This is the process I run on my own servers: Tommygun's Frag Mod, Escape From Rust, and CSRust. It isn't a plugin list; it's a workflow. Most of catching cheaters is knowing what you're looking at before you ever open the spectate camera.
Brand new to running a server? Start with the setup guide first.
Step 1: Get a paid BattleMetrics account
Before anything else. BattleMetrics is the first thing I set up on every server I run:
- Centralizes bans across all of your servers
- Deeper player review, including alt account detection
- Ban sharing and data sharing with other organizations
- Server monitoring and admin tools in one place
Nearly everything below leans on it.
Step 2: Know what you're up against
Rage hackers, the majority
Most cheaters you'll see are joy rides: new or purchased accounts running flyhack and aimbot to rack up maximum damage before the inevitable ban. They're extremely obvious and players mass-report them. Many can be banned before they do damage. A plugin like ReportMe flags the combination of low hours plus connected game-banned accounts as they connect.
Reading a Steam profile
Two ban types show on a profile, and they don't mean the same thing:
- VAC ban: usually a Counter-Strike ban. Very common, and typically does NOT indicate Rust cheating. I recommend ignoring it.
- Game ban: for Rust, issued by EAC on behalf of Facepunch. But the profile doesn't tell you which game issued it. A "1 game ban" account could have been banned in any EAC title.
BattleMetrics can sometimes attribute a game ban to Rust specifically, because it witnessed the ban happen in real time. That attribution is part of what you're paying for.
One policy change worth knowing: Facepunch now offers a one-time second chance. A player banned more than 8 months ago who hasn't reoffended is allowed to come back on a new account. The old account stays banned, and hardware-banned repeat offenders aren't eligible. Keep that in mind when you find one stale banned alt behind an otherwise clean account: if there's nothing since, it can be a sanctioned return rather than ban evasion.
ESP and radar
ESP reveals player positions and gear; some cheats also fly a debug camera through bases to scout raid paths. Two things to know:
- Facepunch added server-side occlusion. When a player is fully hidden behind terrain or large objects, their data isn't sent to other clients at all. It shipped default-on in 2025 and cut deep into ESP effectiveness.
- Cheaters running ESP alone are extremely rare. It's a class of its own, called "legit-cheating": subtle assistance only, to stay under the radar.
- ESP is very hard to judge on its own. High-skill players legitimately look like they "know too much." Be extremely careful banning on ESP alone. Lean on low hours or evidence of other cheating.
Scripters
Scripters use an automated method to control weapon recoil: mouse scripts, or anything else that doesn't hook deeply into the game. That's why they generally go undetected. But since Facepunch reworked recoil ("new recoil"), scripting is nearly a non-issue; a competent player can match what a scripter does. Like ReShade below, this is a class of cheating where you have no ability to distinguish legit players from cheaters, so don't try to enforce it.
ReShade and video post-processing
ReShade manipulates game visuals, mostly brightening night. It's a game-bannable offense (the Tacularr ban made that clear), but it isn't detectable by admins or anti-cheat software at the server level. With no enforcement path, you'd best ignore the problem without clear-as-night evidence.
Step 3: Set up the reporting pipeline
- Discord server: pool your community in one place.
- Ticket bot: so players can report cheaters and appeal bans with a paper trail. I use Ticketeer and recommend it.
- F7 reports into Discord: ReportMe pipes Rust's native F7 reports to a Discord channel, enriched with the BattleMetrics and Steam data above, and can auto-ban the obvious rage hackers on connect.
Be careful with reports: most of them land on legitimate players.
Step 4: Spectate and make the judgment call
When a name keeps coming up, watch them play. spectate <name or steamid>
from the F1 console (admin/moderator only, doesn't work through remote
RCON). Two things nobody tells you first: spectate kills your character on
execution, so strip your gear and clear your craft queue before you run it,
and set global.specnet true if you want to hear voice chat while
watching. Spacebar cycles to the next player, F3 changes the camera, and
respawn drops you back into the world when you're done.
Vanish and Admin Radar are the alternative if you want to observe from the ground without being seen. What you're looking for is behavior a human hand doesn't produce: the crosshair snapping to heads and staying glued through strafes, aim tracking players through solid walls, prefiring every corner with no reaction delay.
One warning about spectate: it doesn't give you an exact reproduction of the player's movement. Every player's first-person view looks a little warped and inhuman in spectate, legitimate or not. Watch a few players you trust first so you know what normal spectate jank looks like before you read anyone's aim as aimbot.
This is the judgment call, and it stays manual. Everything else in this process narrows the list; your eyes make the decision.
The 500-hour rule
Players with 500+ hours are generally not cheating. Check total hours on BattleMetrics before you act on any report, and be especially careful before banning an established account. Report pressure on a good player is usually just a good player.
The exception is purchased accounts. Cheaters buy aged accounts with hours on them to look established. The tell is the activity gap: an older account that sat dormant and recently became active again. Check the session history on BattleMetrics; hours from years ago don't vouch for whoever is playing on the account today.
After the catch
Banning works. But catching a cheater takes hours of unpaid volunteer work. That's why I built Payback: 60 punishment and investigation cards for the cheater you've already confirmed. It's also how Camomo_10 handles them:
A note on racism and homophobia
Not a cheat, but you'll deal with it more often than aimbot. It isn't game-bannable: there's no EAC ban for conduct, and a player banned for it on Facepunch's official servers can still play on community servers. Facepunch runs zero tolerance on their own servers, with automated flagging, manual staff review, and no appeals. On your server, you have full authority: you'll make your own policy on conduct, and the only wrong version is the one you don't enforce consistently.
What about active anti-cheat software?
Solutions like Galium exist, but they're overkill for most servers and come with their own problems and trade-offs. Don't bother looking into them unless you're pushing 200+ pop. The process above covers a community server: BattleMetrics, a reporting pipeline, and manual judgment.
Questions: discord.fragmod.com.