WederCheatDetector | NEXU STUDIOS

WHAT IT DETECTS

▎ - Meteor Client
▎ - Advanced XRay (Fabric)
▎ - X-Ray mods
▎ - CheatUtils
▎ - FreeCam
▎ - Spectator Freecam
▎ - Tweakeroo
▎ - ChestESP
▎ - NoPryingEyes
▎ - NoChatReports
▎ - Asteroid
▎ - VoxelMap
▎ - AutoTotem
▎ - DupersUnited
▎ - Wurst

• Suspicious Network Channels: Impact, Wurst, LiquidBounce, Aristois, Inertia, Lambda, RusherHack, and many more (fully editable list without recompiling).
• VanillaSpoof: Catches clients claiming to be "vanilla" while registering Fabric/Forge channels under the hood — an impossible contradiction for an honest client, without needing the cheat mod itself to expose its name.
• Brand Blacklist: Clients that don't even bother spoofing their brand and leave their real name exposed.
• Sign-Probe (Translation / Keybind Fingerprinting): Detects real mods loaded via Fabric — Meteor Client, Tweakeroo, FreeCam (all variants), CheatUtils, XRay, NoPryingEyes, Asteroid, AutoTotem, and more — even when the mod registers no network channels and doesn't alter its client brand.
• Chat Signature Inspection (1.19.1+): Detects mods that selectively intercept chat packets to break Mojang's signatures (OpSec and similar utilities).
• Handshake Filter: Instantly drops bots/scanners using malformed hostnames before they waste a login attempt.

ALMOST EVERYTHING IS PRE-JOIN

Most checks are resolved during the Login / Configuration phases — players connecting with forbidden mods NEVER spawn into the world; their connection is dropped immediately upon entry.

Note: The only exception is the sign-probe, which requires the player to briefly spawn (~1-2 seconds) to receive the virtual sign packet used for fingerprinting.


SANCTION SYSTEM

• Configurable Escalation: Choose how many detections (strikes-before-ban) trigger a KICK before escalating to an automatic BAN.
• Supported Actions: KICK, BAN, or custom console commands (compatible with LiteBans, AdvancedBan, etc.).
• Persistent History: Per-player detection logs (/wcd history <player>).
• Discord Webhooks: Features TWO distinct embed styles: "Cheat Mod" (Meteor, Tweakeroo, FreeCam...) and "Cheat Client" (Impact, Wurst, LiquidBounce...) — fully customizable (title, color, fields).

BUILT TO BE EDITED WITHOUT RECOMPILING

• All channel lists, brands, and translation keys reside in config.yml.
• Each sign-probe mod can be individually enabled or disabled (enabled: true/false) without deleting the entry.
• Add any custom forbidden mod using its translation key or real keybind in just two lines of YAML.
• Debug Mode (debug: true): Audits every incoming connection packet directly in the console so you can easily fine-tune your own rules.

COMPATIBILITY

• Works seamlessly on both Online-Mode AND Offline-Mode / Cracked servers.
• Fully compatible with Geyser / Floodgate — Bedrock players are automatically exempt from all relevant checks.
• Multi-Language Support: Includes built-in English and Spanish translation files (adding another language is as simple as copying a YAML file).
• Required Dependency: Requires PacketEvents (Free).

WHAT IT DOES NOT DO (We continue working.)

This plugin relies 100% on packet/protocol detection — by design, it DOES NOT include movement, combat, or behavioral analysis. As a result:

• "Injectable" Clients: Clients that patch the vanilla process at runtime (rather than loading as a Fabric mod) are indistinguishable from a vanilla client at the packet level. Detecting these requires a behavioral anticheat (e.g., Vulcan, GrimAC).
• "Silent" Mods: Mods that register NO network channels, brand, keybinds, or translation keys leave no footprint for this method to detect.

We prefer being completely honest about these limitations rather than promising 100% detection that no packet-level plugin can deliver.

COMMANDS & PERMISSIONS

Commands:
Permissions:
REQUIREMENTS

• PacketEvents (hard dependency)
• Java 21
• WederBans (optional)