FiveM Backdoor Scanner

What the backdoor scanner checks

• Code after a long run of spaces: a loader appended to a normal line, out of view in any editor (in Lua and JS files).
• load() or loadstring() on the body of an HTTP response: whoever controls that web server can run any code on yours.
• load() on text that is only decoded at runtime: string.char lists, escaped bytes or base64 decoders.
• Long obfuscated strings: escaped bytes, base64 or hex blobs and long string.char lists.
• Reads of sv_licenseKey, rcon_password or sv_tebexSecret, and of the database connection string in a file that also sends HTTP requests.
• HTTP requests to raw IP addresses or to addresses that are only decoded at runtime.
• os.execute and io.popen, file writes outside the resource and SaveResourceFile into other resources.
• Executables (.exe, .bat, .ps1 …) and archive entries that would extract outside their folder.

How a backdoor gets onto a FiveM server

Most backdoors arrive inside a resource: a leaked or "free" copy of a paid script or a server pack passed around on Discord. The visible code works as advertised, so nothing looks wrong.

The payload is usually small. A common shape pushes a loader thousands of spaces to the right of a normal line, where no editor shows it; another downloads code with PerformHttpRequest and runs the response with load(). Once it runs, it can copy itself into your other resources with SaveResourceFile, which is why one infected script is rarely the only one.

What a result means

Hidden code behind spaces is the one finding with no legitimate use. Treat those files as compromised.

The other findings are leads, not verdicts. An anticheat may read convars, a logging script may call a raw IP and some libraries ship base64 data. Read the marked line and decide.

A clean scan means none of these patterns were found in the files the scanner could read. It can't read escrow-encrypted code or compiled Lua, and a new obfuscation technique can slip past pattern checks. The list under "Not checked" shows exactly what was left out.

If the scanner finds a backdoor

1. Stop the server, or at least stop the affected resource.
2. Scan the whole resources folder, not only the resource you suspect: the backdoor may have copied itself.
3. Replace infected resources with a clean copy from the original author instead of deleting single lines.
4. Change sv_licenseKey (Cfx.re Portal), rcon_password, your Tebex secret, your database password and any Discord bot tokens or webhooks in your files.
5. Check server.cfg and txAdmin for admins and add_ace or add_principal lines you didn't add, and your database for unknown admin groups.
6. Scan again before you start the server.

FAQ

Are my files uploaded?

No. The scanner reads the ZIP or folder in your browser and runs every check there. Nothing is sent to RPScripts.

Can I scan my whole server?

Yes. Choose your resources folder or ZIP it (up to 300 MB). Every Lua and JS file up to 2 MB is checked, up to 120 MB of code in total. Streamed assets such as .ytd or .yft files are not code and are skipped.

Can it check escrow-protected resources?

No. Cfx escrow encrypts the protected files and only FXServer can decrypt them. The scanner checks the files a resource leaves readable and lists the escrowed folders under "Not checked".

Does a clean result guarantee my server is safe?

No. The scanner looks for the patterns known backdoors use. It can't judge encrypted or compiled code, and it doesn't replace getting resources from their original author and keeping your secrets private.

Is the backdoor scanner free?

Yes. It needs no account and has no scan limit.

Test a resource before you install it

The FiveM Script Tester runs the same security checks on one resource, plus its manifest, Lua, framework API and events, and runs it in a CfxLua sandbox.

The Cfx.re guide on server security explains how to secure your own events.