Getting Started

Configuration Reference

The SecurityX plugin self-provisions: your license is embedded in the JAR, so config.yml only exists to tune behavior, not to hold keys.

config.ymlNo API keysconfig-version: 1
config.yml
# Language: en, es, pt, jp, zh
language: en
config-version: 1

updates:
  enabled: true
  auto-update: false
  channel: stable        # stable | beta | dev

cloud: false             # Data cloud relay (beta, off by default)
cloud-cache-ttl-seconds: 300
cloud-queue-batch-size: 5
cloud-queue-flush-interval-seconds: 5

alerts:
  staff-notifications: true
  join-alerts:
    enabled: true        # staff sees banned-player join attempts
  webhooks:
    enabled: false
    url: "YOUR_DISCORD_WEBHOOK_URL"

debug: false

Update channel

auto-update: false by default. Apply verified updates manually with /sx update confirm — the JAR is hash-verified before it is applied.

Blocks VPN, proxy, Tor, and abusive IP ranges on join. Provider selection is global for Spigot; on Velocity/Bungee the check runs server-side with IPAPI / IPSTACK / PROXYCHECK. The default guard-cloud provider needs no key and is maintained by our infrastructure.

config.yml
anti-vpn:
  enabled: false
  provider: "guard-cloud"   # guard-cloud | ip-api | proxycheck | ipstack
  api-secret: ""            # only for guard-cloud (optional, higher quota)
  api-key: ""               # required for proxycheck / ipstack
  require-auth: false
  action: KICK              # KICK | BAN | WARN (BAN is not implemented yet)
  check-abuse: true         # block known abusive ranges
  check-tor: true           # block Tor exit nodes
  exempt-staff: true
  exempt-permission: "securityx.antivpn.exempt"

Combined signals

abuse + TOR + VPN databases are merged into a single verdict before the player spawns.

Kick-screen messages

The kick reason is fully customizable through the language files.

config.yml
reports:
  enabled: true
  cooldown-seconds: 60
  max-per-hour: 5
  duplicate-detection: true
  require-evidence: true    # in-game evidence is a URL (image/video/log)
  categories:
    cheating:
      subcategories: [KillAura, Fly, Speed, Reach, AutoClicker, Aim Assist, Movement, Other]
    chat:            { subcategories: [Slurs, Threats, Spam, Staff-Disrespect, Other] }
    griefing:        { subcategories: [Stealing, Destroying, Scamming, Other] }
    exploiting:      { subcategories: [Dupe, Crash, Bypass, Other] }
    advertising:     { subcategories: [IP-Sharing, External-Links, Other] }
    harassment:      { subcategories: [Discrimination, Doxing, DDoS-Threats, Other] }
    bugabuse:        { subcategories: [Exploits, Glitches, Other] }
    other:           { subcategories: [Other] }

SLA auto-escalation

Local reports that stay unhandled for 60 minutes are escalated, and anything still pending after 24h is pushed to the global review queue for the SecurityX team.

Anti-spoofing

Rejects players who join with falsified identity data. Default: enabled with KICK action.

IP bans & alt limit

ban-ip: true bans the address on Global bans; alt detection flags >3 accounts sharing one IP.

Bedrock (beta)

bedrock.enabled toggle + prefix normalization for Geyser/Floodgate players.

Diagnostics

Run /sx diagnose anytime to self-check license, heartbeat and sync status.