Event protection

Most FiveM cheats do not cheat in the game itself. They trigger your server events with values you never meant to accept: spawn money, give items, change jobs. Event protection is AstroShield's answer. It sits in front of every net event of your resources.

What it checks#

The shared guard in each resource looks at every net event a player sends before your handler runs:

Rate. A player may only send so many events per second, in total and per event. Normal scripts stay far below the limit. A script that fires an event every frame on purpose can hit it.
Payload. The arguments of an event must be sane: no absurdly deep or huge tables and no oversized strings, as sent by crashers and exploit kits.
Traps. Events in the blacklist, and a few well-known backdoor event names, are registered as traps. No real script uses them, so a player who triggers one is a cheater.

The limits are generous on purpose, so normal scripts never reach them. A few ESX events that are abused often have a lower limit of their own: esx_policejob:handcuff, esx-qalle-hunting:reward and esx:giveInventoryItem.

What happens on a violation#

The offending event is blocked, so your handler never sees it. If the violation was a flood, malformed data or a trap, the player is also punished through the antiTrigger detection (Anti Blacklisted Events), usually with a ban. The reason in the ban record says what happened:

Reason	Meaning
`Malformed event payload: <event> (...)`	The data of the event looked like an attack.
`Event flood: N blocked events in 10s (last: <event>)`	The player kept sending blocked events.
`Tried to spam trigger: <event> (count/max in Ns)`	The player passed the rate limit of that event.
`Tried to use blacklisted trigger: <event>`	The player triggered a trap.

A ban from event protection also carries the last events the player sent, so you can check it yourself. See Ban records.

Settings#

All of these are in Configuration, Network & Moderation. They are marked Advanced where only experts should change them.

Setting	Key	What it does
Event Protection	`eventProtection`	Switches the rate and payload checks on or off.
Anti Blacklisted Events	`antiTrigger`	The list of trap events, one per line. Also switches the punishment of violations on or off.
Ignored Events	`IgnoredEvents`	Events that the checks skip.
Ignored Resources	`IgnoredScripts`	Resources whose events and injection checks are skipped.

Only trap events nobody uses

Never put an event in Anti Blacklisted Events that one of your own scripts triggers, because a player who legitimately triggers it is banned.

Ignoring events and resources#

If a trusted script is blocked, tell the guard to look away. Prefer the narrowest option that works.

Ignore the event. Add its name to Ignored Events. Put a * at the end to cover every event that starts with that text.
Output
```
myscript:heavyEvent
ox_lib:*
esx:*
```
Ignore the resource. Add its name to Ignored Resources if one script fires events in a way that no single name covers.

Both are applied as soon as you save, without a restart.

Do not ignore a whole framework unless you must. The ESX or QBCore events that players can trigger are exactly what cheaters aim at, so ignoring esx:* opens them up. Ignore the single noisy event instead.

Find out which event is blocked#

Turn on Dev Mode. The console shows the reason, the event and the recent events of the player instead of banning.
Ask AstroShield whether it guards an event: isEventProtected.
Check the Events page and the console for what the player did right before.

For script authors#

Write your server events as if every argument can be forged. Check that the player is allowed, check the types and the range of every value and never trust amounts or prices from the client. Event protection reduces the damage when you forget. It does not replace validation.