X-ray cheating is one of the oldest and most corrosive exploits in multiplayer Minecraft. Whether through a modified client, a resource pack that makes stone transparent, or a fullbright/cave-finder hack, an x-rayer can see every diamond, ancient debris, and buried chest in your world without ever digging blind. On a survival server that runs on scarcity and fair competition, that ruins the economy and drives away honest players. The good news: if you run Paper (or a Paper fork like Purpur or Folia), you do not need a plugin at all. Anti-xray is built directly into the server and configured in a single file. This guide walks through exactly how to enable it, what each engine mode actually does to your CPU and bandwidth, and how to tune the block lists so cheaters see nothing but a sea of fake ore.
What anti-xray actually does
Anti-xray is a server-side obfuscation system. The server normally sends every nearby chunk to the client in full detail, which is what lets x-ray mods read the block data and highlight ores. Anti-xray intercepts that chunk data before it leaves the server and rewrites it so that hidden ores are disguised. Either they are replaced with common stone, or the entire underground is flooded with thousands of fake ore signatures so the cheater cannot tell which glints are real. Because the obfuscation happens on the server, no client mod, texture pack, or anti-cheat on the player’s end can defeat it. The trade-off is that rewriting chunk packets costs CPU time and, in the heavier modes, extra bandwidth. Choosing the right engine mode is mostly about balancing protection against that cost.
Why Paper, and why Spigot/vanilla need a plugin instead
This is the single most important thing to get straight before you touch any config. Built-in anti-xray exists only on Paper and its descendants (Purpur, Folia, and other Paper forks). It does not exist on vanilla Mojang server.jar, and it does not exist on plain Spigot or CraftBukkit.
- Vanilla (
server.jarfrom Mojang): cannot load plugins at all and has no obfuscation feature. There is no native way to stop x-ray. You must switch to Paper, or accept the exposure. - Spigot / CraftBukkit: can load plugins but has no built-in anti-xray. You would install a third-party Orebfuscator-style plugin to get equivalent protection.
- Paper / Purpur / Folia: ship anti-xray in the core. No plugin, no extra dependency, no Vault bridge — just a config setting.
If you are still on vanilla, the cleanest move is to migrate to Paper. It is a drop-in replacement that loads your existing world and keeps full vanilla survival behavior while adding anti-xray, performance patches, and plugin support. Most managed hosts make this a one-click jar swap. On our platform you can switch jars and review the relevant config from the control panel — see the Minecraft setup documentation for the panel walkthrough, or grab a ready-tuned box from our managed Minecraft hosting where Paper is already the default.
Where the config lives: paper-world-defaults.yml
On modern Paper, world settings are split into two files. paper-world-defaults.yml holds the defaults applied to every world on the server, and each world can carry its own paper-world.yml inside the world folder to override those defaults. Anti-xray lives under the anticheat.anti-xray section in either file.
To enable it for all worlds at once, open paper-world-defaults.yml in your server’s root directory and find the block below. The four keys you care about are enabled, engine-mode, hidden-blocks, and replacement-blocks.
anticheat:
anti-xray:
enabled: true
engine-mode: 1
max-block-height: 64
update-radius: 2
lava-obscures: false
use-permission: false
hidden-blocks:
- copper_ore
- deepslate_copper_ore
- gold_ore
- deepslate_gold_ore
- iron_ore
- deepslate_iron_ore
- lapis_ore
- deepslate_lapis_ore
- redstone_ore
- deepslate_redstone_ore
- diamond_ore
- deepslate_diamond_ore
- emerald_ore
- deepslate_emerald_ore
- ancient_debris
replacement-blocks:
- stone
- oak_planks
- deepslateSet enabled: true, pick your engine-mode, save the file, and fully restart the server (Paper reads these world configs at startup, so a reload is not enough). Note that max-block-height defaults to 64 — anti-xray only obfuscates at or below that Y level, since there is no point burning CPU disguising blocks players can already see in the open air. If your ores generate deeper (or you want protection higher up in a custom world), raise it.
The three keys that control protection
enabled
A simple boolean. enabled: false turns the whole system off; enabled: true activates obfuscation for that world. That is the master switch.
hidden-blocks
This is the list of blocks you actually want to protect — the ores and valuables that x-ray cheaters hunt for. The default list covers all the standard ores (iron, gold, diamond, emerald, lapis, redstone, copper) in both their stone and deepslate variants, plus ancient_debris in the Nether. You can add anything else worth hiding: buried chests are not blocks, but you can add blocks like spawners, suspicious sand/gravel, or modded ores if you run them. Anything in this list is what gets disguised.
replacement-blocks
This list only matters in engine modes 2 and 3. It tells the server which solid blocks to randomly sprinkle fake ores into. In mode 1, hidden ores are simply swapped for a single solid block and this list is ignored. In modes 2 and 3, both the real hidden blocks and these replacement blocks get scrambled with random fake-ore data, so the cheater sees ore signatures everywhere and cannot distinguish genuine veins from noise. A common tactic is to include the most common stone types (stone, deepslate, netherrack) so the fakes blend into the natural terrain.
engine-mode 1 vs 2 vs 3: how each works and what it costs
The engine-mode value is the heart of the system. It accepts 1, 2, or 3, and the difference between them is the strategy used to hide ore and the resource cost that strategy carries.
engine-mode 1 — hide enclosed ores (cheapest)
Mode 1 takes every block in your hidden-blocks list that is fully enclosed by solid blocks and replaces it with a single, dimension-appropriate solid block: stone in the Overworld (or deepslate below Y 0), netherrack in the Nether, and end_stone in the End. To the client, an enclosed diamond vein simply looks like more stone. This is extremely cheap on CPU and adds essentially no bandwidth, because you are sending the same simple block data you would anyway.
The weakness of mode 1 is in the word “enclosed.” It only hides ores that are completely surrounded by solid blocks. An ore exposed to a cave, an air pocket, water, or lava is left visible — because the server can tell the client could legitimately see it. A determined x-rayer can still spot ores that touch cave systems. For most small to mid-size survival servers that just want to deter casual x-ray packs, mode 1 is the sensible default: near-zero cost, meaningful protection.
engine-mode 2 — fake ore everywhere (strongest)
Mode 2 is the heavy artillery. Instead of hiding real ores, it disguises both your hidden-blocks and your replacement-blocks by scattering randomized fake ore throughout the terrain. The cheater’s x-ray now lights up like a Christmas tree — fake diamonds and gold are everywhere, real and fake are indistinguishable, and even ores exposed to caves are buried in noise. This is the most thorough protection available because it does not rely on whether an ore is enclosed.
The cost is real. Mode 2 has to compute and inject fake ore data across large volumes of every chunk, which is heavier on CPU, and because the obfuscated chunk data is more complex and less compressible, it increases the bandwidth needed to send chunks to players. On a busy server with high view-distance, that overhead adds up. Use mode 2 when protection matters more than raw performance — large competitive survival or anarchy-adjacent servers, for example.
engine-mode 3 — mode 2 with smarter network timing
Mode 3 behaves like mode 2 — it floods the world with the same randomized fake ore — but it randomizes the obfuscation per chunk-layer in a way that reduces the network load concentrated at the moment a player joins or loads a fresh batch of chunks. The protection level is essentially the same as mode 2, but the bandwidth spike during heavy chunk-streaming (logins, fast travel, elytra flight) is smoothed out. If you want mode-2-grade protection but your players are reporting lag or rubber-banding while loading terrain, mode 3 is the version to try.
| Engine mode | Strategy | Hides cave-exposed ore? | CPU cost | Bandwidth cost | Best for |
|---|---|---|---|---|---|
| 1 | Replace enclosed ores with one solid block | No (enclosed only) | Very low | None | Most servers; the safe default |
| 2 | Random fake ore across hidden + replacement blocks | Yes | High | High | Competitive / high-stakes survival |
| 3 | Like mode 2, randomized per chunk-layer | Yes | High | High, smoothed at join | Mode-2 protection with less join lag |
Per-world overrides
The settings in paper-world-defaults.yml apply to every world. But you rarely want identical anti-xray everywhere. A creative or lobby world has nothing to protect, and obfuscating it just wastes CPU. A high-value resource world might justify mode 3 even if your main world runs mode 1.
To override per world, open the paper-world.yml inside that specific world’s folder and add only the keys you want to change. Anything you do not specify falls back to the defaults file. For example, to turn anti-xray off in a creative world while leaving the global default on:
# Inside creative_world/paper-world.yml
anticheat:
anti-xray:
enabled: falseOr to push your resource world up to mode 3 while the rest of the server stays on mode 1:
# Inside resource_world/paper-world.yml
anticheat:
anti-xray:
enabled: true
engine-mode: 3Restart the server after editing any of these files. If you run multiple worlds through a plugin like Multiverse, each managed world gets its own folder and therefore its own paper-world.yml, so you can tune them independently. See our guide on the Multiverse plugin for running multiple worlds for how those world folders are created and named.
Tuning the block lists for your server
The default hidden-blocks list is sensible, but it is worth reviewing for your specific server. A few practical considerations:
- Don’t over-hide. Every extra block type in
hidden-blocksis more work for the server. Hiding common stone or dirt is pointless and wastes cycles — protect only what cheaters actually scan for. - Match your dimensions.
ancient_debrisonly matters in the Nether. If you run a Nether-heavy economy, make sure it is in the list (it is, by default). - Modded ores. If you run a modpack-aware Paper fork or datapack ores, add their block IDs to
hidden-blocksso they are covered too. - Pick believable replacements. In modes 2 and 3, your
replacement-blocksshould be the dominant terrain blocks (stone,deepslate,netherrack) so the fake ore noise blends naturally instead of standing out in obvious patterns.
After you make changes, test them. Join with an x-ray pack or mod on a throwaway account (or ask a trusted staff member to) and confirm you cannot pick out real veins. With mode 1 you should see ores vanish into stone; with mode 2 or 3 you should see fake ore scattered everywhere, making real finds hopeless to identify.
Anti-xray is not your whole anti-cheat plan
Obfuscation stops players from seeing ore through walls, but it does nothing about flight hacks, kill-aura, reach, or fast-break. Paper’s anticheat section is narrow — it is primarily the anti-xray system, not a full cheat-detection suite. For movement and combat cheats you still want a dedicated anti-cheat plugin, plus the usual server hardening: keep online-mode=true so cheaters cannot spoof usernames, lock down ops, and use a whitelist or proxy for sensitive servers. Anti-xray is one strong, free layer — treat it as part of a stack, not the entire defense.
Frequently asked questions
Does anti-xray work on Spigot or vanilla Minecraft servers?
No. Built-in anti-xray is a Paper feature found under anticheat.anti-xray in paper-world-defaults.yml. Vanilla Mojang server.jar has no obfuscation at all and cannot even load plugins, and plain Spigot/CraftBukkit has no native anti-xray either. On Spigot you would install a third-party Orebfuscator-style plugin; on vanilla you would need to migrate to Paper first. Because Paper is a drop-in replacement that keeps full survival behavior, switching to it is the simplest path to anti-xray.
Which engine mode should I use — 1, 2, or 3?
Start with engine-mode 1. It costs almost nothing in CPU or bandwidth and hides every ore that is fully enclosed by solid blocks, which stops the vast majority of casual x-ray users. Move to mode 2 only if you run a competitive or high-stakes survival server and need to also hide ores exposed to caves — accept that it raises both CPU and bandwidth. If you want mode-2-level protection but players report lag while loading chunks, use mode 3, which spreads the network cost out so the join-time spike is smaller.
Why can players still see some ores after I enabled engine-mode 1?
This is expected behavior for mode 1. It only obfuscates ores that are completely enclosed by solid blocks. Any ore touching a cave, air pocket, water, or lava is left visible, because the server treats it as something a player could legitimately see. If cave-exposed ore is being x-rayed on your server, switch to engine-mode: 2 or 3, which flood the terrain with fake ore regardless of whether real ore is enclosed.
Do I have to restart the server after editing paper-world-defaults.yml?
Yes. Paper reads its world configuration files at startup, so a full server restart is required for anti-xray changes to take effect — a /reload will not reliably apply them. Edit enabled, engine-mode, and your block lists, save the file, then restart. The same applies to any per-world paper-world.yml override.
Will anti-xray hurt my server’s performance or lag players?
It depends on the mode. Engine-mode 1 is extremely light — it sends essentially the same simple block data it would anyway, so the impact is negligible. Modes 2 and 3 are heavier because they compute and inject randomized fake ore across chunks, raising CPU usage and bandwidth (obfuscated chunk data is larger and less compressible). On servers with high view-distance and many players this overhead is noticeable. If mode 2 causes load spikes when players load terrain, mode 3 smooths that network cost over time without sacrificing protection.
Can I enable anti-xray on some worlds but not others?
Yes — that is exactly what per-world overrides are for. paper-world-defaults.yml sets the default for all worlds, and each world’s own paper-world.yml (inside the world folder) overrides only the keys you specify. Set enabled: false in a creative or lobby world to skip the obfuscation cost where there is nothing to protect, or bump a resource world up to engine-mode: 3 while the rest of the server stays on mode 1. Restart after editing.
Related Minecraft server guides
- How to change the level-type of your Minecraft server
- How to disable animals spawning on your Minecraft server
- How to temp-ban a player on your Minecraft server
Enable anti-xray, pick the engine mode your server can afford, tune the block lists, and you have shut down one of the most damaging exploits in multiplayer Minecraft — without paying for a single plugin.
Free Minecraft Tools
Speed up your server with our free Minecraft tools:
Ready to play?
Run your own Minecraft server with XGamingServer
Spin up an always-on Minecraft server your friends can join in minutes — no port-forwarding, no tech headaches.
