How to Configure Anti-Cheat on Your CSS Server
Configure VAC, sv_pure modes, sv_consistency, and SourceMod anti-cheat plugins to protect your CSS server.
Anti-Cheat in Counter-Strike: Source
CSS has three layers of anti-cheat protection: VAC (Valve's network-level ban system), sv_pure (file integrity enforcement), and sv_consistency (model/sound hash verification). CSS also has sv_pure — a feature that does not exist in CS2 at all.
VAC
Valve Anti-Cheat runs automatically on all CSS servers launched normally. If you launched your server with -insecure for testing, re-enable VAC by removing that flag. The correct flag for an explicitly VAC-secured server is -secure, though this is the default.
When the server starts and connects to Steam, you'll see:
VAC secure mode is activated.
If you see VAC secure mode is disabled instead, check your launch command — you may have -insecure set.
VAC bans are permanent and game-wide — a player banned from CSS via VAC loses access to the game entirely. VAC does not catch everything; it's one layer, not a complete solution.
sv_pure (CSS-Only)
sv_pure enforces what custom files clients are allowed to run. This cvar does not exist in CS2 — it is CSS/Source engine-specific.
| Setting | Behavior |
|---|---|
sv_pure 0 |
Allow all custom client files — skins, HUDs, sounds, anything |
sv_pure 1 |
Enforce consistency only on files listed in pure_server_whitelist.txt; allow others |
sv_pure 2 |
Block ALL custom client files — strictest mode |
Recommendation by server type:
- Surf / bhop / casual — use
sv_pure 0. Players expect custom HUDs and visual tweaks. Blocking them kills your player count. - Competitive / match — use
sv_pure 2. You don't want anyone running custom models that make enemies easier to see.
Set in server.cfg:
sv_pure 0
pure_server_whitelist.txt
When using sv_pure 1, cstrike/pure_server_whitelist.txt lists files that clients can have custom versions of even under enforcement. This lets you allow custom sprays or HUD elements while still enforcing model consistency.
"pure_server_whitelist"
{
"whitelist"
{
"materials/..." "any"
"sound/..." "any"
}
}
Refer to Valve's developer wiki for the full whitelist syntax.
sv_consistency
sv_consistency 1
This verifies MD5 hashes of model and sound files. A client with modified versions of server-side files gets kicked with a "files don't match" message. Effective against wallhack mods that replace models with transparent versions.
Set to 0 on surf/bhop servers where players commonly run cosmetic mods without malicious intent.
SourceMod Anti-Cheat Plugins
VAC and sv_pure are preventive. For active detection, SourceMod plugins add another layer:
- SourceSleuth — detects players reusing banned accounts (same machine, different Steam ID); kicks them on join
- sm-ext-AntiFlood — rate-limits commands to prevent console spam exploits
- AlliedModders forums — search for CSS-specific aim detection and speedhack detection plugins; the quality varies, test before running on production
Practical Setup by Server Type
Casual / custom game mode servers:
sv_pure 0
sv_consistency 0
Competitive servers:
sv_pure 2
sv_consistency 1