Blog

7 Ways to Keep Your FiveM Server Secure

A FiveM server is both a community where players spend their time and a server open to the internet. A cheating player, a leaked script or a password shared in the wrong place can ruin an economy built with effort in a single night. The seven points below explain, in plain words, the spots server owners most often leave open.

Published: 19 October 2026

1. Keep your license key and passwords private

Your server.cfg holds the server's license key (sv_licenseKey), the database connection details and, if you use one, the Steam Web API key. Do not share this file in screenshots and do not upload it to a public GitHub repository; if it was shared by mistake, renew the keys right away.

Not everyone on the team needs access to everything. Giving a developer only the folder they need, or a test server, is much safer than sharing the main passwords.

2. Know who can log in to txAdmin

txAdmin is the panel you use to manage the server from a browser, and by default it runs on port 40120. Give every admin a separate account, grant only the permissions their job needs and delete the account of anyone who leaves the team right away. A shared admin password used by everyone makes it impossible to know who did what.

Do not share the panel address and password in Discord channels. If you can, add a firewall rule so the panel port is reachable only from your own IP address.

3. Open only the ports you need

For players to connect, FiveM's own port (30120 by default, TCP and UDP) is enough. The database (MySQL or MariaDB, 3306 by default) should not be open to the internet; only the server itself should connect to it. If you use remote desktop or SSH, log in with a strong password or a key, and turn off services you do not use.

Ask your hosting company whether it offers DDoS protection for game servers. A protected setup is far more resilient than a home connection or an unprotected server.

4. Do not trust the client: validate server events

On FiveM, the player's computer can be tampered with, and cheat menus can send the server any event they like. Every server event that gives money, adds items or changes a job should check on the server whether the player sending it is really entitled to it: their permissions, their distance, what is really in their inventory and the amount requested. A single unchecked event is enough to break a server economy.

In our own script, Gunrack, the job, the vehicle, the seat, the distance and the inventory are checked on the server for every store and take request, and requests are rate limited. Ask the same question of every script you buy or order: which actions are validated on the server?

server/main.luaUnprotected

-- The price comes from the client: a cheat
-- menu can send any number it likes
RegisterNetEvent('shop:sell', function(item, price)
    local src = source
    RemoveItem(src, item, 1)
    AddMoney(src, price)
end)

server/main.luaValidated

-- The price lives on the server; the client only sends the item
-- (HasItem, RemoveItem, AddMoney: your framework's equivalents)
local PRICES = { bread = 5, water = 3 }
local SHOP = vector3(25.7, -1347.3, 29.5)
local last = {}

RegisterNetEvent('shop:sell', function(item)
    local src = source
    local price = PRICES[item]
    if not price then return end
    -- Is it really in the inventory?
    if not HasItem(src, item, 1) then return end
    -- Is the player next to the shop?
    local pos = GetEntityCoords(GetPlayerPed(src))
    if #(pos - SHOP) > 3.0 then return end
    -- At most one sale per second
    local now = GetGameTimer()
    if last[src] and now - last[src] < 1000 then return end
    last[src] = now
    RemoveItem(src, item, 1)
    AddMoney(src, price)
end)

5. Stay away from leaked scripts

Unauthorised copies of paid scripts often hide a backdoor: code that is encrypted so it cannot be read, or lines that download and run code from an outside address when the server starts. Such a backdoor can let someone else do whatever they want on your server.

Get scripts only from their seller or a source you trust. If you have to install a script of unknown origin, try it on a test server first and have its outgoing requests (PerformHttpRequest) and any code run from text (load) reviewed.

6. Tighten client-side settings

On servers with OneSync, the sv_entityLockdown setting limits players from creating vehicles or objects from their own computers; this largely stops cheat menus from raining objects on the map. Before turning on strict mode, test on a test server whether your scripts are compatible; some older scripts create objects on the client.

Keep sv_scriptHookAllowed off (0); this stops players from joining your server with ScriptHook based mods. Anti-cheat scripts can add an extra layer, but they do not replace validation on the server.

7. Update, back up, test first

Keep the FiveM server build (artifacts) and your scripts up to date; security fixes usually arrive with updates. Back up the database regularly and keep the backup somewhere other than the same server; after an attack or a broken update, it is the only thing you can go back to.

Instead of installing a new script or an update straight on the live server, try it first on a test server with no players. If you are not sure how secure your server and scripts are, we can review them with your permission and give you a report of what we find, ordered by priority; you can write to us.

Product

Gunrack

Vehicle gun rack for FiveM. Officers store weapons and ammo inside department vehicles.

Related service

Cyber Security Services