FiveM Anticheat Discord Alerts: Webhooks That Get Read
Wire FiveM anticheat alerts into Discord the right way: webhook fields, severity routing, a high-signal staff channel, privacy rules and who acts on them.
Roby Einstein
FairShieldAC Security Team
If your FiveM anticheat Discord alerts go unread, the webhook is almost never the problem - the channel design is. One feed carrying every detection, connect and log line teaches staff to scroll past it quickly. The fix is routing: a quiet channel holding only what a human must act on, a separate firehose nobody watches, and a payload rich enough to decide from.
Why nobody reads your FiveM anticheat Discord channel
The failure is mechanical. A channel fed by every category at once produces far more messages than anyone reads, and the reader cannot tell which three need a response. So they mute it. The webhook still fires, the embeds still land, and the server is functionally unmonitored.
Discord's ceilings push the same way. A message carries up to ten embeds, an embed holds up to 25 fields, and all embeds share a 6000-character budget, so batching a busy feed into fat posts hits a wall rather than scaling. Alerting is the last mile of detection: an engine can classify a mod menu perfectly and it counts for nothing if the message lands where nobody looks. Still mapping what your tool catches? Start with how a FiveM anticheat detects cheating.
What a FiveM anticheat Discord webhook alert should contain
An alert exists so one person can decide, in about ten seconds, whether to open the game. Owners often ask what a FiveM anti cheat alert should carry; the answer is the fields that serve that decision.
- A stable identifier. GetPlayerIdentifiers returns steam, discord, license, license2, fivem and ip. Key the alert on license, the Rockstar Online Services hash that survives a name change, and carry the discord id so staff can mention the account directly.
- A UTC timestamp and the server or session. Multi-server networks fall apart without it, and an appeal weeks later is impossible to reconstruct.
- The detection class in plain words. Aimbot, silent aim, ESP, noclip, godmode, teleport, spawn abuse. Nobody should have to look up an internal rule number at 2am.
- Confidence and source. FiveM's server security documentation warns that 'client checks can also be a good practice but can be easily be overridden'. A client-sourced signal is a lead; a server-confirmed one is evidence, and one field saying which cuts more noise than any filter.
- A link to the stored evidence, not the evidence itself. Cfx's screenshot-basic resource uploads a capture to a remote HTTP URL, so the message carries a link rather than an image that buries the next alerts.
- The action id, once a ban or warn is applied, so the message can be matched to its own reversal later.
Leave out the raw IP, internal thresholds, tolerance windows and stack traces; thresholds posted where half your staff can read them become a tuning guide once somebody leaves badly. If your tool cannot put an evidence link in the payload, weigh that when you assess the best FiveM anticheat options - an alert you must re-investigate from scratch is barely an alert.
Route by severity: one actionable channel, one firehose
Severity is not the same thing as category. The common setup is one webhook per category - bans, kicks, connects, explosions - which leaves every category looking equally urgent. Route by what a human has to do. Separate webhooks also earn separate rate-limit buckets, since Discord treats a webhook id as a top-level rate-limit resource, so a chatty log feed backing off cannot starve the channel that matters.
| Alert type | Urgency | Where it goes | Who acts |
|---|---|---|---|
| Server-confirmed detection, player still online (godmode, noclip, teleport classes) | Act now | ac-action, high-signal only | On-call moderator with spectate and ban rights |
| Ban applied (txAdmin playerBanned, carries actionId) | Record only | ac-audit, append-only | Nobody acts - it is the audit trail |
| Ban or warn revoked (actionRevoked, same actionId) | Review | ac-audit plus weekly review | Senior staff or head of moderation |
| Signal awaiting confirmation | Queue | ac-firehose | Reviewed on the team's own schedule |
| Recurring signal on one account | Batch | ac-firehose, digested | Whoever runs the periodic review |
| Staff action (admin auth, live console command) | Oversight | staff-audit, restricted visibility | Owner or senior staff only |
| Any payload containing an ip identifier | Never send | Nowhere | Strip it in the alert template |
| Pipeline failing (repeated 429s, webhook 401 or 403) | Act now | infra, pings the technical owner | Server owner or developer |
Channel names are illustrative. The actionable channel should be quiet enough that a new message is startling; more than a handful on a normal evening means revisiting what counts as actionable.
Who is on call, and how fast they answer
No platform documentation sets a response time for a cheat detection, and anyone quoting one as a standard invented it. Choose your own tiers, publish them internally, and attach a name to each: act now, same session, next review. The number matters less than somebody owning each tier.
Add an acknowledgement convention: one reaction means claimed, a second means resolved, and anything unclaimed after your window escalates to the next name on the rota. It costs nothing to set up and is often skipped. txAdmin grants spectating and banning as separate permissions, so a trainee who can watch but cannot ban is supported.
The pipeline ends the moment a human claims the message. Evidence gathering, questioning and the decision are a separate discipline, laid out in the staff workflow for a cheater report.
Is it safe to send player IPs to a Discord webhook?
No, and the platform already closed the leak owners used to manage with a convar. sv_endpointPrivacy is gone; current FiveM server source declares it only to print a removal notice: 'sv_endpointPrivacy has been removed. Player endpoint addresses are no longer exposed on any HTTP endpoint. Please remove this ConVar from your server configuration.' sv_exposePlayerIdentifiersInHttpEndpoint went the same way; identifiers appear on players.json only when the request is authenticated using sv_playersToken. The docs.fivem.net server-commands page still lists the old convar, so stale advice circulates. Delete it from your server.cfg.
That closes one path and leaves this one open. GetPlayerIdentifiers still hands your resources the ip identifier, so any address reaching Discord got there because a template put it there. Least privilege is already the platform's posture: txAdmin ships a permission described as 'View Settings (no tokens)'. Give the webhook URL the same handling: Discord documents webhooks as needing no 'bot user or authentication to use', so whoever holds it can post as your anticheat. Keep it in a server convar, never in a client file, and treat a leak as a webhook you delete and recreate.
What txAdmin already logs versus what an anticheat adds
txAdmin comes preinstalled with FXServer and keeps three streams under your profile's logs folder. The admin log is a 'log of administrative actions as well as some automated ones like server restarts, bans, warns, settings change, live console input'. The console log captures everything passing through the FXServer console, and the server log records 'player join/leave/die, chat messages, explosions, menu events, commands'. All three rotate; the console and server logs are also capped by file count and size, while the admin log is not.
It is a good record, and a pull surface. txAdmin records; it does not notify. Its Discord integration is a persistent status embed plus commands to whitelist a player and show player info, with no native push of a detection into a staff channel. A FiveM anticheat supplies what the log cannot: classification of what fired, evidence attached to the event, and routing that decides whether anyone is woken up. This is only the logging-and-notification slice; the full division of labour is in FiveM anticheat vs txAdmin, and for install, ports and security settings see txAdmin explained.
Keeping an audit trail so a ban is defensible later
txAdmin broadcasts a ban event carrying an actionId, and the revocation event carries the same actionId when that ban or warn is reversed. Write the action id into the Discord message and a ban and its unban become one traceable record months later, when an appeal arrives and nobody remembers the session. Keep the audit channel append-only - no edits, no deletions.
Low-confidence detections belong in the firehose, reviewed in batch, which keeps honest mistakes out of the channel where staff act immediately. FairShieldAC pairs Discord webhook notifications with the Real-Time Anti-Cheat Dashboard, where the bans, screenshots and activity logs live, so the message stays short and the link carries the weight.
Common questions about FiveM anticheat Discord alerts
Should anticheat alerts and server logs share one Discord channel?
No. Use two channels on two webhooks with different permissions: one high-signal channel receiving only events that need a human, and one firehose archiving the rest, muted. Separate webhooks get separate rate-limit buckets, so log volume cannot delay the alerts that matter.
How fast should staff respond to a cheat detection alert?
There is no published standard, so set your own and write it down. Three tiers work: act now for a server-confirmed detection while the player is online, same session for anything that can wait for the next admin, and next review for batched low-confidence signals. Name someone for each.
Why did my FiveM Discord webhook stop posting?
Commonly one of four things: outbound HTTP is blocked or the resource never fires, the channel or webhook was deleted, the URL was rotated after a leak, or you are rate limited. Discord states that rate limits 'should not be hard coded into your app' - honour the Retry-After header on a 429 instead.
Does txAdmin send cheat detection alerts to Discord by itself?
It does not. Its Discord features are a persistent auto-updated status embed and two commands, one to whitelist a player and one to show player info. The logs are good, but you open the panel to read them. Pushing a classified detection into a channel is the anticheat layer's job.
Where to start this week
Scroll back one evening in your alert channel and count how many messages actually required action. That ratio explains most of the problem. Then split the feed in two, strip the IP from the template, add the evidence link and the action id, and publish the on-call tiers. FairShieldAC's Discord webhook notifications and Real-Time Anti-Cheat Dashboard work as that pair, with a free trial and plans if you want to see it running.
For background, what a FiveM anticheat is and how detection works covers the engine side, and the criteria behind the best FiveM anticheat shortlist cover what to demand from a payload. With routing in place, confirm it using how to test your FiveM anticheat safely, then check what data a FiveM anticheat collects so your template and privacy policy agree.