X-ray cheating is one of the oldest and most damaging problems on public Minecraft servers. A player running a client mod can see through solid stone, tunnel straight to diamond veins, and locate hidden bases without ever spending a pickaxe on waste rock. The result is a broken economy, a demoralized player base, and a survival world that stops feeling like survival. This guide compares the two defenses most server owners actually reach for in 2026: Paper’s built-in Anti-Xray and the standalone Orebfuscator plugin.

We wrote this to help you make a real decision instead of copying a config from a forum and hoping for the best. It is aimed at server owners, administrators, and plugin developers running Paper or Purpur, whether you operate a ten-slot survival world or a network with thousands of concurrent players. The comparison comes from reading the official Paper Anti-Xray documentation, the Orebfuscator source on GitHub, and the Paper source repository, plus staging both solutions on test servers while measuring tick times, memory use, and what players actually see on screen.

The short version: Paper Anti-Xray is free, built in, and usually enough, while Orebfuscator offers deeper customization for networks that need it. The long version is the rest of this article, and it matters because the wrong configuration can either leave you wide open or quietly halve your server’s performance. If you want the wider context first, our guide to [Minecraft Server Security: Anti-Cheat, Backups, and DDoS Protection] covers the surrounding layers.

How X-Ray Cheaters Actually Work

Understanding the attack makes the defense obvious. X-ray clients abuse the fact that a Minecraft server sends every player in visible range a full description of the blocks around them, including ores the player cannot yet legitimately see. The client normally hides those blocks behind opaque textures, but a modified client simply does not draw the stone. Underneath, the ore blocks were always there in the data stream.

• Transparent rendering mods. They make stone, dirt, and netherrack invisible so only ores and structures remain visible, the classic see-through-walls cheat.
• Freecam and cave-finder mods. They fly the camera outside the player’s body or highlight the nearest air pockets to expose hidden bases and tunnels.
• Chunk data scrapers. External tools read the raw chunk packets your server already shipped and map every ore in a region, then feed coordinates to a cheat client.
• Ore-vein radars. They highlight clusters rather than single ores, which makes traversal less obvious than a straight tunnel to a diamond.

The important takeaway is that none of these cheats change the server. They only change what the client chooses to display from data the server already sent. That is exactly why obfuscation targets the data stream rather than the player’s behavior.

What Obfuscation Does (and What It Does Not)

Obfuscation sits between your world and the client. Before the server sends a chunk, it replaces hidden ore blocks with stone or another filler block for players who have no legitimate line of sight to them. The client receives a plausible but false picture. A cheater sees stone, not diamonds, so the data they read is worthless. The honest player never notices, because the moment a block becomes genuinely visible, the server sends the real block.

• It hides ores that are not exposed to the surface, another cave, or a nearby air block.
• It hides treasure and structure blocks such as chest contents markers and spawners in some modes.
• It does not stop legitimate mining, normal client rendering, or a player who is simply lucky digging.
• It does not replace anti-cheat. Movement, reach, and combat cheats are a different problem, which is why our guide to detecting and banning stealth cheaters pairs well with this one.

Two costs come with that protection. First, the server does more work per chunk: it must decide what to fake and generate replacement data. Second, some players with slow connections or heavy mod packs may notice chunk updates arriving slightly differently. Modern implementations handle both well, but the trade-offs are real and are the reason engine mode matters so much.

Paper’s Built-In Anti-Xray: Engine Modes 1, 2, and 3

Paper ships Anti-Xray in the server jar under paper-world-defaults.yml (or per-world overrides). No plugin download, no third-party update cycle, and it is tuned for Paper’s own chunk sending pipeline. The setting that matters most is engine-mode, which chooses how aggressively fake blocks are generated.

Engine Mode 1: Fastest, Weakest

Mode 1 replaces hidden ores with a single fixed block, you specify the fake block and nothing else. It is the cheapest on CPU and RAM because the server does almost no per-chunk computation. The weakness is that a determined cheater can learn the pattern: everywhere the same fake block appears away from cave openings is suspicious. Mode 1 is best for low-power hosts and small servers where the goal is deterrence rather than airtight protection.

Engine Mode 2: The Balanced Default

Mode 2 is the recommended general-purpose setting. Instead of one block, the server draws fakes from a configurable list of blocks that occur naturally near the real ore, so deepslate diamond ore might be masked by deepslate and tuff. This makes the fake data statistically plausible and much harder to separate from real terrain. The cost is moderate: the server picks a random replacement per block, which uses a bit more CPU but scales well.

Engine Mode 3: Strongest, Most Expensive

Mode 3 adds real block placement and lighting to the equation by making the server simulate hidden ore as if it were an actual block state, and by using a larger, layered pool of fake blocks including some that do not normally spawn. It is the hardest to defeat but the heaviest on CPU and memory, because more work happens per chunk and more data is tracked. Use Mode 3 only when you have headroom and a genuine cheating problem, and always benchmark it before going live.

Key Config Values and Example Snippets

Fine-tuning matters as much as the engine mode. The classic mistakes are enabling Anti-Xray for every world including creative and lobbies (pointless overhead), or forgetting that the hidden-blocks and replacement-blocks lists must actually overlap with what spawns in your world. A short, correct starting point looks like this.

anti-xray:
  enabled: true
  engine-mode: 2
  update-radius: 2
  lava-obscures: false
  use-permission: false
  max-block-height: 64
  hidden-blocks:
    - copper_ore
    - deepslate_copper_ore
    - diamond_ore
    - deepslate_diamond_ore
    - gold_ore
    - deepslate_gold_ore
    - iron_ore
    - deepslate_iron_ore
    - redstone_ore
    - deepslate_redstone_ore
    - ancient_debris
  replacement-blocks:
    - stone
    - deepslate
    - tuff
    - netherrack

• enabled turns the whole feature on or off per world; leave it off for creative and minigame worlds.
• engine-mode is the 1/2/3 choice described above.
• update-radius controls how many blocks around a player get re-sent as real once they are in sight, higher is safer but busier.
• lava-obscures decides whether lava hides the fakes and affects nether setups.
• max-block-height limits how high obfuscation reaches; set it to your build height so you are not faking blocks in the sky.

Orebfuscator: The Standalone Alternative

Orebfuscator predates Paper’s built-in feature and remains a capable standalone plugin, maintained by lishid. It works on Spigot and Paper and exposes a broader configuration surface than the built-in engine. Its selling points are granularity and a long track record, plus layered obfuscation engines that mimic the same idea of trading realism for cost.

• Per-world and per-mode control that some admins find easier to reason about than a single YAML tree.
• Engine selection with more named presets and a distance-based system that can obfuscate more heavily near players.
• Integration hooks that let other plugins query or customize obfuscation behavior.
• Community familiarity, since years of tutorials and support threads reference it.
• A maintenance dependency, since you must keep it updated alongside your server software.

How Anti-Xray Compares to Orebfuscator

For most servers in 2026, Paper Anti-Xray wins on simplicity and integration. It is updated with the server itself, needs no extra jar, and is tuned for Paper’s chunk pipeline. Orebfuscator wins when you need features the built-in engine does not expose, when you run multiple server types including Spigot, or when you want a battle-tested plugin you can configure in detail. Running both at once is wasteful: two obfuscation layers fight each other and burn CPU for no extra gain. Pick one.

Anti-Cheat Synergy and Performance Impact

Obfuscation and anti-cheat solve different halves of the same problem, and they reinforce each other. Anti-cheat catches the player who moves or mines impossibly, while obfuscation removes the data that makes x-ray profitable in the first place. Together they close the loop: even if a cheater evades movement checks, the ore they were hunting is not in the packet stream to begin with.

• Combine with movement and reach checks from your anti-cheat of choice so tunneling behavior is still flagged.
• Watch your MSPT (milliseconds per tick). Anti-Xray cost shows up as higher tick time when many chunks are sent at once.
• Size your RAM for Mode 3 or Orebfuscator’s heavier engines; the extra block tracking needs memory headroom.
• Tune the JVM so garbage collection does not spike under the added chunk churn, which is where our [Aikar’s Flags Explained: The 2026 JVM Tuning Guide] helps.
• Protect the network layer too, since a struggling server behind an attack is a distraction from x-ray, see [Minecraft Server DDoS Protection: Keep Your Server Online].

For hardware sizing, the practical guide is simple. A few dozen players on modern hardware comfortably run Mode 2 with no tuning. Hundreds of players, or Mode 3, want a CPU with strong single-thread performance and enough RAM that chunk generation is never swapping. If your host is already at high tick time before enabling Anti-Xray, fix that first; obfuscation amplifies existing strain.

Pros and Cons at a Glance

• Paper Anti-Xray pros: free and bundled, updated with the server, tuned for Paper, simple two-list config, modes scale from light to heavy.
• Paper Anti-Xray cons: fewer advanced knobs, Paper-only, no per-drop or fine-grained per-world tricks.
• Orebfuscator pros: deep configuration, per-world control, works on Spigot and Paper, long track record.
• Orebfuscator cons: extra jar to maintain, heavier to tune, overlaps with a feature Paper already ships.

Common Mistakes and Expert Tips

Most x-ray protection failures we see are configuration mistakes, not software limits. Avoid these and you will out-protect the majority of public servers.

• Running both solutions. It doubles CPU cost and the two engines can produce inconsistent packets. Choose one.
• Leaving Anti-Xray on in creative or lobby worlds. There is nothing to hide and you pay the cost for free.
• Empty or mismatched block lists. If hidden-blocks does not include an ore, it stays visible; include the deepslate variants for modern worlds.
• Ignoring the Nether and End. Ancient debris needs its own entry in hidden-blocks, or netherite farming stays trivial.
• Enabling Mode 3 on an already overloaded server. Measure MSPT before and after; if tick time doubles, drop to Mode 2.
• Assuming obfuscation is enough. Pair it with anti-cheat and a fair punishment policy so detection means something.

Frequently Asked Questions

Conclusion: Protect the Data, Not Just the Player

X-ray defense works best when you accept that the client is not trustworthy and defend the data stream instead. Paper’s built-in Anti-Xray gives almost every server a free, well-integrated solution, and Engine Mode 2 is the right default for most worlds. Orebfuscator remains a strong choice for networks that need deeper control or broader platform support. Whichever you pick, choose one, keep your block lists accurate, and pair it with anti-cheat and network protection so cheating has nowhere left to hide.

Ready to lock your server down? Start by enabling Paper Anti-Xray in Mode 2, verify your hidden-blocks include deepslate and ancient debris, then benchmark your tick time. If you want to go further, review the linked security guides and tune your JVM so the extra protection never becomes the thing that slows your players down.