Quick start

Your setup path#

Sign up, verify your email and choose a paid plan. After payment, open Servers, add your server and download its package with an account that can manage servers.

Prepare before your first session#

Divide setup into four stages: verify the account, check the paid subscription, connect the correct server and observe normal gameplay. Completing each stage before moving on helps distinguish a payment or connection problem from a resource installation problem.

Use an email address you can access and sign in with an account allowed to manage servers. Give teammates permissions appropriate to their work instead of sharing one administrator password. Before installation, back up the current resource directory, editable settings and game database so you have a known working reference.

In Billing, review the selected plan’s server and website limits, billing period and current payment status. Returning from a payment provider or uploading a receipt alone does not prove activation. Check the invoice and subscription status displayed in your account before proceeding.

Connect the package to the right server#

Select the intended record in Servers. Its package and server license belong to that record; keep files and keys from different servers separate. Account permissions and download entitlement are checked independently.

1. Check the selected server name, download its own package and compare the included version with your existing installation.
2. Follow the installation guide’s startup order. Put the license only in server-side server.cfg using set; never copy it into shared or client files.
3. Start the resource during planned maintenance. Check the console for dependency or authentication failures and confirm the panel shows the intended server.
4. The database bridge is on by default and needs no server.cfg line beyond the license. If you do not want it, turn it off with “Disable connection” on the server’s Tosun Connect card. Verify the connection with a small read request before attempting an economy change.

• Installation steps
• Database bridge

Test ordinary gameplay before raising enforcement#

Try character selection, spawning, hospital revival, garages, police equipment and staff teleports before increasing several protection settings. Review a detection alongside the activity that caused it, rather than treating the message as complete context.

Compare console output, panel records and player observations over the same period. Change one setting at a time and record its previous value so you can identify the effect and reverse an unsuitable change. Measure performance under your own server’s resources and workload.

Downloading the package again and replacing a lost or exposed license are separate tasks. If you suspect a license has leaked, updating files alone is insufficient. Coordinate key replacement with the administrator and stop older running copies before validating the new connection.

• Settings and performance

Decide whether setup is complete#

A saved-settings message is only one checkpoint. The anticheat connection, a supported database request, rented-site provisioning and HTTPS preparation each have their own outcome. Review them separately so an unfinished optional service does not obscure the result of the main installation.

• The intended server uses the current package and ordinary gameplay behaves as expected.
• Payment status is understood and an uncertain payment has not been followed by another charge attempt.
• If a website is required, its Websites card shows provisioning completed and its working address opens.
• For an unresolved issue, collect the version, server or site ID, error time and error text with all secrets removed.

Build a small acceptance plan#

Write down what a successful first session should demonstrate before inviting the whole community. Include one ordinary player and one staff account, a new connection and a reconnection. Use your actual framework and the resources players normally use; a quiet console alone cannot show whether a hospital or garage interaction is compatible.

For each scenario, record the action, expected outcome and observed outcome. A character should load, ordinary equipment should remain usable and a permitted staff action should complete. If a detection appears, keep its time together with the gameplay context and investigate before expanding enforcement.

Choose an observation period that includes your server’s busy activities. Repeat an affected scenario after changing its relevant setting, leaving other settings unchanged. Passing these checks gives the team a concrete acceptance record; it does not establish that every resource or future update is compatible.

Separate required setup from optional services#

Make a short dependency map for your own deployment. The paid account, the chosen server’s package, its server-side license and working resource startup form the initial path. The panel data connection (Tosun Connect) is already on by default, needs no extra server.cfg line and only needs checking with one small read; you can turn it off on the server’s Tosun Connect card. Discord notifications, a launcher and a rented website add separate workflows. Bring each into service after the underlying connection is understood.

For example, when the anticheat connects but the website is still provisioning, continue checking normal gameplay and track the website separately. When a bridge read fails, investigate framework support and bridge permissions; repeatedly replacing a working license will not repair an unsupported database schema.

Add one optional integration at a time and note its owner and verification method. This lets you locate the first unsuccessful stage and return to a working setup without discarding completed work. Keep a list of intentionally disabled options so another administrator does not mistake them for failures.

Hand over a reproducible operating record#

Before another administrator takes over, prepare a short record containing the server ID, installed version, framework, startup order and the location of editable settings. Link to the relevant documentation topics and state which optional integrations were verified. Keep licenses and private credentials in your approved secure storage rather than inside this record.

Include the maintenance window, changed settings and the previous working values. Name who handles billing, integration credentials and gameplay reports. Describe how to restore your own saved resource files and configuration, and which observations should be checked immediately after that restoration.

When a resource, framework or hosting environment changes later, reuse the same acceptance scenarios. Compare the new results with the earlier record instead of relying on memory. This makes upgrades easier to review and gives support a useful history without sharing an archive of unrelated player data.

Match four identities in one setup record#

Before installation, create a record with the selected panel server ID, the Build ID from download history, the package fxmanifest.lua version and the directory you intend to run. These identify different things: the server record, distributed package, software version and machine installation. A new ZIP may sit on your desktop while the server still starts an old directory. Download success alone does not establish that an update is running. Keep the license out of this record.

After extraction, follow the directory tree to fxmanifest.lua and identify the actual resource root. Associate startup output and test time with this record. If names differ between the panel and machine, compare identities rather than assuming similar names are sufficient. For several machines, identify the active copy. These four details and the time let support distinguish the wrong package, wrong server and obsolete active files without requiring an unrelated archive or secret credentials.

Route each symptom to the appropriate documentation#

Describe the expected result in one sentence. If you can sign in but cannot download, inspect Billing and server entitlement first; signing in does not prove download permission. If the resource never starts, use Installation for file and dependency checks. If startup completes but licensing rejects the package, inspect license and Build ID binding in License. If gameplay runs normally but panel reads fail, the MySQL bridge, job state and framework support are more appropriate starting points.

Keep the symptom within its scope. A character balance disagreement is a reason to check identity and read type through Framework and MySQL, rather than changing all protection. Use Configuration and performance for measured stalls, and Exports and integration for rejected legitimate script actions. Do not repeat uncertain payments or money writes as a diagnostic. Apply the relevant step and verify the same observation, using the longer documentation to find the first failing stage while retaining work already confirmed.

Tosun AC 9.6.12#

The Render startup manifest is fixed. A single INSTALL.sql repairs missing legacy columns. The database bridge uses the license resolved on the server. Panel permissions refresh regularly and the latest settings remain queued. Unchanged resources reuse expensive analysis results. One download includes offline guides in nine languages and the separate Discord bot installer.

Changes in 9.6.19#

The anticheat repairs its admin_logs and ac_detections tables at start by adding only missing columns; tables shared with other scripts are left alone by default. The event limiter now records players who go over a listed event's limit (server_event_spam, LOG by default; check your limits, then set KICK; a value saved in the panel wins). Other server scripts can no longer fire the anticheat's internal events unless they are on the trusted resource list (set tosun_ac_local_event_guard "audit" to only report while you adjust). Backdoor auto-quarantine works when you turn it on, new-log alerts reach staff phones and the in-game menu, and a setup health summary (tosunac_health) lists what to fix after start. A late framework start no longer stops the server module.

Changes in 9.6.18#

Players whose anticheat client is not running or stops answering are now kicked (never banned), staff included. The staff exemption is narrower: only explicitly listed staff (admins file, panel grant, the tosun.exempt permission or a verified txAdmin session) are exempt; staff with only a broad permission or an ip: entry are checked like players, automatic actions on them are capped at a kick, and detections on exempt staff are reported to the new StaffAlerts webhook. Noclip, freecam and spectate from the in-game menu and txAdmin get a server-verified admin-mode lease. A new server-side movement guard checks positions on the server; it starts in observation (shadow) mode and kicks no one until you set ts.serverMovement.guard.mode = "enforce". Read RELEASE-9.6.18.md before installing: add the StaffAlerts webhook and check who is exempt.

Changes in 9.6.3#

Framework API errors no longer prove that a weapon is missing. checkDamage=false works; inventory restarts clear stale results. AllowWeapon requires a trusted resource. Anti-aimbot keeps the latest hit per target; thresholds and default actions are unchanged.

What changed in 9.6.6?#

A performance problem that could make the server stutter during big fights is fixed. The admin check (ts.AdminStatus) ran two synchronous database queries on every call for players who are not staff, and the whole server thread waits while they run. The punishment exemption check calls it on every explosion and damage event, so large fights could cause lag, and a player could create the same load on purpose by requesting an admin check once a second. A “not staff” result from the database is now kept for 30 s per player. ACE, txAdmin and admins.lua checks are not cached and apply immediately; a new panel grant is recognised within 30 s.

What changed in 9.6.5?#

For screenshots requested from the panel, the address sent back by the watched player is now checked. A cheater being watched could previously return any address instead of a screenshot: a clean image hosted elsewhere, a tracking pixel or a link to another site. Now only data:image addresses from base64 mode and paths under the panel’s /images/ folder are accepted, and the host of a full address is always replaced with the panel the upload went to. Other addresses are dropped, the request is marked failed, and the server console shows a warning.

What changed in 9.6.3 and 9.6.4?#

9.6.3: ts.weaponInventory.checkDamage = false now really turns the damage check off. If the inventory API does not answer, the weapon counts as unknown, not as missing. AllowWeapon now needs a trusted server resource: add your arena/paintball script to the existing tosun_ac_trusted_resources list (keep the other names). The aimbot sweep now uses bounded memory and work; thresholds are unchanged. 9.6.4: a Shield screenshot is accepted only when the server asked for it (within 60 s, once). A ban video is accepted only from a player who was really kicked or banned in the last 2 minutes; before, any player could create a fake “BAN” entry in the panel and a Discord ban notification.

What changed in 9.6.2?#

Two cases where the vehicle physics guard (ts.vehicleGuard, kick by default) could kick an innocent player are fixed. One explosion lifting several vehicles owned by the same player used to count one strike per vehicle, so the owner could be kicked even when someone else threw the bomb. A player now gets at most one strike per sampling pass, and vehicles within 30 m of an explosion from the last 4 s are not evaluated. Only explosions that no other check cancelled count, so a cheater cannot hide a throw behind a blocked explosion.

What changed in 9.6.1?#

The client log channel is hardened. Any player could write logs with any tag and status: fake “[BAN] ...” lines in the panel, phone notifications to every admin with the status “Detection”, and one panel request per line. Ordinary players can now only use the anticheat’s own client tags; the server sets the status, and each player is limited to 12 lines a minute. Other tags (admin menu) need staff rights. The panel log mirror is now sent in one batched request every 3 s, so ban and detection notifications no longer hit the panel rate limit during busy moments. Logging in the game database is unchanged.

What changed in 9.6.0?#

The weapon/inventory check now looks at damage dealt, not only at the weapon in hand. Cheat menus can fire a weapon without holding it (magic bullets, tasing players with a stun gun). If the weapon in a damage event is not in the attacker’s inventory, it goes through the same logging and punishment pipeline (log only by default). It needs 2 events within 60 s. Thrown weapons, the first 60 s after joining, inventories that have not loaded, add-on and vehicle weapons, and weapons granted with AllowWeapon are ignored. Set ts.weaponInventory.checkDamage = false to turn it off.

What changed in 9.5.9?#

Detections pause while a player is dead, downed or in last stand, so that revive animations do not cause false positives. A cheat could hold that state forever by triggering a framework’s death event locally or by keeping health at 101–110. A downed player cannot run, sprint or drive a moving vehicle. Once a player has been doing one of those for 20 s, a stale “downed” flag is cleared and low health no longer pauses detections. Players who really are downed are unaffected.

What changed in 9.5.7 and 9.5.8?#

Every client-side check that can punish was audited, and each finding went through three independent reviews. Closed for cheaters: a latch that silenced every client detection for the session with one local event; client-writable exemptions that silently swallowed detections (they are now reported as log entries); SetSpawned permanently switching checks off; a key refresh that blinded signed detections; and a confirmation window that never completed. Fixed for innocent players: permanent bans for riding a bicycle downhill; kicks while refuelling with a jerry can; godmode bans after 1 HP of environmental damage; aimbot bans for police keeping aim on a fleeing suspect; parked cars counted as vehicle spawns; vehicle godmode bans in dealership test cars; menu scans matching FiveM’s own exec command and the game’s own texture names; standing on a boat deck or truck bed; and engine-failure scripts kicking drivers.

What changed in 9.5.6?#

The client traps built from cheat-menu event names no longer hit real resources. For example, on a server running the SEM_InteractionMenu police menu, a jailed player received that menu’s own event and was kicked as a cheater. If an event name’s prefix is a running resource, the event counts as that resource’s legitimate event and is never punished. Weapon-based explosion types (railgun, proximity mine, pipe bomb, raygun) now follow the weapon blacklist: if you removed the weapon from the blacklist, for example for a heist script, its explosion is allowed too.

What changed in 9.5.5?#

A ban with empty fields no longer blocks unrelated players. The connection check searched for missing identifiers as empty values, so after the panel banned a player without Steam or Discord, anyone joining without Steam or Discord could be rejected with that ban’s card. Identifiers are now validated by format, and empty or placeholder values never match. Offline bans are now actually recorded. On MySQL 8 the timed-ban columns could not be added, which let banned players in; the migration and the install SQL now work on both database engines. Ban-evasion analysis uses only active bans and no longer treats a shared IP (carrier, dorm, cafe) as a link by default.

What changed in 9.5.4?#

A bug in the anti-aimbot module let cheaters escape. Its log entries and its punishments shared one 4-second wait, so signals that repeated every 2 seconds or faster (magic bullet on every shot, a triggerbot striking once a second) were never punished. One shotgun blast into a crowd no longer counts as magic bullet: the threshold is 4 targets and the signal must repeat. The server-side excessive weapon damage check ignores ramming, run-over, explosions and falls, and a single event is only logged. Panel seeds were compared with the config defaults. New servers get safer OCR, combat, rate guard and burst settings. Installs without panel settings now default to kick for the watchdog and log for the native guard, and the infinite stamina check is off.

What changed in 9.5.3?#

Threat intel no longer turns LOG detections and connection problems into a kick on join. The score reported to the panel counted every detection (including log-only ones), heartbeat misses and a value the player’s own client can write. The stored score never went down, so an innocent player could be kicked on every join. It now counts only detections actually enforced (kick or ban) on this server in the last 10 minutes, and the default join action is log only. On installs without panel settings, the mass object check now defaults to log instead of ban. The config doctor and the panel warn about turning fail-open off (a panel outage would then kick everyone) and about kick on join.

What changed in 9.5.2?#

Shield AI no longer deletes legitimate entities. On a OneSync server, objects and player peds have no population type. With the old settings, every networked object a player created was cancelled (emote and phone props, cones, furniture), and so was every vehicle and NPC from a script missing from a short list. An entity created by any resource running on the server is now allowed. Only a script entity that no resource created is cancelled. The spawn is always cancelled; kick or ban happens only when the violation repeats 3 times within 60 s. The old behaviour is kept as an optional strict whitelist. The blacklisted object check, which had not run since 9.3.0, works again. Harmless silent explosions (exhaust pops) no longer count toward punishment.

What changed in 9.5.1?#

Two more false-ban sources were closed. The cursor-based overlay check could permanently ban a player who moved the mouse in an ATM, shop or phone menu opened with E, and it pinned the cursor to the corner meanwhile; it now never runs while a menu has focus, no longer watches E or ESC, and only logs by default. A single silent or invisible explosion was a permanent ban, although fire-department, exhaust and thermite scripts create them too. The explosion is still always cancelled; punishment now needs 5 repeats within 60 s and defaults to kick.

What changed in 9.5.0?#

Config doctor: after the panel and database settings are applied, the anticheat reads the real values and lists those that carry a false-ban or security risk. For example it warns when OCR or the teleport punishment is set to ban, when a safeguard is turned off, or when Debug is on. It runs by itself about 90 s after start and writes a summary to the panel logs; run tosunac_doctor in the server console at any time. It never changes a setting. In the panel, values in detection, player and ban details are now escaped, so a reason sent from a game client cannot run code in an admin’s browser, and data embedded in pages cannot break out of its context. The notification bell works again.

What changed in 9.4.0?#

New weapon and inventory check: the server reads the weapon in a player’s hand and looks for it in the inventory (ox_inventory, QBCore/Qbox or ESX). A weapon with no matching item was spawned and is caught even if it is not on the blacklist. By default it only logs, needs 3 consecutive samples, and ignores the first 60 s after joining and players whose character is not loaded. Watch the panel for a few days, then raise it to kick or ban in the server authority section of the anticheat settings. Scripts that hand out weapons without an inventory item should call AllowWeapon. A second getConfig registration was also closed, and the API page now shows the key as a header instead of in the URL.

What changed in 9.3.1?#

The rest of the innocent-player review. Armour vests and first-aid kits no longer kick players; a health or armour spike now needs 3 repeats within 60 s. Emptying an SMG, fire and explosions no longer count as aimbot, and the long-range check only looks at short-range weapons. Browsing a car dealership, being downed twice, a burning car exploding after you walk away and sniper hits no longer cause punishments. Police and heist equipment (BZ gas, flare gun, hacking device) was removed from the default weapon blacklist. Shield signatures now use the same canonical text on both sides, and a single lost key delivery no longer times a player out.

What changed in 9.3.0?#

A security and false-ban release. In earlier versions the panel API key could reach players’ clients when settings were saved in the panel; the panel no longer sends it, and 9.3.0 filters every setting sent to clients. After updating, generate a new AC API key under Site settings, save it and send it to the AC. Server events that let a player exempt themselves now only relax movement and visibility checks briefly. A single teleport (character select, hospital, house, admin bring) now creates a log entry instead of a ban; continuous impossible speed (noclip flight) is punished. The money check, chat and name filters, OCR, vehicle guard and 27 unmapped client detections were fixed so they no longer cause false bans. Sensitive exports only accept trusted resources; add a script you trust with tosun_ac_trusted_resources in server.cfg. Details are in RELEASE-9.3.0.md and INTEGRATION.md inside the package.

What changed in 9.2.0#

The in-game admin menu was redesigned. It now opens as a panel at the edge of the screen, so the game stays visible; the dock button moves it to the other side. Ctrl K finds any player or action, players with detections this session are listed first, and kick, ban, warn and give weapon open a small form that names the target. Slay, unban, nearby delete and every server-wide action need a second press. Player names can no longer inject script into the menu, and the allowEsp, allowFreecam and allowDelete admin menu settings are now enforced.

What changed in 9.1.0#

A new server-side guard reads the player state that OneSync replicates to the server: super jump, invincibility, invisibility, collision-disabled (slow) noclip, weapon damage and defence modifiers, blacklisted weapons held in hand, and a camera far away from the player (spectate/freecam). These checks keep working even if a cheat stops the client-side anti-cheat. High-confidence checks kick by default; context-sensitive checks only log until you raise them in the v25 section of the anti-cheat settings. Checks that your server build does not support are disabled automatically and listed in the server console.

What changed in 9.0.3#

Server event payload checks and rate limits were tightened. The optional database bridge reads supported data on demand. Evidence uploads use short-lived upload credentials; they do not grant panel management access. No anti-cheat or package protection can guarantee that every attack will be stopped.