Skip to main content

Ultimate AntiBot — Installation and Configuration

This guide explains the quick installation steps, initial configuration, and recommended settings for the Ultimate AntiBot plugin (Firewall, Anti-VPN) on Spigot/Paper servers using BungeeCord or Velocity. Focus: stop bots and VPN connections effectively without disturbing legit players.

Brief summary​

  • This plugin aims to block bots, login floods, and VPN/proxy connections at the server or proxy level (BungeeCord/Velocity).
  • Install on all Spigot/Paper backends, as well as on the proxy (Bungee/Velocity) if integration features are available.
  • Initial recommendation: enable logging/monitor mode first, use selective VPN blocking, then enable full blocking after observation.

Prerequisites​

  • Server: Spigot/Paper/Purpur compatible.
  • Proxy (optional): BungeeCord or Velocity for protection at the proxy level.
  • Supporting plugins: LuckPerms (for staff exemptions), MySQL if the plugin supports data synchronization, CoreProtect for auditing if needed.

Quick installation​

  1. Download the plugin's .jar file from an official source such as SpigotMC.
  2. Copy the JAR to the plugins/ folder on each Spigot/Paper backend server you want to protect.
  3. If there's proxy integration, install the JAR on the BungeeCord or Velocity instance as well according to the plugin documentation.
  4. Restart the server/proxy to generate the plugin's configuration folder.

Initial configuration (reasonable and safe)​

  1. Back up the default configuration (plugin folder in plugins/UltimateAntiBot/).
  2. Open the main configuration file (usually config.yml or settings.yml).
  3. Start with observation mode:
    • Set the default action to log or challenge (e.g. captcha) instead of kick/ban.
    • Enable verbose logging for 24–72 hours to see false positive patterns.
  4. Set up anti-VPN:
    • Enable VPN/proxy checking; use a managed blacklist (the plugin usually has integration with VPN DB providers).
    • Set a medium sensitivity level; don't immediately auto-ban for VPN because some legit players use VPNs.
  5. Set up rate-limiting and anti-join-flood:
    • Limit the number of connections from a single IP within a short time span.
    • Enable throttling at the pre-login stage (if the plugin supports it).
  6. Set up staff exemptions:
    • Create a staff group in LuckPerms and give a bypass node so they aren't affected by the anti-bot mechanism during troubleshooting.

Sample concise settings (concept, adjust the node names in the plugin config):

mode: observe
vpn-check: true
vpn-action: challenge
join-rate:
  max-attempts: 5
  per-seconds: 10
bypass-groups:
  - moderator
  - admin
logging:
  verbose: true

Integration with BungeeCord / Velocity​

  • Install the plugin on the proxy if you want to block bots before they reach the backend; this reduces the backend server load.
  • If the plugin provides a proxy-only mode or synchronization, enable it so blocking decisions are consistent across the whole network.
  • Make sure the proxy forward configuration (IP forwarding, plugin messaging channel) is correct so the plugin recognizes the real client IP and the groups/permissions are synchronized.

Captcha / Challenge Flow (optional)​

  • Enable a challenge (captcha/minigame) at pre-login to separate automated bots from human players.
  • Use a short challenge (text or code image) that's easy for players, hard for bots.
  • Set a timeout (e.g. 60 seconds) before an automatic kick.

Testing and rollout​

  1. Run an observation phase for 48–72 hours; note the detected IPs and false positive patterns.
  2. Test scenarios: many connections from a single IP, VPN clients, clients with strange headers.
  3. Once confident, change mode: observe → mode: block or enable kick/ban for specific scenarios (repeated VPN, join flood).
  4. Monitor server load and player feedback for 1 week after rollout.

Quick troubleshooting​

  • Many VPN false positives: lower the sensitivity or change the action from ban to challenge/kick.
  • Staff can't log in: make sure the staff group has a bypass node in LuckPerms.
  • Increased CPU load/latency: make sure the plugin performs asynchronous checks; enable caching or use proxy-level blocking.
  • Synchronization between backends fails: check the database/MySQL connection if the plugin uses synchronization, and make sure the restart times are consistent.
  • Stages: observe/log → challenge (captcha) → temporary kick → temporary ban → permanent ban for repeated violations.
  • Keep a list of IPs that were actioned and provide an appeal mechanism (Discord or form).
  • Don't auto-ban based solely on a single VPN detection; use repeated patterns or additional violations as the basis for a permanent ban.

If you want, mention whether your server uses BungeeCord or Velocity, the Spigot/Paper version, and whether you'd like me to put together a sample config.yml configuration file tailored for your server.