FiveM Anticheat Glossary: Every Term, Plainly Defined

This FiveM anticheat glossary defines 36 terms server owners meet in reports and logs, from HWID (the community name for machine-linked ban identifiers) to entity lockdown (the convar that limits what clients can create). Entries are written from the defender's side, and platform terms follow Cfx.re's documentation.

Use it to decode Discord reports and anticheat logs. For how the pieces fit together, read what a FiveM anticheat is and how detection works; if you are choosing a product, our best FiveM anticheat comparison for 2026 does that job.

• Tools: mod menu, Lua executor, injector
• Behaviours: aimbot, silent aim, ESP, godmode, noclip, teleport, freecam, speedhack
• Detection: signature, heuristic, client-side, server-side, false positive, bypass
• Identity and bans: identifiers, HWID, HWID ban, spoofer, Cfx.re global ban, global ban list
• Platform: OneSync, entity lockdown, state bags, routing bucket, pure mode, artifact, txAdmin, resmon
• Attacks: trigger, event spoofing, backdoor, crasher, DDoS

FiveM Cheat Terms: Mod Menus, Lua Executors and Injectors

Mod menu is a packaged cheat with an in-game menu that bundles several cheats, such as aimbot, godmode and teleport, behind one interface.

Lua executor is a cheat tool that runs attacker-written Lua inside the FiveM client (how to stop one). Cfx.re's security guide warns: "Cheats can allow the client to trigger events in any context."

Injector is the loader that forces cheat code into the running game process. Cfx.re's ban FAQ says its own platform anticheat detects external programs that attempt to inject themselves into the FiveM client.

FiveM Cheat Behaviours: Aimbot, ESP, Godmode and Noclip

Aimbot steers a player's aim onto targets automatically. See how aimbot, silent aim and ESP are caught.

Silent aim is an aimbot variant that registers hits without the cheater's camera visibly moving, so a spectating admin may see nothing unusual.

ESP (extra-sensory perception), also called a wallhack, is a cheat that draws players and items the cheater should not see, often through walls. Because it only changes the cheater's screen, it is harder to prove.

Godmode is a cheat that makes a player ignore damage. txAdmin's admin menu offers God and NoClip modes too, so check staff activity first (warning signs).

Noclip is movement that ignores collision, passing through walls or under the map. Custom maps can trip noclip checks; FairShieldAC's changelog logged a false-ban fix for that on 3 September 2026.

Teleport is an instant, unexplained jump in position. Garages and admin commands do the same, so checks need whitelisted locations.

Freecam detaches the camera from the character so the cheater can scout without moving.

Speedhack is a cheat that moves a player or vehicle faster than the game allows.

FiveM Anticheat Terms: How Detection Is Described

Signature detection matches known traits of a specific cheat build. It is precise but blind to new or updated builds until refreshed, the gap heuristics aim to close.

Heuristic detection, also called behavioural analysis, judges what a player or client does, such as impossible movement or suspicious event calls. It can flag uncatalogued cheats but needs tuning.

Client-side checks run on the player's PC inside the FiveM client. Cfx.re's security guide warns that client-side checks can be overridden by cheating clients, so treat them as signals.

Server-side checks run on your server, out of the player's reach; Cfx.re's resource FAQ says "Use server-side code where possible." A FiveM anti cheat commonly uses both (server vs client).

False positive is a detection on a player who did not cheat; a false ban is enforcement acting on one. See false positive causes and fair appeals.

Bypass means a cheat avoiding a particular detection, and detection coverage is the share of cheats a product catches. No FiveM anticheat can honestly promise full coverage, so check the claims and see why cheaters still get through.

FiveM Identity and Ban Terms: HWID, Spoofers and Global Bans

Identifiers are the account IDs a server can read for a player. Cfx.re documents six for GetPlayerIdentifiers: steam, discord, license, license2, fivem and ip. ESX and QBCore tie player records to the license identifier by default (frameworks); log identifiers in every cheater report.

HWID (hardware ID) is the community term for identifiers tied to a player's machine. FiveM has no native named HWID; it exposes player tokens, which Cfx.re documents as "specific to a server". See HWID bans explained.

HWID ban is a ban matched against a player's hardware tokens, aimed at blocking a banned player's new accounts on the same PC. txAdmin warns these tokens "are not guaranteed to be unique", so unrelated players can match.

Spoofer is software that tries to change or hide the hardware identifiers a PC reports, so a hardware-linked ban stops matching. Detection matters because an undetected spoofer turns an HWID ban back into an account ban that a new account sidesteps.

Cfx.re global ban is a platform ban from Cfx.re's own automated anticheat, which targets external programs that try to inject into the FiveM client. The banned account sees a global ban message when it tries to join servers.

Global ban list, or shared ban network, is a third-party list that bans a player across many servers. Cfx.re's resource FAQ says FiveM "rarely takes action" but lists global ban lists among resources it wants to avoid: "We have no way to verify the quality of every anticheat, and it may very well be possible for a global ban list to ban players without good reason." The same FAQ confirms anticheat resources are allowed. Any cross-server ban should therefore rest on recorded evidence and have an appeal route.

FiveM Server Platform Terms: OneSync, Entity Lockdown and txAdmin

OneSync is "a custom sync system that is built on top of GTA: Online's codebase", per Cfx.re's OneSync page. It raises slot counts and adds "server-sided synchronization states for entities" (hardening checklist).

Entity lockdown restricts client-created entities via the sv_entityLockdown convar. Inactive (default) allows any, relaxed blocks client-created script-owned entities, strict means "No entities can be created by clients", and full "Disables dummy object creation" and is only usable on GTAV Enhanced (Enhanced vs Legacy).

State bags are "arbitrary key/value pairs" attached to entities, players or the whole server, per the state bag docs. Players and entity owners can write some state by default; with sv_stateBagStrictMode true, "only the server can modify a state bag."

Routing bucket is a separate world on one server: per Cfx.re's OneSync docs, players and entities in a bucket "will only see entities (and players) that belong to the same routing bucket." See its defensive use.

Pure mode is the sv_pureLevel setting that blocks modified client files: level 1 still allows audio files and known graphics mods, level 2 blocks all. It is a free built-in protection.

Artifact is Cfx.re's term for a server build, "a package that includes the files needed to run/update your RedM or FiveM server", published on Recommended and Latest branches. See which build to use.

txAdmin is "a full-featured web panel to help you Manage & monitor your FiveM Server", preinstalled with FXServer per Cfx.re, and it does not describe itself as an anticheat. See txAdmin explained and txAdmin vs an anticheat.

resmon is a client developer command that opens the resource monitor, which Cfx.re says "monitors the CPU usage and memory usage for each resource." Use it to measure anticheat cost; see also console commands.

FiveM Attack Terms: Triggers, Event Spoofing, Crashers and DDoS

Trigger is community shorthand for a server event that client code can call through TriggerServerEvent. Triggers that grant money or items are targets, which is why FairShieldAC encrypts and shuffles them (executor guide).

Event spoofing is calling a real server event with forged arguments, such as a fake amount. Cfx.re's security advice: "Make sure to retrieve all values using server-side methods, not allowing players to change the values."

Backdoor is hidden malicious code in a resource that gives someone else control or spreads to other resources, so vet every script before you install it.

Crasher is a cheat or exploit that deliberately crashes players' clients or the server from inside a game session, so it needs a connected client, unlike a DDoS (crasher guide). FairShieldAC shipped Anti Crasher modules on 10 July 2026, per the changelog.

DDoS (distributed denial of service) is a traffic flood from many sources that overwhelms your host so players cannot connect. See the DDoS response steps; FairShield Gravity is built to absorb volumetric and application-layer attacks upstream.

Summary Table: Every Term in One Line

FiveM Anticheat Glossary FAQ

What is the difference between a mod menu and a Lua executor?

A mod menu is a packaged set of cheats behind an in-game interface, while a Lua executor runs arbitrary Lua inside the FiveM client. Even without a menu, an executor can fire server events, so server-side validation matters against both.

Is a Cfx.re global ban the same as a server ban?

No. A Cfx.re global ban comes from the platform's own automated anticheat and applies whenever the account tries to join a server. A server ban comes from one server's staff, txAdmin or anticheat and applies only there.

Does FiveM have an official HWID ban?

FiveM has no native named HWID. It gives server scripts player tokens, which Cfx.re says "can be used to enhance banning logic, however are specific to a server", and txAdmin offers HWID bans based on hardware ID tokens. Tokens are not guaranteed unique, so pair any HWID ban with an appeal route.

How to Put This Vocabulary to Work

Share this glossary with new staff so "silent aim" or "trigger" in a Discord report means the same thing to everyone. Next, read how a FiveM anticheat detects cheats, the best FiveM anticheat comparison if you are still choosing, and FiveM anticheat for QBCore, ESX and Qbox.

When you are ready for live protection, compare FairShieldAC plans, manually pre-screen players with Members Lookup, and see what FairShieldAC shipped in 2026.