Server Admins: Catching Cheaters EAC Misses (Oxide & Carbon)

Disclosure: I'm DeadInTen, and I make Rust plugins. One of my plugins is mentioned below, but everything in this guide works without it.

Every server runs Easy Anti-Cheat, and cheaters still get through. Here's what you have out of the box:

• Easy Anti-Cheat runs on the player's PC and bans known cheats on every server. These are Facepunch's bans, and you never see them happen.
  
• Server antihack checks movement and combat: noclip, flying, speed hacks, shots from impossible positions, melee from too far away. Enough violations in a short time get the player kicked.
  
• F7 reports go to Facepunch, but plugins can read them too.

The gap: antihack forgets. Violations fade within minutes and are wiped on restart, so a cheater who trips it a few times a night never adds up to anything. EAC also can't spot a cheat it doesn't know yet, or the patterns an admin notices over weeks.

No single sign proves anything. A lag spike trips antihack too. Look for several signs that point the same way over time:

• Antihack violations that keep coming back, from the same player, across different nights.
  
• A headshot rate well above everyone else's, especially at long range. Compare with your own server's players, not a number from the internet.
  
• Finding things nobody could see: digging straight to buried stashes, or heading directly for hidden loot rooms.
  
• F7 reports from several different players in the same week. Reports from one angry player mean little.
  
• A family-shared account whose owner is banned. Family sharing lets a banned player come back on someone else's copy of the game.

• Write it down. Name, Steam ID, time, and what happened. Chat moves fast and memory is unreliable.
  
• Spectate. Watch the suspect unseen and record it with your own capture software. Look for tracking through walls and aim that snaps between targets.
  
• Bury a honeypot. Hide a small stash where nobody would stumble on it and see who digs it up. Nobody finds a stash in the middle of an empty field by chance twice.
  
• Save the logs (console and plugin logs) from the nights in question before they roll over.

CheatAlarm does this bookkeeping for you. It keeps every antihack violation the game forgets, compares each player's headshot rate with the rest of the server by distance, counts F7 reports and family-shared accounts, and lets you bury honeypot stashes from chat. All of it adds up to one score per player that fades over time. Admins are only alerted when a score crosses a line, and every flag is kept with its evidence. It never bans anyone itself.

• Be sure first. A wrong ban costs a player and your server's reputation. If the evidence is mixed, keep watching.
  
• Ban by Steam ID, not by name, because names change:
  

  banid <SteamID> "name" "reason"

• Keep the evidence with the ban, because there will be an appeal.
  
• Say so, briefly. A short public note that a cheater was removed tells honest players you're paying attention. Don't say how you caught them.

The full guide is here:
Catching Cheaters on Your Rust Server: What EAC Misses

Questions are welcome in the comments.