vl (violation level) thresholds are tuned conservatively to avoid bans, which means they let some cheats through. After your warn-only week, drop thresholds on checks where you saw zero false positives, raise them on checks that fired on innocents.

Whitelist staff

Always exempt admins and helpers from anti-cheat. The number of times you'll teleport while in creative and trigger a Fly check is not zero.

Pair with /spark for performance auditing

After enabling any anti-cheat, run spark for an hour during peak. If the anti-cheat plugin shows up in the top 5 main-thread consumers, you've over-tuned. Loosen something.

What free anti-cheat can't fix

Some categories of cheating are functionally undetectable by any current anti-cheat - free or paid:

• X-ray (texture pack or rendered): There's no way to detect a client rendering ores through walls. Anti-X-ray plugins (Orebfuscator) work by not sending hidden block data to clients - they prevent x-ray rather than detect it. Run one of those instead.
• Reach modifications at distances below threshold: Most anti-cheats flag reach above 3.05-3.1 blocks. Cheats that limit themselves to 3.04 are unflaggable.
• Aimbot with humanlike smoothing: Detection relies on suspiciously perfect aim patterns. Patient cheaters can avoid these by lowering aim assist intensity.
• Bedrock players using mobile UI quirks: Mobile players naturally produce some "off" behavior. Many anti-cheats produce false positives on Bedrock-via-Geyser players; better to bypass anti-cheat for Geyser sessions and rely on reports.

If your server has high-skill PvP with real prize stakes, free anti-cheats will not be enough. You'll need either paid anti-cheat (Polar/Grim premium tiers) or active human moderation. Or both.

Reporting and review workflow

The anti-cheat is half the battle. The other half is what you do with reports and flag logs.

A workflow that works for small servers:

1. Players use /report with a built-in plugin or a Discord bot.
2. Reports route to a private staff channel with reporter username, accused username, accused server, and reason.
3. Staff member spectates the accused in-game (use /v or /spectate).
4. Decision tree: obvious cheat → ban. Suspicious but unclear → mute, mark for further observation. Clean → close report, possibly warn reporter if it's their fifth false report.
5. Anti-cheat logs reviewed daily for accumulated violations on players who weren't reported but are tripping checks consistently.

Without this workflow, your anti-cheat is a one-time install that gradually becomes irrelevant as cheaters figure out exactly which thresholds to stay under.

Custom anti-cheat for unusual servers

If your server runs a heavily customized gamemode where existing anti-cheats produce constant false positives - custom combat, modified physics, RPG-style movement modifiers - you might be better off with a focused custom check rather than fighting a generic anti-cheat's config.

We've built per-gamemode anti-cheat modules for clients with this exact problem - usually small, targeted checks (e.g. "no fly outside region X" or "no reach above N for class Y") rather than trying to cover everything. If your server has unusual constraints, we take custom orders and can scope something appropriately.

Bottom line

Run Vulcan free + Negativity as your default free stack. Spend a week in warn-only mode tuning thresholds. Pair with active moderation and a reporting workflow. Don't bother with abandoned anti-cheats (AAC, original Matrix) regardless of how often they show up in old forum posts.

If your server scales past a few hundred concurrent PvPers or hosts real-money tournaments, accept that you'll eventually need to budget for paid anti-cheat. The free tier ceiling is real, and once you hit it the cost of not upgrading shows up as a slow exodus of skilled players who got tired of fighting cheaters.

Got a specific cheat your current anti-cheat can't catch? Drop into our Discord and share the recording - we've usually seen it before and can point you at a working check.