How to Configure Anti-Cheat on Your CS 1.6 Server
CS 1.6 anti-cheat options, from VAC2 to reHLDS movement validation and sv_consistency. Know what each setting actually does and what it can't do.
VAC2
VAC2 is Valve's anti-cheat system and it's enabled by default with reHLDS. You don't configure it — it runs automatically. Verify it's active at server startup:
Connection to Steam servers successful.
VAC secure mode activated.
If you see VAC secure mode disabled, your server failed to authenticate with Steam. Check outbound firewall rules on UDP ports 27015, 27020, and 27005.
VAC runs on the client side — it scans for known cheat signatures in memory. It's not real-time detection; it bans in waves. A new cheat can be undetected for weeks before VAC catches up.
sv_consistency
Forces clients to use the server's model and sound files by checking hash signatures:
sv_consistency 1
When enabled, a player who loads a modified model (transparent walls via model replacement, silent footsteps via modified sound files) gets kicked with "Server is enforcing file consistency."
This is effective against the cheapest category of visual cheats — model replacement. It does nothing against external aimbot or wallhack software.
sv_pure
sv_pure 0 // allow all custom client files (default)
sv_pure 1 // enforce consistency on specific files listed in pure_server_whitelist.txt
sv_pure 2 // block ALL custom client files
sv_pure 2 is aggressive — it breaks custom HUDs, crosshairs, and player models that a large portion of the legitimate CS 1.6 community uses. Most public server operators leave this at 0 or 1.
If you use sv_pure 1, create cstrike/pure_server_whitelist.txt and list the specific files you want to lock down.
reHLDS-Specific Protections
These go in server.cfg and are only available with reHLDS:
sv_rehlds_force_dlmax 1
Blocks file enumeration exploits — prevents clients from discovering file lists on the server via crafted download requests. This is a security hardening measure, not an anti-cheat measure.
sv_rehlds_movecmdcontents_bitmask 4294967295
Validates the content of player movement commands. Rejects movement packets that contain invalid bit flags — catches some speed hack and movement exploit attempts at the protocol level.
Community Ban Sharing
Many CS 1.6 communities maintain shared ban lists. You can import these into your banned.cfg:
cat community_bans.cfg >> /home/gameserver/hlds/cstrike/banned.cfg
Then in the server console:
exec banned.cfg
writeid
Verify the file doesn't contain banid 0 0:0:0 before importing — that line bans everyone.
Reality Check
Server-side anti-cheat in CS 1.6 is limited. The game is 25 years old and cheat tools are everywhere. Here's what actually works:
- VAC2 catches known cheats but is slow to respond to new ones
- sv_consistency stops model replacement cheats
- Active admins with recording capability (HLTV, manual demos) are more effective than any cvar
- Fast ban response — when someone is obviously cheating, ban them quickly and move on
No config combination fully stops a determined cheater using a working external tool. Build a community where cheaters get reported fast and banned faster.