ExploitFixer overview

ExploitFixer is a Bukkit-family plugin for servers that need to reject malicious or malformed packets before they become an expensive server problem. It combines a raw packet guard, a module system for specific exploit families, and a shared violation policy that can notify, kick or run a configured command.

This documentation is based on the 4.1.2 source inspected for this release. It deliberately separates what the plugin declares from what has actually been tested on a server.

What it covers

The plugin ships modules for several classes of abuse, including:

• invalid payloads and malformed packet data;
• packet size, rate and processing-time limits;
• crash and duplication patches;
• command and tab-completion abuse;
• inventory-click and recipe edge cases;
• optional packet hooks through PacketEvents or ProtocolLib.

The module list is configuration, not a promise that every module is appropriate for every server. Start with the shipped defaults, watch the logs, and enable stricter actions only after you know what normal traffic looks like.

How a packet reaches a decision

There are two inspection stages:

1. Raw decode guard. The plugin can inspect a frame before the server constructs a normal packet object. Oversized or malformed data can be cancelled here, which is cheaper than handling it later.
2. Decoded receive pipeline. Once a packet exists, module-specific listeners evaluate it. Detection results feed the shared violation system rather than each check inventing its own punishment.

The watchdog is a separate control. It measures how long packet handling takes and compares that against configurable budgets. It is meant to contain pathological input, not to prove that every other plugin on the server is efficient.

Requirements

Requirement	Verified detail
Server	Bukkit, Spigot or Paper; the plugin metadata declares Folia support
API metadata	api-version: 1.13
Java	Java 8 bytecode; use the JVM required by your server version
Required dependency	HamsterAPI 0.3.5 or newer
Optional hooks	PacketEvents 2.13.0 or ProtocolLib 5.3.0

HamsterAPI is checked before modules load. If it is missing or too old, ExploitFixer refuses to start instead of running with a partial packet layer. PacketEvents and ProtocolLib are optional and loaded reflectively.

What is not claimed

The source does not declare a tested Minecraft version range. api-version: 1.13 describes the plugin metadata, not a guarantee that every server from 1.13 to the latest release behaves identically. The Folia flag is a declaration; test your actual server build and plugin set.

Version numbers and defaults on this page were checked against the source on 30 October 2026. The distributed build can lag the source; confirm the version in your JAR.

Next steps

• Install ExploitFixer for the dependency and first-start sequence.
• Configure the modules for violation thresholds and packet limits.
• Commands and permissions for administration.
• Read the packet-validation case study for the engineering decisions behind the plugin.