FiveM Server Setup and Hardening: The Real Checklist
Run a FiveM server that survives its first six months: verified server.cfg convars, resmon and profiler workflow, plus a phased setup and hardening checklist.
Roby Einstein
FairShieldAC Security Team
A FiveM server survives its first six months on four unglamorous things: single-thread CPU headroom, a resource list you can justify line by line, a server.cfg where you can explain every convar, and an admin process that outlives whoever wrote it. Protection is the fifth. A FiveM server setup that hitches at forty players loses its population before a cheater arrives.
This is the server guide, not the installer walkthrough: which convars are real, their documented defaults, where your frame time goes, and what to do in week one. Every command below is quoted from official Cfx documentation.
What Actually Decides Whether a FiveM Server Survives Six Months
Ordered by lethality, which is a different list from the one people argue about:
- Performance headroom. FXServer's main logic behaves as one hot thread, so per-core clock speed beats core count.
- Resource discipline. The most self-inflicted of the five. Every script is a permanent tax on tick time and startup time.
- Server-side validation. Whether your scripts trust the client, covered in the server-side versus client-side breakdown.
- Staff process. Unmeasurable, unconfigurable, behind more closures than any exploit.
- Protection. Real, necessary, fifth. It stops damage the other four cannot touch, and will not rescue a hitching server.
That ordering is a judgement from years of operating servers. Treat it as one, and be sceptical of the exact percentages other pages quote for server closures; none of them carry a source.
The Minimum Viable FiveM server.cfg
A working config is smaller than the copypasta suggests. Endpoints, a license key, identity, a slot count, a sync mode, your resource block, your ACEs. The rest is tuning.
| Convar or command | Documented purpose | Documented default | What the decision costs you |
|---|---|---|---|
| endpoint_add_tcp [endpoint] | Adds and binds the provided endpoint, creating a multiplexable TCP server instance | n/a | Must match the TCP port you open upstream; txAdmin can enforce or replace these lines |
| endpoint_add_udp [endpoint] | Creates a UDP host instance; the address and port must be valid and not already in use | n/a | If the port is taken the server will not bind at all |
| sv_licenseKey [key] | Sets the license key for this server | not documented | No key, no listing; keep it out of any repo you push |
| sv_hostname [newValue] | The server-specific host name | not documented | Cosmetic alone; the docs point you at sv_projectName and sv_projectDesc as well |
| sets sv_projectName | The name of your project or community; a name, not a list, and no tags | not documented | Non-compliant names are cut off in the server list, and a missing value throws a startup error |
| sets sv_projectDesc | The description of your project, written as a sentence | not documented | Same startup error path as sv_projectName |
| gamename [game] | Defines the game to run the server for: gta5 or rdr3 | not documented | Wrong value points the server at the wrong game entirely |
| sv_maxClients [newValue] | Maximum clients as an integer from 1 to 2048; 32 and above requires onesync on or legacy, above 64 requires onesync on | not documented | Slots you cannot feed with CPU are worse than slots you never sold |
| onesync [on/off/legacy] | Which mode of state awareness to use: off, on, or legacy | not documented | Legacy is documented as not recommended due to performance issues and graphical glitches |
| sv_enforceGameBuild [build] | Selects a game build for clients to use; startup only, cannot be changed at runtime | not documented | Clients must restart the game to switch builds, and a changed build can break streamed content |
| load_server_icon [fileName.png] | Loads a specified icon and sets it as the server icon; must be a 96x96 PNG | n/a | Wrong dimensions and the icon is simply rejected |
| steam_webApiKey [key] | Required to allow Steam identifiers to be returned by the server | not documented | Without it you lose the Steam identifier on every connecting player |
| rcon_password [password] | Sets the RCon password; if unset, RCon is disabled; FXServer RCon uses UDP | disabled when unset | Setting one creates a root credential over UDP, so scope and rotate it like one |
| sv_lan [true/false] | Makes the server LAN-only; it will not appear in the public list and license key checks are skipped | false | Left enabled by accident and nobody outside your network can find you |
Source: FiveM server commands. The sets tags, sets locale and banner lines live in the shipped example config, not on that page. Watch casing too: the reference writes sv_maxClients, the example writes sv_maxclients, and case-insensitivity is documented nowhere.
Slots, OneSync and How Many Players You Can Really Hold
sv_maxClients accepts 1 to 2048; from 32 up you need onesync on or legacy, and above 64 you need onesync on. Legacy is a compatibility mode Cfx calls not recommended, citing performance issues and graphical glitches. OneSync is free to 48 slots, and beyond that the docs point at Element Club Argentum or higher.
Your real ceiling is a tick-budget question no hardware table answers. Two documented facts shape it: the culling radius is 424 units around the entity, and scope events scale, so 32 players in scope means 32 calls. And sv_maxclients has no documented default; the 32 everyone repeats is hardcap's fallback.
FiveM Server Hardening: What Clients May Create, Route and Modify
Organise hardening by decision, not by threat. Each convar answers a question you own: what may a client create, what may it route through your server, what may it modify? Documented defaults and trade-offs below.
| Convar | The decision it encodes | Documented default | Trade-off the docs state |
|---|---|---|---|
| sv_entityLockdown [mode] | How strict the server is about client-created entities; modes inactive, relaxed, strict and full | inactive | Strict blocks all client entity creation, relaxed blocks only script-owned ones, full is Enhanced-only. Plenty of framework resources expect at least relaxed, so test first |
| sv_scriptHookAllowed [true/false] | Whether clients with Script Hook V may connect | false | The docs warn against enabling it, stating it makes the server vulnerable to security issues |
| sv_pureLevel [level] | Blocking of modified client files; level 1 blocks all except audio files and known graphics mods, level 2 blocks all | not documented | Level 2 turns away players running harmless graphics packs, so budget for the support tickets |
| setr sv_stateBagStrictMode [true/false] | Whether the network owner of a replicated entity can modify state bags, or only the server can | false | True is stricter, and any resource that writes entity state client-side stops working. Introduced in server build 12739 |
| sv_filterRequestControl [mode] | Policy for blocking REQUEST_CONTROL_EVENT routing; modes -1 through 4 are enumerated in the docs | 0 (off) | Higher modes can interfere with legitimate resources that need to take entity control |
| sv_filterRequestControlSettleTimer [time] | How long after creation an entity is protected from a request control event; applies to modes 1 and 3 | 30000 | The value must be given in milliseconds, which is where people trip |
| sv_enableNetworkedSounds | Whether NETWORK_PLAY_SOUND_EVENT may be routed through the server | true | Open by default; closing it removes a routing path some legitimate resources use |
| sv_enableNetworkedScriptEntityStates | Whether SCRIPT_ENTITY_STATE_CHANGE_EVENT may be routed through the server | true | Same call as above, and the same need to check your resource list first. Introduced in server build 8540 |
| sv_enableNetworkedPhoneExplosions | Whether phone explosion events may be routed | false | Already closed by default; leave it closed |
| sv_authMinTrust [newValue] | Minimum trust accepted, 1 to 5, where trust is how unlikely an identity is to be spoofed | 1 | Raising it locks out players whose only identifier is a weak one |
| sv_authMaxVariance [newValue] | Maximum variance accepted, 1 to 5, where variance is how likely a provider's id is to change | 5 | Lowering it rejects identifier types that change between sessions |
| sv_requestParanoia [newValue] | Counters proxy-based HTTP floods; levels 0 to 3 | 0 | From level 2 the info, dynamic and players JSON endpoints stop answering, and the docs say use with care. Level 3 also closes the socket |
| sv_endpointPrivacy [newValue] | Hides player IP addresses from public reports output by the server | not documented | Little downside, though some admin tooling expects to read those endpoints |
| net_tcpConnLimit [limit] | Tunes the concurrent connection limit per IP | 16 | Set it too low and players sharing a NAT collide with each other |
Source: FiveM server commands. Change one convar at a time, on staging, with your real resource list running; a setting that breaks your vehicle shop gets reverted at 2am and stays reverted. Script-level trust is a separate layer, covered in how Lua executors abuse trusted events, and attack traffic has its own playbook.
Delete what a copied config left behind. Cfx documents the first two, in its Enhanced-exclusive section, as having no effect:
- onesync_enableBeyond and sv_enhancedHostSupport, documented as no longer necessary and no longer used.
- sv_protectServerEntities, documented as not implemented, pointing you at sv_entityLockdown instead.
- Anything absent from the reference: net_maxPackets, sv_useDirectListing, sv_debugQueue, sv_hideRconOutput and onesync_enabled appear nowhere in current Cfx documentation.
Finding What Is Costing You Frame Time
Two tools, two questions. resmon runs on the client and shows which resources eat client frame time. The profiler, run server-side, shows what eats your server tick.
| Command | Where it runs | What the documentation says it does |
|---|---|---|
| profiler record <frames> | Server console or client console | Starts a capture; the official guide suggests 500 frames as a starting point because it covers a substantial period |
| profiler status | Server or client | Reports whether the capture is active and how many frames it has captured |
| profiler view | Server or client | Opens the capture in Chrome; server-side it does not launch Chrome for you, so you copy the provided link across manually |
| profiler saveJSON <file>.json | Server or client | Saves the capture to the folder where your run.bat lives, ready to load into Chrome DevTools under Performance |
| resmon <true/false> | Client, developer mode required | Opens the resource monitor showing CPU and memory usage per resource |
| netgraph <true/false> | Client, developer mode required | Real-time client network metrics including ping, bytes in and out, routing packets and routing packet delay |
| strmem <true/false> | Client, developer mode required | Lists streaming memory used by specific streaming assets plus a global overview |
| cl_drawfps <true/false> | Client, no developer mode needed | Enables the frames-per-second counter in the screen corner |
| cl_drawperf <true/false> | Client, no developer mode needed | Shows FPS, ping, packet loss, CPU usage, GPU usage and GPU temperature in the corner |
| svgui | Server console | Opens or closes the server debug GUI |
Sources: client console commands and using the profiler. Plenty of guides tell players to press F8 and type resmon. resmon, netgraph, strmem and netobjviewer are developer commands, and Cfx states they need developer mode or they return Access denied for command resmon. The documented ways in are +set moo 31337 or a non-production update channel.
The workflow: profiler record 500 at real population, then profiler saveJSON capture.json, opened in Chrome DevTools under Performance. Hitches show as sudden spikes in CPU time exceeding normal frames. Capture an empty server first, because Cfx publishes no acceptable millisecond figure for resmon and no hitch threshold; anyone quoting a 0.05ms target is repeating folklore.
Resource Discipline and What the Base Data Already Starts
Use ensure instead of start; it restarts a running resource and starts a stopped one, so reloads stay idempotent. Order the block deliberately: dependencies, framework, then what leans on them.
- server_only 'yes' in fxmanifest.lua stops clients downloading anything of that resource.
- Declare dependencies explicitly; the manifest reference documents constraints such as /server:4500, /onesync and /gameBuild:h4.
- node_version is documented as defaulting to 16, with 22 available.
- Delete lua54 'yes'; the docs note all Lua scripts use 5.4 as of June 2025.
- Audit the base data: runcode registers /run and /crun behind command.run, command.crun and runcode.self.
Staff Access: Set Up ACE Permissions Before You Need Them
The built-in ACL is the piece almost nobody configures. Cfx's own cookbook note, archived from July 2021, says it has not seen people use it to its full potential. The example config shows the pattern in three lines: allow group.admin the command object, deny group.admin command.quit, add your identifier as a principal of group.admin. On txAdmin, audit who holds all_permissions, documented as root and as removing all other permissions.
Where Protection Fits in the Ordering
Protection is fifth, after performance and resource discipline. The line is clean: configuration decides what is possible, the anti-cheat decides what is caught. sv_entityLockdown, sv_pureLevel and sv_scriptHookAllowed sit on the configuration side; sensitivity, ban policy and appeals sit on the other, covered in the step-by-step install guide and the 2026 vendor scorecard. FairShieldAC sits in that layer: real-time detection with server-side behavioural analysis, a global HWID ban network screening players at connect, and Gravity DDoS protection upstream. We build anti-cheat, not hosting, so the advice here stays host-neutral.
The Phased Checklist: Before Launch, First Week, Ongoing
Before launch
- Pin the recommended artifact: supported six weeks past the next release, against two for latest.
- Delete every convar you cannot explain out loud.
- Set sets sv_projectName and sets sv_projectDesc; missing values throw a startup error.
- Choose sv_maxClients from measured headroom, respecting the onesync gates and the 48-slot line.
- Audit which principals hold command.run and command.crun.
- On Windows, exclude the FXServer folder from Defender; the docs name it as a slow-startup cause.
- Capture a baseline with profiler record 500 on an empty server.
- Never ship sv_devMode enabled: Enhanced-only, caps clients at 8, not for production.
First week
- Expect listing lag: up to 8 minutes to appear if no other heartbeats are sent.
- Profile at real population and diff against your empty-server baseline.
- Watch startup time as resources accumulate; Cfx notes that adding resources increases it.
- Enable the oxmysql slow query warning, then read it sceptically; its docs warn slow queries can signal hitches.
- Fix your top three frame-time offenders before installing another script.
Ongoing
- Keep artifacts current: unsupported ones older than three months are not joinable from the server browser.
- Re-profile after every content drop, and re-check hardening convars after framework updates.
- Re-read your ACEs and txAdmin admin list quarterly; remove the people who left.
- Keep a dated change log of server.cfg edits; it is the fastest diagnostic you own.
- Test the restart flow; txAdmin's docs warn against relying on its events for consistency.
What a Checklist Cannot Fix
Configuration solves configuration problems. It does nothing for what actually ends communities, and pretending otherwise is how owners tune convars at midnight while the staff team falls apart.
- Measurement misleads: a slow query can signal a hitch, as the oxmysql docs warn.
- There is no published number to aim at, so judgement does the work.
- It cannot give your server an identity; frame time only buys the chance.
- It cannot fix staff churn or burnout.
FiveM Server Setup FAQ
What do I actually need in server.cfg to run a FiveM server?
Endpoints (endpoint_add_tcp and endpoint_add_udp), sv_licenseKey, sv_hostname, sets sv_projectName, sets sv_projectDesc, gamename, sv_maxClients, an onesync mode, your ensure block, and add_ace plus add_principal for staff. Everything else in a downloaded config is tuning.
How many players can my FiveM server handle?
Documented limits: 1 to 2048 clients, onesync on or legacy from 32 up, onesync on above 64, and OneSync free to 48 slots with more requiring Element Club Argentum or higher. The practical limit comes from single-thread CPU headroom against your resource list, which only a profiler capture locates.
What causes a server thread hitch warning and how do I find the resource responsible?
A hitch means something blocked the server tick long enough to be noticed, usually one resource doing too much in a single frame. Use the profiler on the server, since resmon only sees the client. Record 500 frames at population, save with profiler saveJSON, open the file in Chrome DevTools under Performance, and look for CPU spikes above normal frames.
Should sv_scriptHookAllowed be true or false?
False, which is the documented default. Cfx attaches an explicit warning that enabling it is not recommended and makes the server vulnerable to security issues. If you inherited a config with it switched on, that one line tells you how much of the rest to trust.
Next Step
Capture a 500-frame profile at peak today and open it in Chrome DevTools. Whatever sits at the top of that chart is your roadmap for the fortnight, and it is rarely what you assumed. Once the tick is stable, add the protection layer; our plans cover real-time detection, the global ban network and Gravity DDoS protection. Next reads: the anti-cheat install walkthrough, HWID bans explained and the three layers of protection.