ExploitFixer configuration

ExploitFixer splits its configuration in two layers. config.yml holds global switches and the shared violation policy; modules/*.yml holds per-family settings such as packet-size limits and watchdog budgets. Both are read during enable and can be reloaded with /ef reload (exploitfixer.admin).

Files and reload

File	Purpose
plugins/ExploitFixer/config.yml	Locale, webhook, global checks, violation buckets
plugins/ExploitFixer/modules/*.yml	One file per module; about two dozen modules ship with the plugin
plugins/ExploitFixer/lang/	Language files used by Settings.locale

/ef reload reloads configuration and modules. It does not replace the plugin JAR or restart the server. /ef config ... performs runtime edits with a 30-second confirmation step; the tab-completable targets include clear, itemanalysis, invalidselectbundle, packetlimiter, packetfunnel and packetwatchdog. Use it for quick experiments, but keep the YAML files as the source of truth.

Global defaults

Key	Default	Meaning
Settings.locale	"en"	Default language
PacketHooks.packet-events	true	Enable the PacketEvents adapter if present
PacketHooks.protocol-lib	true	Enable the ProtocolLib adapter if present
discord-webhook.enabled	false	Send alerts to a Discord webhook
InvalidPayload.enabled / .kick / .vls	true / true / 100	Invalid-tag payload detection
InvalidInventoryClick.prevent-swap / .vls	false / 25	Window-click handling
TabComplete.limit	256	Maximum tab-complete argument length
RecipeBlacklist.blacklist	["BEDROCK"]	Recipe results to block
Violations.cancel	25	VLS at which packet cancellation starts
Violations.reduce	20	VLS removed per second

The shipped Violations.commands buckets are 25, 50, 75 and 100. Buckets below 100 only notify; the 100 bucket notifies, kicks, and runs a temporary ban command:

Violations:
  cancel: 25
  reduce: 20
  commands:
    25:
      - "notify"
    100:
      - "notify"
      - "kick"
      - "tempban %player% 1m Server Crasher Detected"

Buckets run in ascending VLS order, and notify, kick and console commands are deduplicated. Two rules matter when tuning:

• A module with kick: false still cancels, notifies, sends webhooks and logs, but skips its kick and custom console punishments.
• PacketWatchdog hard-blocks punitive commands below 100 current VLS, even if Violations.commands defines a lower punitive bucket. notify is allowed at any threshold.

Module defaults

Module key	Default	Meaning
packet-limiter.max_size	50kb	Maximum packet size
packet-limiter.max_pps	4096	Packets per second before punishment
packet-limiter.max_bps	60kb	Bandwidth per second before punishment
packet-watchdog.enabled	true	Processing-time watchdog
packet-watchdog.cancel-packets	false	Cancel the offending packet after the cancel threshold
packet-watchdog.vls	25.0	VLS per logical packet that exceeds a budget
packet-watchdog.budgets.packet	1000	Milliseconds allowed for one logical packet
raw-packet-guard.mode	enforce	Pre-decode guard mode; observe logs only
raw-packet-guard.receive-semantic.enabled	false	Semantic fallback for the raw guard
command-blocker.block_syntax	true	Block syntax variants such as minecraft:me and //calc
command-blocker.kick	false	Skip kick and console punishment for this module
general-patcher.*	per patch, mostly true	Individual crash and duplication patches

packet-watchdog.cancel-packets defaults to false deliberately: cancelling movement packets such as position updates can look like an immediate disconnect. Leave it off unless you are testing against known-bad traffic. The watchdog also loads per-period budgets, a TPS allowance, duplicate leniency, and a UUID whitelist; prefer /ef config packetwatchdog over hand-editing the whitelist.

Tuning order

1. Run the shipped values for a while and read /ef stats and the logs before changing limits.
2. If you suspect false positives from the raw guard, switch raw-packet-guard.mode to observe first. That mode logs without cancelling packets or adding VLS.
3. Keep packet-watchdog.cancel-packets: false until you have confirmed that normal movement traffic stays inside the budgets.
4. Raise max_pps, max_bps or max_size only after identifying the traffic that trips them; lowering them blindly turns modded or Geyser clients into false positives.
5. Test punishment changes on a staging server. The 100-VLS bucket runs a console command, and the command is executed with the proxy or server console’s authority.

What this page does not cover

There is no exhaustive reference for every one of the roughly two dozen modules. The values above are the operational subset that affects first-line packet handling, violations and reloads. Module-specific keys outside this table should be read from the shipped YAML for your exact JAR, because a distributed build can lag the source.

Verified against ExploitFixer d065b6b (version 4.1.2, 24 October 2026) on 30 October 2026. Defaults are source values and were not exercised on a live server.