Configuration Reference
The SecurityX plugin self-provisions: your license is embedded in the JAR, so config.yml only exists to tune behavior, not to hold keys.
# Language: en, es, pt, jp, zh
language: en
config-version: 1
updates:
enabled: true
auto-update: false
channel: stable # stable | beta | dev
cloud: false # Data cloud relay (beta, off by default)
cloud-cache-ttl-seconds: 300
cloud-queue-batch-size: 5
cloud-queue-flush-interval-seconds: 5
alerts:
staff-notifications: true
join-alerts:
enabled: true # staff sees banned-player join attempts
webhooks:
enabled: false
url: "YOUR_DISCORD_WEBHOOK_URL"
debug: falseUpdate channel
auto-update: false by default. Apply verified updates manually with /sx update confirm — the JAR is hash-verified before it is applied.
Blocks VPN, proxy, Tor, and abusive IP ranges on join. Provider selection is global for Spigot; on Velocity/Bungee the check runs server-side with IPAPI / IPSTACK / PROXYCHECK. The default guard-cloud provider needs no key and is maintained by our infrastructure.
anti-vpn: enabled: false provider: "guard-cloud" # guard-cloud | ip-api | proxycheck | ipstack api-secret: "" # only for guard-cloud (optional, higher quota) api-key: "" # required for proxycheck / ipstack require-auth: false action: KICK # KICK | BAN | WARN (BAN is not implemented yet) check-abuse: true # block known abusive ranges check-tor: true # block Tor exit nodes exempt-staff: true exempt-permission: "securityx.antivpn.exempt"
Combined signals
abuse + TOR + VPN databases are merged into a single verdict before the player spawns.
Kick-screen messages
The kick reason is fully customizable through the language files.
reports:
enabled: true
cooldown-seconds: 60
max-per-hour: 5
duplicate-detection: true
require-evidence: true # in-game evidence is a URL (image/video/log)
categories:
cheating:
subcategories: [KillAura, Fly, Speed, Reach, AutoClicker, Aim Assist, Movement, Other]
chat: { subcategories: [Slurs, Threats, Spam, Staff-Disrespect, Other] }
griefing: { subcategories: [Stealing, Destroying, Scamming, Other] }
exploiting: { subcategories: [Dupe, Crash, Bypass, Other] }
advertising: { subcategories: [IP-Sharing, External-Links, Other] }
harassment: { subcategories: [Discrimination, Doxing, DDoS-Threats, Other] }
bugabuse: { subcategories: [Exploits, Glitches, Other] }
other: { subcategories: [Other] }SLA auto-escalation
Local reports that stay unhandled for 60 minutes are escalated, and anything still pending after 24h is pushed to the global review queue for the SecurityX team.
Anti-spoofing
Rejects players who join with falsified identity data. Default: enabled with KICK action.
IP bans & alt limit
ban-ip: true bans the address on Global bans; alt detection flags >3 accounts sharing one IP.
Bedrock (beta)
bedrock.enabled toggle + prefix normalization for Geyser/Floodgate players.
Diagnostics
Run /sx diagnose anytime to self-check license, heartbeat and sync status.
