HeartWarden

Lifesteal your players can't farm.

Every lifesteal plugin gives out hearts. This one makes sure they were earned. Free, no dependencies.

---

The problem nobody ships a fix for

Hearts are the easy part. Running a lifesteal server is not.

Two friends stand in a corner and kill each other on loop. A player logs into a second account and farms his own alt. Veterans camp spawn and strip newcomers before they find a tree. Someone quits mid-fight to dodge the death. None of that is a bug in your server — it is the shape of the mode, and it is why lifesteal servers bleed players in week two.

Most plugins hand you the mechanic and leave the moderation to you. HeartWarden ships the mechanic and the four defences, configurable, on by default.

The four defences

Exploit	What HeartWarden does
Killing the same player on loop	No hearts awarded for a repeat kill inside a cooldown window
Farming your own alt account	Kills between players sharing an IP award nothing
Spawn-camping newcomers	New players lose no hearts, and killing them grants none
Logging out mid-fight	Combat logout counts as a death: the player loses a heart, drops their inventory and, on their next login, is sent to their spawn point; the opponent gets the heart

Every window and toggle is a config value — set any of them to 0 to turn that check off.

The killer always gets told why a kill paid nothing. Silence here is what makes players report your plugin as broken.

Protection you can actually see

Anti-abuse is invisible by nature: when an exploit is blocked, nothing happens.

/lifesteal stats shows what the plugin has actually done since it was installed — kills counted, attempts blocked per exploit type, combat logs punished, eliminations, revives, hearts withdrawn — and the share of all kills that were blocked.

That last number is also your tuning dial. If a third of kills are being blocked, your windows are too aggressive, and you can see it in one line instead of guessing from complaints.

Counters survive restarts and reset with one command.

The lifesteal half, in full

• Hearts on kill — starting hearts, hard cap, steal amount, optional loss on natural death
• Elimination at zero — three modes: the plugin's own kick list, a real server ban, or spectator. Timed or permanent
• Heart item — craftable, right-click to consume. Tagged with hidden item data, not by display name, so renaming a nether star in an anvil does not forge one
• /withdraw — turn hearts back into items. This is what makes hearts a currency your economy can use
• Revival Crystal — craftable item plus /revive to bring an eliminated player back
• Leaderboard — /hearts top
• Heart menu — /hearts opens a window: your hearts as a stack, the leaderboard as player heads, a withdraw button (left-click for one, shift for five), and remaining newbie protection. Admins also get a Protection button that opens a live statistics window. Set gui.open-on-command: false for plain text instead

Built to be run by someone else

/lifesteal verify — a config checker, because a broken config is silent. An unknown material, a recipe key used in the shape but missing from the ingredients, an invalid elimination mode, a start value above the cap — none of these throw an error on load. The recipe just never registers, and your players quietly cannot craft hearts. Verify names every one of them, with the exact config path.

It also reports settings added in an update that your config file does not have yet. Bukkit silently falls back to the jar defaults, so everything keeps working and you never learn the new options exist.

YAML, SQLite or MySQL — storage.type switches between a file you can open in Notepad, a local SQLite database, or a MySQL server (tested with MySQL 8). Switching away from YAML migrates your existing players.yml automatically and keeps the old file as a backup. The SQLite and MySQL drivers ship inside Paper; there is nothing to install.

English and Russian — the plugin ships in English, and config-ru.yml lands next to your config on first start. Swap the file, restart, done.

Commands

Command	Permission	What it does
/hearts	heartwarden.hearts	Open the heart menu (or print your hearts)
/hearts [player]	heartwarden.hearts.others	Someone else's hearts
/hearts top [n]	heartwarden.hearts	Leaderboard
/hearts set|add|remove	heartwarden.hearts.modify	Change a player's hearts
/withdraw <amount>	heartwarden.withdraw	Turn hearts into items
/revive <player>	heartwarden.revive	Bring an eliminated player back
/lifesteal reload	heartwarden.admin	Reload the config
/lifesteal verify	heartwarden.admin	Check the config for problems
/lifesteal stats	heartwarden.admin	What the protection has blocked

Plus heartwarden.bypass.farm (default: false) to let staff ignore the anti-abuse checks.

Configuration

protection:

  # Killing the same player again grants no hearts until this
  # many minutes have passed. 0 = disable this check.
  same-victim-cooldown-minutes: 30

  # Kills between players sharing an IP grant no hearts.
  # Shuts down the "kill your own alt account" scheme.
  block-same-ip: true

  # New players lose no hearts for this many minutes, and killing
  # them grants nothing. 0 = disable.
  newbie-grace-minutes: 15

  # Logging out mid-fight counts as a death.
  combat-log:
    enabled: true
    # How long after taking a hit a player counts as in combat
    tag-seconds: 15
    # Drop the player's inventory on combat-log too, same as a real death
    # would (skipped automatically if the keepInventory gamerule is on).
    drop-items: true

Every message, item name, recipe and window title is in the config. Colours use MiniMessage, including gradients.

Requirements

• Paper — built and tested against 26.2
• Java 25
• No dependencies. No PlaceholderAPI required, nothing to install alongside

What is not in it yet

• No PlaceholderAPI placeholders
• No Discord notifications
• No custom heart textures / resource pack

Support

Bug reports are welcome and get priority over feature requests. A report with your config and the relevant log lines gets fixed fastest.