Official project documentation 7.2.18

FIREAC, documented for real deployment.

Name: FIREAC
Author: Amirreza Jaberi

A free and lightweight FiveM anti-cheat designed by Amirreza Jaberi, with client-side and server-side detections, lifecycle-aware validation, a server-authorized admin interface and database-backed ban/access management.

ESXQBCoreStandaloneoxmysqlAGPL-3.0

Start installation View source

fireac/status

$ resource FIREAC

› version 7.2.18

› fx_version cerulean

› game gta5

› framework auto-detect

› database oxmysql

ready for configuration

7.2

7.2.18 is a full stability & compatibility release

It improves framework compatibility, spawn/respawn lifecycle handling, server-side source validation, detection cooldowns and false-positive resistance. For older installs, replace the complete resource instead of merging individual files.

Upgrade notes

How FIREAC is structured

Resource architecture

The resource is split into shared configuration and blacklist data, client detections/admin NUI glue, server validation/punishment logic, and the browser-based admin UI.

configs/

Configuration

fire-config.lua controls protections, lifecycle timing, ACE and UI behavior. fire-webhook.lua contains webhook configuration.

src/

Runtime

fire-client.lua, fire-menu.lua, fire-server.lua implement detections, admin interactions, server validation and actions.

tables/

Blacklist data

Separated Lua tables for weapons, vehicles, peds, objects, words, triggers, explosions, plates, tasks and more.

ui/

Admin NUI

The F9 / command-based admin interface. Sensitive actions are checked on the server, not trusted only from NUI.

fxmanifest.luacerulean · gta5 · ui_page "ui/index.html" · dependency "oxmysql"

Before installation

Requirements

oxmysqlRequired

FIREAC declares oxmysql as a resource dependency and uses its MySQL library on the server.

GitHub

discord-screenshotFor screenshots

Used when screenshot evidence is enabled. Keep the resource started and configure a valid webhook.

GitHub

FrameworkAuto

FIREAC 7.2.18 supports ESX, QBCore and Standalone. Framework/lifecycle readiness is handled automatically.

ESXQBCoreStandalone

Clean installation

Install FIREAC

Do not merge 7.2.18 into an older FIREAC folder.

Remove the old resource, install the complete release, import the updated database schema and restart the server.

1
Download the current release
Download the latest stable archive from the GitHub Releases page and extract the complete FIREAC resource.
Open latest release
2
Add the resource
Copy the FIREAC folder into your FiveM resources directory. Keep the original resource name as FIREAC so the documented exports resolve correctly.
3
Prepare dependencies
Install oxmysql. If screenshot capture is enabled, install discord-screenshot as well.
4
Import the database
Import the database.sql included with FIREAC before the first start. The 7.2.18 schema is cleaned and should be used with this release.
5
Configure FIREAC
Review configs/fire-config.lua and configs/fire-webhook.lua before production. Set the server identity, actions and webhook values intentionally.
6
Start resources in order
server.cfg
```
ensure oxmysql
ensure discord-screenshot
ensure FIREAC
```
If screenshot capture is intentionally disabled, discord-screenshot is only needed when you use that evidence path.

configs/fire-config.lua

Core configuration

These values are the important defaults in FIREAC 7.2.18. Tune them only when you understand the effect on lifecycle, evidence and false-positive handling.

ServerConfig

Name: YOUR SERVER NAME
Port: 30120
Linux: false

ACE

Enable: false
Admin: FIREAC.Admin
Whitelist: FIREAC.Whitelist
Unban: FIREAC.Unban

ChatSettings

Enable: true
PrivateWarn: true

ScreenShot

Enable: true
Format: PNG
Quality: 1

Connection & deferral defaults

Option	Default	Purpose
`AntiBlackListName`	true	Checks blocked player names on connection.
`AntiVPN`	false	VPN checking is disabled by default.
`HideIP`	true	Avoids exposing player IP in displayed data where supported.
`UseDeferrals`	true	Uses the connection deferral flow.
`DeferralMode`	`card`	Uses the adaptive connection card flow.
`DeferralDelayMs`	1200 ms	Initial deferral delay.
`DeferralStepMs`	120 ms	Visual/progress step timing.
`ProblemOnlyMode`	false	Normal connection UI is shown, not only problem cards.

Detection lifecycle defaults

120sReadyMaxWaitMaximum framework/player readiness wait

12sMinimumClientReadyMinimum client readiness window

20sSpawnGraceGrace after spawn

18sPostSpawnSettlePost-spawn settle time

20sPostReadyGraceGrace after ready state

15sRespawnGraceGrace after respawn

12sPedChangeGraceGrace around ped changes

3.5sCameraGraceGrace during camera transitions

3EvidenceThresholdEvidence count in the configured window

15sEvidenceWindowEvidence aggregation window

6GodmodeSamplesGodmode evidence samples

6 / 10sServerReportLimitClient report rate limit window

Lifecycle checks are part of false-positive control.

Before disabling a protection because of a spawn/character-loading report, confirm the framework readiness and grace-period configuration first.

Detection matrix

Protections & defaults

FIREAC contains both client-side behavioral checks and server-side event/entity protections. The status below reflects the 7.2.18 default config, not a recommendation to blindly enable every disabled module.

Client-side

Player state, movement, camera, weapons and vehicle state.

Anti Health HackON · BANMaxHealth 200

Anti Armor HackON · BANMaxArmor 100

Anti Infinite AmmoON

Anti SpectateON · BAN

Anti Blacklist WeaponONWeapon action: BAN

Anti God ModeON · BAN

Anti InvisibleON · KICK

Anti Change SpeedON · KICK

Anti Rainbow VehicleON · BAN

Anti Plate Changer / Blacklist PlateON · BAN

Anti Night / Thermal VisionON · BAN

Anti Super JumpON · BAN

Anti TeleportON · BANFoot 200 · Vehicle 600

Anti Ped ChangerON · BAN

Anti Tiny PedON · BAN

Anti Blacklist AnimationsON · BAN

Anti Free CameraOFF · BAN

Anti NoclipOFF · KICK

Anti Infinite StaminaOFF · WARN

Anti SuicideOFF · WARN

Anti Pickup CollectOFF · BAN

Anti Blacklist TasksOFF · BAN

Server-side

Chat, events, entities, permissions, damage and abuse limits.

Anti Spam ChatON · BAN10 messages / 3 sec cooldown

Anti Blacklist CommandsON · BAN

Anti Weapon Damage ChangerON · BAN

Anti Blacklist WordON · KICK

Anti Spam TriggerON · BAN

Anti Taze PlayersON · KICKMax 3

Anti Explosion SpamON · BANMaxExplosion 10

Anti Blacklist Object / Ped / Building / VehicleON · BAN

Anti Spam VehicleON · KICKMaxVehicle 10

Anti Spam PedON · KICKMaxPed 4

Anti Spam ObjectON · KICKMaxObject 15

Anti Play SoundON · KICK

Anti Bring AllOFF · BAN

Anti Blacklist TriggerOFF

Anti Clear Ped TasksOFF · BANMax 5

Anti InjectOFF · BAN

Anti Change PermissionOFF · BAN

tables/*.lua

Blacklist tables

Blacklist data is deliberately separated from the main runtime config. This makes review and customization easier without mixing large data sets into detection logic.

fire-anim.luafire-cmd.luafire-damage.luafire-emoji.luafire-event.luafire-explosions.luafire-name.luafire-object.luafire-peds.luafire-plate.luafire-task.luafire-vehicle.luafire-weapon.luafire-words.lua

Server-authorized control surface

Admin menu

Open the FIREAC admin interface

When AdminMenu.Enable is true, authorized admins can open the NUI using F9 or the /fireac and /fireacmenu commands. Admin state and sensitive actions are validated by server-side code.

EnabletrueKeyF9MenuPunishmentBAN

▦

Dashboard

Online players, props, vehicles, peds, bans, admins, whitelist/unban access, plus recent admin and ban records.

◎

Self tools

Godmode, invisibility, suicide, heal, all weapons, clear weapons, copy coordinates, night vision and thermal vision.

♟

Player actions

Goto, bring, kick, spectate, ban, make admin, whitelist and grant unban access. Kick/ban actions accept reasons.

◇

Entity control

Delete vehicles, props, peds or all supported entities. Player peds are protected from the entity delete path.

Teleport workflow

Admin teleport actions grant appropriate detection grace so authorized movement does not immediately collide with teleport protection.

▱

Vehicle tools

Spawn for self or a target, RGB color, repair/clean, full customization and delete actions.

Who can do what

Admin, whitelist & unban access

Admin

Grants the FIREAC administration interface and protected admin actions.

Whitelist

Marks trusted/authorized players for the whitelist path used by FIREAC.

Unban

Grants access to unban functions without necessarily granting every admin capability.

ACE

ACE integration is available but disabled by default.

FIREAC.Admin · FIREAC.Whitelist · FIREAC.Unban. Set FIREAC.ACE.Enable = true only when your server.cfg ACE rules are intentionally configured.

Console and in-game operations

Commands

Command	Purpose
`/funban [Ban ID]`	Unban a FIREAC ban record by Ban ID.
`/unban [Ban ID]`	Unban command alias/path exposed by the project.
`addadmin [ID]`	Grant admin access to an online player; documented for server console use.
`addwhitelist [ID]`	Grant whitelist access.
`addunban [ID]`	Grant unban access.
`fireacban [ID] [Reason]`	Ban a player with an explicit reason.
`fireacunban [Ban ID]`	Unban a record by FIREAC Ban ID.

Integrate other resources

Exports

FIREAC exposes client and server exports so other resources can trigger documented punishments, coordinate temporary whitelist windows, and manage bans through the anti-cheat instead of duplicating logic.

Client / shared action

FIREAC_ACTION

client_export

Lua

exports['FIREAC']:FIREAC_ACTION(source, "BAN", "Cheating", "Using godmode")

Routes a documented FIREAC action with the source, action type, category and detail/reason.

Temporary whitelist

FIREAC_CHANGE_TEMP_WHITELIST

client + server

Lua

exports['FIREAC']:FIREAC_CHANGE_TEMP_WHITELIST(source, true, 15000)
local allowed = exports['FIREAC']:FIREAC_CHECK_TEMP_WHITELIST(source)

Useful around trusted scripted actions that temporarily resemble a protected behavior. The manifest also retains the historical FIREAC_CHANGE_TEMP_WHHITELIST alias for compatibility.

Server ban management

BanPlayer / UnbanPlayer

server_export

Lua

exports['FIREAC']:BanPlayer(playerId, reason, issuer)
exports['FIREAC']:UnbanPlayer(banId, issuer)

Use the server exports when another trusted server resource needs to create or remove FIREAC ban records.

Do not trust client-provided identity or punishment data in your own wrapper resource.

Keep authorization and identity validation server-side, matching the hardened direction used in FIREAC 7.2.18.

database.sql

Database & persisted access

FIREAC persists ban and access state through MySQL. Import the schema shipped with the same release you deploy; the 7.2.18 release notes explicitly call out a cleaned database schema with example player data removed.

Import before first FIREAC start.
Keep oxmysql online before FIREAC.
Back up existing ban/access data before a production upgrade.
Do not combine an old schema with a partially merged new resource.

MySQL

FIREACoxmysqldatabase

Bans · admins · whitelist · unban access

Stable migration

Upgrade to 7.2.18

Back up

Back up your current FIREAC folder, production config values and database before replacing anything.

Replace, do not merge

Install the complete 7.2.18 resource as one versioned unit.

Import current schema

Apply the database.sql that ships with 7.2.18 using an appropriate migration/backup process for existing production data.

Re-apply intentional config

Port only the settings you intentionally need; do not reintroduce removed/unsupported old options.

Why 7.2.18 matters

Full ESX / QBCore / Standalone compatibility
Connection, spawn, respawn and character-load false-positive fixes
Stronger server-side source / identifier validation
Detection cooldown and evidence/lifecycle improvements

Spawn, camera, ped and admin action grace periods
Client report validation and rate limiting
Godmode camera and initial Ped Changer false-positive fixes
Cleaned schema, removed obsolete command/config paths

Operational checks

Troubleshooting

FIREAC does not start or reports database errors

Verify oxmysql is installed and started before FIREAC, your database connection is valid, and the database.sql from the same FIREAC release has been imported.

F9 or /fireac does not open the admin menu

Confirm AdminMenu.Enable is true and the player has FIREAC admin authorization. If you enabled ACE mode, confirm the FIREAC.Admin ACE rule is actually granted.

Screenshot evidence is not delivered

Confirm ScreenShot.Enable, the discord-screenshot resource state and the configured webhook. A stopped screenshot resource or invalid webhook prevents this evidence path.

Players are detected around spawn / respawn

Use the complete 7.2.18 build first. Then verify framework readiness and Detection grace values before disabling the underlying protection. This release specifically adds lifecycle-aware false-positive controls.

An admin teleport/action triggers a protection

Prefer FIREAC admin workflows for protected administrative actions because the current menu code coordinates grace/authorization with the anti-cheat. Custom admin resources should integrate temporary whitelist/grace logic deliberately.

Open-source terms

License & project scope

AGPL

GNU Affero General Public License v3.0

FIREAC is distributed under AGPL-3.0. Review the repository LICENSE before redistribution or modification, especially when deploying modified network software.

LICENSE

Security scope

FIREAC is positioned by the project as a free anti-cheat for basic protection. Anti-cheat is defense-in-depth: keep your server resources, permissions, events and database hardened instead of treating one resource as a complete security boundary.