Protect your sever from over TWENTY glitches and dupes that have made it into final Spigot builds! This plugin supports all versions of Spigot from 1.8.8 to present. I try to keep it up to date with any new exploits that are found (from any version) So please feel free to contact me if you know of a vanilla game mechanic exploit that should be fixed!
- Native Minecraft Version:
- Tested Minecraft Versions:
Just below I will always post the latest addition to the plugin, as new protections are added, protections will be sorted into the appropriate categories (by version) below, so no matter what your version please do look through and see if your server is affected by these glitches. I have tried to include videos or screenshots of how to duplicate these exploits if you would like to verify that your server is vulnerable before downloading.
Got a question? need some help? Join our discord!
*New for version 1.9.5*
Added an option to look for enchantments greater than the vanilla limits, eg sharpness 10 swords (or unbreaking 32000 armor) This option is OFF by default, when turned on The plugin will reset them to the max allowed enchantment level.
Added the ability to change the prefix for messages sent by IllegalStack, it's located in the messages.yml and defaults to "[IllegalStack] -"
Version 1.9+ now offers in game config editing, in the form of clickable links.. http://prntscr.com/nqesk4 (ONLY if your Server Version supports ChatComponents.)
This makes changing config options a breeze and it can all be done without needing to reload the plugin.
If you would like to donate to support this plugin please do so here:
-> DONATE <-
The spoiler below contains all possible configuration options for each protection. Please Note: There is no need to disable protections in the configuration if they do not apply to your minecraft server version. A 1.13 only protection will automatically disable if you are running any other version.
LogOffensesInSeparateFile: true #Write the time/date of all offenses to a text file: (located in /plugins/IllegalStack/OffenseLog.txt)
InGameOffenseNotifications: true #Send a notification of offenses to players who have the illegalstack.notify permission node (default OP)
PreventOverStackedItemInHoppers: true #destroys items in hoppers that are over the max stack size.
AllowStack: #any items added here will be ignored by the overstacked item protection code.
FixOverstackedItemInstead: false #if enabled, instead of removing an illegal stack, the item's quantity will be adjusted to the max stack size for that item.
RemovePistonIfHeadIsExploded: true #removes piston bases if the piston head is destroyed.
PreventRailDupe: true #prevents using rails to dupe carpets and such (1.12 - 1.14 only)
PreventRecipeDupe: true #prevents the recipe book dupe glitch
PreventNestedShulkers: true #destroy any shulker boxes stored inside another shulker box.
BlockCMIShulkerStacking: true #prevent the CMI plugin from allowing shulkers to be placed inside other shulkers
RemoveOverstackedItems: true #remove any items found on players, in inventories etc that are larger than the vanilla stack size.
PreventCactusDupe: true #Enable blocking of 0 tick cactus / chorus fruit exploits.
RemoveBooksNotMatchingCharset: true #enable checking for the chunksave dupe.
ValidCharset: US-ASCII #your server's desired charset.
DestroyBadSignsOnChunkLoad:false #enable if your server has a sign dupe issue to allow the plugin to scan for and remove the signs that make this dupe possible. (if you notice any hits in performance turn this back off / notify me).
PageCountThreshold: 5 #number of pages in a book allowed to have characters OTHER than your specified charset.
BookAuthorWhitelist: #Book authors that bypass the book dupe checks
- dniym #Change this to a trusted member of your staff!!!
PreventItemFramePistonDupe: true #prevent pistons and item frames from being used to dupe (1.12 and below)
PreventIndirectTNTPowerDupe: true #Prevents tnt dupers (all versions)
PreventMinecartGlitch: true #prevent pistons from being used to glitch minecarts inside other blocks.
RemoveExistingGlitchedMinecarts: false #set this to true to have the plugin remove minecarts from your worlds that are already glitched inside other blocks.
PreventZombieItemPickup: false #set this to true if you are having issues with players using zombies / drowned to dupe items (should not be a problem on spigot 1.13+ servers)
BlockNonPlayersInNetherPortal: true #prevent any entity (except for players) that is not on the whitelist from going through a nether portal.
BlockNonPlayersInEndPortal: true #prevent any entity (except for players) that is not on the whitelist from going through a end portal.
EndWhiteList:  #add entity types here you wish to allow to travel to the end
NetherWhiteList:  #add entity types here you wish to allow to travel to the nether.
NotifyBlockedPortalAttempts: false #notify staff whenever a portal attempt is blocked. NOTE this is off by default to prevent spam if someone has a sand duper or farm setup already.
BlockVillagerTradeCheesing: true #prevent players from being able to force villagers to regenerate their trades over and over until they find one they like. (1.14+ only)
PreventVillagerSwimExploit: true #prevent players from being able to glitch the discounts that villagers give by making the villagers swim.
KickForAutoClickerFishing: true #kick players who use auto clickers to fish.
WatchForAutoFishMod: true #enable detection of 3rd party fishing mods.
WarnPlayerThenKickInsteadOfNotify: false #defaults to false, send a notification to staff and prevent the player from catching fish in the exact same spot over and over.
MaxFishToNotifyStaffThenBlock: 5 #number of fish a player can catch in the exact same spot before being detected.
MaxFishAllowedBeforeKick: 10 #number of fish a player can catch before being kicked (if enabled above)
DisableBookWriting: false #totally disable writing in books, any player writing in a book will also have the book removed from their inventory to prevent packet bypasses.
DisableInWorlds:  #Enter world names here to disable IllegalStack features in that world ***WARNING ALL PROTECTIONS ARE DISABLED IN THESE WORLDS *** Use this feature ONLY if you are SURE players can't dupe items on a non protected world and transfer them to a protected one!
Settings.RemoveItemsMatchingName: false #use this feature to remove items with specific names and or lores, for this to function names/lore must be added to one of the two lists below. This is useful if you've had players who have gotten items out of a shop gui due to a bug with the shop plugin.
Settings.ItemNamesToRemove:  #add item names you wish to have removed from players/inventories/hoppers etc.
Settings.ItemLoresToRemove:  #add lore to this list to have items that have a line of lore that matches removed from players/inventories/hoppers etc.
Settings.NameLoreStrictMatchMode: false #If this value is true, then the item name or lore line must EXACTLY match including color codes, when set to false as long as the text is included in the lore or name a match will be detected.
All messages sent to players/staff by the plugin have been removed from the config.yml and are now located in messages.yml. You can change these / translate them / recolor them however you like.
Messages support color codes as well as some placeholders, but not all messages support all color codes. They're mostly here so that you can move them around.
~author~ --> A books author (only applies to book protections)
~name~ --> A player or entity's name that triggered the message.
~contents~ --> Contents of an item frame.
~removedblocks~ --> A list of blocks removed by a protection.
~item~ --> The item type affected by a protection.
~amount~ --> The amount of a ~item~
@ --> The location where a protection happened.
~value~ --> Value of a option (staff commands only)
~protection~ --> The Protection affected (staff commands/in game editor only)
~status~ --> The status of a protection, ie ON / OFF for the in game editor.
BookRemoved: 'found a book with characters that do NOT match the specified character
set and removed it.. Author was: ~author~'
SignRemoved: Found a sign not matching the allowed character set in the world @
SignRemovedOnPlace: detected a sign placed by ~name~ that contained characters not
in the allowed character set. Possible dupe machine exploit! @
SignKickPlayerMsg: Placing signs with unicode characters is NOT permitted.
ShulkerClick: 'Removed a shulker box from inside another shulker box clicked by: ~name~'
ItemFrameRemoveOnExtend: removed an item frame containing - ~contents~ on the back
of a retracting piston @
ItemFrameRemoveOnRetract: removed an item frame containing - ~contents~ pulled by
a sticky piston
PistonRetractionDupe: Stopped Retraction Dupe Glitch & Removed Piston @ ~removedblocks~
NetherPortalBlock: 'Blocked an entity from entering or leaving the nether: ~name~
EndPortalBlock: 'Blocked an entity from entering or leaving the end: ~name~ @'
MinecartGlitch1: 'Located and removed a minecart glitched inside another block : ~blocktype~
MinecartGlitch2: Stopped a minecart from being glitched into a block @
ZeroTickGlitch: Stopped 1.13 - 1.14 Zero tick crop growth glitch and removed (~removedblocks~)
NamedItemRemovalHopper: Found an item named ~item~ in a hopper, it has been removed
NamedItemRemovalPlayer: 'Found an item named: ~item~ in ~name~''s inventory, it has
been removed. @'
PistonHeadRemoval: A piston head was exploded.. remoging an orphan piston base @
IllegalStackLogin: 'Illegal stack of items removed: ~item~ (~amount~) from player:
~name~ at login.'
IllegalStackOffhand: Removed an illegal stack of items from the off hand of ~name~,
~item~ ( ~amount~)
IllegalStackPlayerBody: 'Illegal stack of items removed: ~item~ (~amount~) from ~name~''s
body during item scan.'
IllegalStackItemScan: 'Illegal stack of items removed: ~item~ (~amount~) from player:
~name~ at item scan.'
IllegalStackOnClick: 'Illegal stack of items removed: ~item~ (~amount~) from player:
~name~ on click in inventory.'
IllegalStackShorten: 'Fixed an illegal stack of: ~item~ (~amount~) triggered by player:
PlayerDisabledBookMsg: &cSorry but player book editing is disabled on this server!
PlayerKickMsgFishing: &cAuto Clicker Fishing is not allowed on this server!
PlayerKickMsgFishMod: &cAttention! it looks like you may be using an Auto Fishing
Mod... Please change the spot you're fishing to avoid getting kicked!
PlayerSwimExploitMsg: &cThat villager is too busy swimming to trade with you right
PlayerCMIShulkerNest: &cSorry you can not put a shulker into another shulker!
StaffMsgBookRemoved: 'Removed a writable book from player: ~name~ because player book
creation is disabled!'
StaffProtectionToggleMsg: 'Protection: ~protection~ has been turned ~status~ by ~name~'
StaffInvalidProtectionMsg: '&cYou must supply a valid protection name to add values
StaffOptionUpdated: &aOption successfully updated!
StaffSingleWordsOnly: &cThat protection does not support multiple word arguments!
StaffStringUpdated: '&aValue updated with string value: ~value~'
All permissions for this plugin default to OP, to give your lower staff access to them grant them permissions from the spoiler below.
ALL / MOST Version Protections - The following protections affect most if not all server versions, (including the current minecraft version) Once (if ever) a exploit is patched by mojang / spigot it will be moved to the last version it worked in.Code (Text):
description: Allows users to use the /istack protections command
description: Allows users with this perm to use the /istack command
description: Allows users with this perm to receive in game notifications of offenses
Protects and identifies the tnt dupers that is present and CONFIRMED working in the latest spigot build. This duper does work in the final 1.13.2 release as well as 1.14 snapshots!!! This protection detects and prevents the tnt from ever being lit silently protecting you from this dupe.Prevents the chunk savestate dupe. ***Note if you need to change the charset for the plugin a valid list of them is here: -> https://docs.oracle.com/javase/7/docs/technotes/guides/intl/encoding.doc.html
you may also whitelist authors in the configuration files, any books created by a whitelisted author will NOT be removed even if they contain characters beyond the specified charset or page threshold! (be careful whom you add to the whitelist!)
Added a user requested feature to completely block written book creation (this feature is OFF by default enable it in the config if you need it)
in Settings.DisableBookWriting: true
Added a user requested feature to remove items with a display name or lore that matches a configurable value. See -> Settings.RemoveItemsMatchingName : true to enable.
Added a user requested feature to drop items from a exploit machine rather than destroying the blocks: Settings.BreakMachinesInsteadOfDroppingItems: true (defaults to true to break the machine rather than dropping items.)
Added a user requested feature to only notify about exploits and don't take further action. NOTE: setting this option to true may end up with a lot of notifications/spam if your staff isn't on to handle the exploit manually. -> Settings.NotifyInsteadOfBlock: false (defaults to false)Will detect and remove shulker boxes stored inside other shulker boxes, which is not vanilla behavior typically accomplished using glitches.Prevents shulkers from being placed inside shulkers if you're using the CMI plugin.. There's a command used to open a shulker without placing it, this allows shulkers to be stored inside shulkers.Prevents the long standing bedrock removal method that involves headless pistons. -> (which still works in 1.14) Any piston that has its head removed will also have its base removed.Prevents using hoppers across a chunk border to duplicate items when the chunk is unloaded or in a lazy state..
Prevents nether portal / end portal duping!
Completely blocks non player entities from traveling to to the nether or end, you can enable either in the config as well as whitelist entity types if you deem these safe. Please note you'll need to use the entity types located here: https://hub.spigotmc.org/javadocs/spigot/org/bukkit/entity/EntityType.html
If you are using an older version of minecraft you'll need to verify that the entity type's name is correct you should be able to do this by looking at the entity while F3 is active in your client.Added protection against minecart glitching, this will prevent players from being able to use pistons to glitch a minecart inside another block. **Note this only prevents players from doing the glitch it does not fix already glitched ones.
If your server already has minecarts glitched into blocks and you would like to remove them from your world turn on the setting: RemoveExistingGlitchedMinecarts: true in the config.Protects against AutoClicker fishing AND Auto fishing mods. These two exploits are handled / detected differently and have different options. To Be clear this does NOT break fishing farm setups OR inhibit normal fishing in any way. If a player is fishing normally without the use of 3rd party / auto clicking exploits they should never be interrupted by these protections.
1) Auto Fish Mod protection: (Default Configuration) Several variations of this exist and they're all 3rd party clients or part of a hacked client. But they all cast in the same area over and over again, typically with zero movement which is technically possible if your player were to say hold their mouse in the air and just right click whenever a fish is caught to cast in the exact same place. This protection will monitor the location of the hook and if its within a tiny area track the number of fish caught. After a configurable amount of fish, staff is notified of the offending player and that location is blacklisted. Any further casts into that area will NOT yield any more fish until the player casts elsewhere and catches a fish.
There is an advanced mode option that will instead of notifying staff about the potential mod user, it will instead warn the player directly that they are suspected of using the mod and should change where they're casting their lure. If they catch another fish from the same spot instead of casting elsewhere they'll be kicked from the server (Off by default)
2) Autoclicker protection:
(all versions) reliably detects players who are spam casting / auto click fishing. This exploit is very different from normal fishing, they'll target an intractable such a note block, repeater, lever etc and either activate a macro that holds down the right mouse button, or put a weight on the button, or tape the button down etc, and whenever a fish is caught the fish will be reeled in and the lure instantly recast.
a) These farms are typically one water block setups but it could be used at an ocean just as easily..
b) Many right clicks are detected between fish catches so it is very easy to tell these players from players who are actually fishing.
c) There should NEVER be any reason a player needs to hold down the right mouse button on an intractable block while fishing,
Once a player is detected staff is notified, their catch is removed and they are kicked from the server with a configurable kick message.
*NOTE* the above video is just one example of this fish farm, it does vary from version to version but anyone fishing faster than humanly possible will get caught.
Misc Features (All Versions) - The following items are just features the plugin offers and are enabled for all server versions by default.
Will destroy any items found in player inventories that are in larger stack sizes than they should be. (can be configured)
- Specific items can be overstacked based upon a permission (illegalstack.overstack) any user with this permission can have items greater than the vanilla stack size once they are added to the whitelist. Settings.GroupStack 
You may also opt to have items FIXED instead of removed, located in the config under: FixOverstackedItemInstead: false, setting this to true will reduce the stack to the vanilla limit rather than deleting the item(s).
Customizable Messages for players and staff whenever the plugin needs to send them a message. ---> see this post for more information:
Logs blocked offenses to a text file in /plugins/IllegalStack/OffenseLog.txt for easy lookup of whose trying to exploit glitches on your server.
In game notifications are given to players with the illegalstack.notify permission node (default OP), if you're using spigot this notification shows up as a clickable link that will teleport you to where the offense was detected.
The plugin's configuration can be reloaded using the /istack reload command.
Ability to disable protections in a specific world (USE WITH CAUTION) -> see this post:
1.14 ONLY Protections - The following protections only affect servers running Spigot 1.14
Protects against the villager trade cheesing exploit that allows players to get villagers to change their profession over and over (thus creating new trades) until they found the best possible trade for that villager. Now villagers will be locked to the first trade they spawn with until the player levels them up.
Also protects against players glitching the discounts by making the villagers swim! Players will be unable to trade with a swimming villager (until a better fix is found).
1.13 - 1.14 Protections - The following protections only affect servers running Spigot 1.13 - 1.14
Now protects against Zero Tick exploits of Bamboo and Sugarcane, previously these plant's couldn't be grown faster with the zero tick exploit however later versions of 1.14 and 1.14.1 as well as 1.14.2 are affected!
Prevents the 0 tick cacti/chorus fruit farm exploits (1.13 & 1.14). This protection will remove any cacti and the piston that caused the 0 tick exploit when triggered. These farms are capable of producing insane amounts of these items.
1.13-1.12 Protections: - The following protections affect versions 1.12 - 1.13 servers ONLY
Prevents the 1.13 retraction dupe glitch, and should prevent any other machine that pulls rails/carpets off of another block from duping. This will break the machine causing the dupe and write the location to the log files so that you can locate the offending player/machine.
https://prnt.sc/ktmc3s <-- New Setup for carpet/rail dupers
Prevents the slime block/piston extension 1.12.2 carpet / rail dupe glitch (still working in 1.13)
Older Protections: - The following protections are for older versions of minecraft and may span multiple versions.
Prevents the piston / item frame dupe glitch (1.12 and below). This protection will remove and destroy any item and item frame attached to or moved by a piston. The location and item are logged to the console when this happens.
Prevents recipe book glitches/dupes that involve players dropping items and spamming a crafting recipe.Prevents overloading a chunk using unicode characters on signs (minecraft 1.9 - 1.12)Added a user requested option to disable zombies from being able to pick up items... The drowned/zombie exploit should be fixed in 1.13+ spigot so this option is OFF by default, to turn it on set: Settings.PreventZombieItemPickup:true in the config
Dupe Fixes / Illegal Stack Remover 1.9.5
Provided fixes for several vanilla bugs that allow players to dupe on your server.