Security basics for FiveM servers

Most FiveM servers that get “hacked” are not hacked at all. Someone found an unprotected event that gives money, a leaked resource with a backdoor, an exposed database, or an admin password reused from a leaked site. This page covers the basics that stop most of it.

1. Accounts and the txAdmin panel

• Log in with Cfx.re and turn on two factor authentication on your Cfx.re account (forum account settings). Every admin should do the same.
• Give each admin their own txAdmin account (Admin Manager). Never share the master account.
• Least privilege. txAdmin has fine grained permissions: console.write, control.server, players.ban, server.cfg.editor, manage.admins and more. A moderator needs players.warn, players.kick, players.ban and maybe players.spectate, not the console. See Everyday admin.
• Remove admins who leave, the same day.
• Keep port 40120 private if you can: allow it only from your IP in the firewall. If it must be public, strong passwords and 2FA are not optional. For HTTPS, put a reverse proxy (nginx, Caddy) or a Cloudflare Tunnel in front, as the txAdmin team recommends.
• The txAdmin backup password is a real password. Make it long and unique.

2. ACE permissions in server.cfg

FiveM’s built in permission system is ACE. Keep it tight:

# a group that can use every command except quit
add_ace group.admin command allow
add_ace group.admin command.quit deny

# a smaller group for moderators
add_ace group.mod command.kick allow
add_ace group.mod myresource.moderate allow   # a custom permission your scripts check

# people
add_principal identifier.fivem:123456 group.admin
add_principal identifier.discord:111111111111111111 group.mod

• Prefer identifier.fivem: (the Cfx.re account ID, visible in txAdmin) or identifier.license: over identifier.ip:, which changes and can be shared.
• add_ace resource.myresource command.stop allow lets a resource run a command. Only give resources what they need. Some resources ask for add_ace resource.x command allow (everything): think twice.
• In your own code, protect commands with RegisterCommand(name, fn, true) (restricted: requires the command.name ACE) or check IsPlayerAceAllowed(source, 'myresource.admin').

3. Never trust the client

This is the most important rule for anyone who writes or installs scripts. Anything a client sends can be faked by a cheater with an executor. They can trigger any server event you registered, with any arguments.

Bad:

RegisterNetEvent('shop:giveMoney', function(amount)
    local player = GetPlayer(source)
    player.addMoney(amount) -- a cheater sends 999999999
end)

Better:

local PRICE = { bread = 5, water = 3 }

RegisterNetEvent('shop:buy', function(item)
    local src = source
    local price = PRICE[item]
    if not price then return end                       -- unknown item, ignore
    local player = GetPlayer(src)
    if not player or not isNearShop(src) then return end -- check position server side
    if player.getMoney() < price then return end
    player.removeMoney(price)
    player.addItem(item, 1)
end)

• Decide prices, rewards and amounts on the server.
• Validate every argument: type, range, whether the player can do this right now (distance, job, cooldown).
• Use source (copied into a local at the top of the handler), never a player ID sent as an argument, to know who is asking.
• Rate limit events that could be spammed.

More in Client, server and events.

4. The database

• MariaDB listens on 127.0.0.1 only. Never open port 3306 to the internet.
• Use a dedicated database user with a strong password, not root with an empty one.
• Manage it remotely through an SSH tunnel.
• Use parameterised queries (? placeholders) everywhere. See Database setup.
• Back it up every night, and keep copies off the server.

5. Secrets out of git and screenshots

Keep your license key, database password, Discord bot tokens, Tebex secret and webhook URLs in a separate secrets.cfg that you exec from server.cfg, and add it to .gitignore:

secrets.cfg
txData/
cache/
*.log

If a key leaks: regenerate the license key on the Portal, change the database password, reset the bot token. Webhook URLs are secrets too: anyone with the URL can post to your channel.

6. What you install

• No leaked resources. Besides breaking the platform license, leaked paid scripts are a favourite place to hide backdoors: obfuscated code that downloads and runs remote Lua, gives admin to a stranger, or empties your Tebex.
• Read what you install, at least quickly. Red flags in Lua: load( or assert(load( with downloaded or encoded strings, PerformHttpRequest to unknown domains combined with load, long lines of escaped bytes (\x..), or files that are unreadable on purpose in a supposedly open resource.
• Prefer well known open source resources from GitHub (see Recommended resources) and paid ones from reputable creators who use Cfx.re escrow.
• Keep them updated: security fixes land in ox_inventory, frameworks and txAdmin regularly.

7. Server settings that help

sv_scriptHookAllowed 0         # block singleplayer mod menus
sv_endpointPrivacy true        # hide player IPs in public output
sv_entityLockdown strict       # only the server may create networked entities
# rcon_password is left unset, so RCON is disabled

• Entity lockdown stops a big class of cheats (spawning objects and peds). It also breaks scripts that create networked entities on the client, so test it on a dev copy. relaxed is a middle ground.
• sv_filterRequestControl can block clients from taking control of entities they don’t own, another common cheat vector. Read its modes in the server commands reference before using it.
• State bags: set sv_stateBagStrictMode true if your resources only set state from the server, so clients can’t write to state bags.

8. Anticheat, realistically

No anticheat is perfect, and a paid one does not fix unsafe events. In order of value:

1. Safe server side code (section 3).
2. Entity lockdown and the settings above.
3. Good logging: txAdmin’s action log and server log, plus logs of money and item changes in your framework.
4. Active moderators with txAdmin.
5. Then, if you still need it, a reputable anticheat.

FiveM Scripting: How to Stop Cheaters (Twisle)

9. The machine itself

• Keep the OS updated. On Linux, enable unattended security upgrades.
• SSH with keys, not passwords. Disable root login over SSH.
• Run FXServer as its own user, not root or Administrator.
• Firewall: only 30120 TCP/UDP public, 40120 restricted, SSH restricted if possible.
• Backups of txData, the server folder and the database, stored elsewhere.

Quick checklist

• Every admin has their own txAdmin account with only the permissions they need.
• 2FA on every Cfx.re account with admin access.
• 40120 restricted, 3306 closed.
• Secrets in secrets.cfg, not in git.
• No leaked or unreadable resources.
• Server events validate everything and use source.
• sv_scriptHookAllowed 0, sv_endpointPrivacy true, entity lockdown tested.
• Nightly backups copied off the machine.