Anti-Abuse

Redstone Clock Limiter

Detects repeater and comparator clocks firing faster than a threshold, counted per block over a rolling ten seconds. What happens next is yours to choose.

redstone-clock:
  enabled: true
  # destroy    : replace the repeater or comparator with a sign explaining why
  # quarantine : the chunk stops passing redstone for quarantine-seconds, then
  #              resumes on its own. The machine stops, nothing is destroyed,
  #              and a legitimate build that ran hot survives the encounter.
  # notify     : tell the staff, touch nothing
  action: destroy
  quarantine-seconds: 60
  stop-threshold: 7
  # Told in-game to staff holding xantilag.notify.
  notify-staff: true
  # How long the same clock stays quiet after being reported. 0 tells you every time.
  notify-cooldown-seconds: 300

quarantine is usually the kinder setting. A farm that ran hot for a moment is stopped rather than dismantled, and it comes back by itself.

notify-cooldown-seconds matters more than it looks. A clock past the threshold has its counter dropped, so the count starts over, and a clock nobody removed crosses the threshold again within a second. Without the cooldown, notify repeats every half second, and so does destroy wherever the block cannot really be replaced, inside a claim or a protected region.

The console line is separate and off by default: see console-logging under Monitoring. The Discord message is separate again.

Anti Chunk-Loader

Detects entities that loop through portals to keep distant chunks loaded — a common dupe / lag exploit. Smart flagging requires multiple sightings before action to reduce false positives.

Portal exploit detection — Tracks repeated portal entries without nearby players
Action toggle — Remove the entity or just log a warning
Named-entity focus — Targets persistent / named entities (typical of exploits)

Lag Machine Detection

A duper does not look like an overloaded chunk. Everything it produces is consumed as fast as it appears, so the entity count stays low and both the chunk limiter and clearlag walk straight past it. What gives it away is the rate.

lag-machine:
  enabled: true
  tnt-per-minute: 300
  falling-blocks-per-minute: 600
  items-per-minute: 1500
  action: "notify"
  notify-staff: true

Per chunk, per minute — Primed TNT, falling blocks and item spawns are counted separately; set a threshold to 0 to ignore that kind
Reported once — A detected chunk is announced to the console, the staff and Discord, then goes quiet for ten minutes rather than sixty times a minute
No pattern list — Nothing to keep up to date when a new duping technique appears: whatever shape the machine takes, it has to spawn things to be worth building

action: notify is the default on purpose. What looks like a duper is sometimes a legitimate farm running hot, and deleting a player's build on a heuristic is not a trade to make without being asked. action: block also refuses the spawns while the chunk is over its threshold.

Chunk Load Watcher

Paper already caps how fast a single player can make the server load chunks (player-max-chunk-load-rate, in config/paper-global.yml). What it never says is who is sitting on that cap — one player crossing unexplored terrain under elytra can hold the whole budget while everyone else waits behind them.

chunk-load-watcher:
  enabled: true
  threshold: 60
  duration-seconds: 5
  reduced-view-distance: 4
  recover-seconds: 10
  notify-staff: true

Attributed — The rate is measured per player and reported with their name
Targeted — Only that player's view distance is narrowed, and only while it lasts; everyone else is untouched
Released automatically — After recover-seconds below the threshold
Report only — Set reduced-view-distance: 0 to watch without acting

The constraint goes through the same component that resolves view distance for the AFK system and the performance monitor. Three things already wanted to own that value; a fourth writing it directly is how they used to overwrite each other.

TNT Rate Limiter

Caps TNT and TNT minecart explosions per chunk per second using a 1-second TTL Caffeine cache. Prevents TNT cannons / bombs from tanking the server without disabling TNT entirely.

Default cap — 5 explosions per chunk per second
Caffeine cache — 1-second TTL for efficient tracking

Spawn Rate Limiter

Reduces natural mob spawn rates globally or per world by a configurable percentage (100 = vanilla, 50 = half, 0 = none).

It ships enabled at 100: nothing changes on a healthy server — the listener returns immediately at that rate — but the monitor's reduce-mob-spawn-rate action finally has something to act on. Left disabled, that action did nothing at all and said so at every startup.

Per-world filtering — Apply to specific worlds or all worlds
TPS integration — Halved automatically while a performance level is active
AFK farms — Spawns are cut around a player marked AFK (afk.on-afk.reduce-spawns, on by default, 64 blocks). A farm running for somebody who is not playing is the cheapest lag a server pays for, and the only one nobody is watching; active players never see a difference
ThreadLocalRandom — Efficient random cancellation with no contention

Clearlag

Scheduled removal of dropped items, arrows, XP orbs, and optionally hostile mobs. Runs at a configurable interval with as many warning broadcasts as you like.

Default interval — Every 15 minutes
Configurable warnings — Default 60s + 20s ahead of cleanup, but you can configure any number
Translatable messages — All strings live in lang/<code>.yml with {time} and {count} placeholders
Sound effects — Configurable sounds for warnings and cleanup
Entity filter — Pick which entity types to clear (items, arrows, XP orbs, ...)
Stack-aware — Recognizes stacked items / mobs and counts them correctly
Exclude named entities — Skip entities with custom names
Excluded materials — clearlag.excluded-items lists what never gets swept off the ground, whatever else says otherwise. Netherite, totems, elytras and the dragon egg are there by default
Excluded entity types — clearlag.excluded-entities, same idea: armour stands, item frames, paintings, villagers and the bosses are spared by default
Player drops — protect-player-drops spares what somebody deliberately threw on the ground. Death drops, mob drops and block drops are not "thrown", so this protects exactly what a player put there
Safety radius — player-safe-radius removes nothing at all within N blocks of a player, whatever its type; monster-safe-radius does the same for hostile mobs alone, so a sweep never wipes the dungeon somebody is standing in
Announcement threshold — min-removed-to-announce skips the completion message below N removals, so a sweep that found nothing stops being a message players learn to ignore

Pets and companions

Nothing that belongs to somebody is swept. Tamed animals, mounts and their riders, named mobs and anything marked with XAntiLag's own protection tag are spared without configuration. Three settings cover the companions vanilla has no concept of — a pet plugin that hands a player a zombie or a blaze gives them a mob that is neither tamed nor named:

Setting	Default	What it spares
`protect-persistent-mobs`	`true`	Any mob the server was told never to despawn. Pet plugins set that flag so the companion survives its owner walking away; quest NPCs use it too
`protect-plugin-spawned`	`false`	Anything a plugin spawned deliberately. Off by default because a spawner or farm plugin also spawns that way, and those mobs are what the sweeps exist for
`protected-pdc-keys`	`[]`	Entities carrying one of these persistent-data keys, written `plugin:key`. For a plugin that does neither of the above

The mob stacker honours the same list: merging a pet into a stack removes the entity as surely as a sweep would.