How to protect your FiveM assets from leaks

Custom cars, MLOs, clothing and scripts are often the most expensive part of a FiveM server, so it is no surprise that owners ask how to keep them from being copied. The honest answer has two parts: what you can protect, and what you cannot.

What you cannot fully protect

Every asset a player sees in game has to be on their PC first. That is how FiveM works: the client downloads your resources, keeps them in its cache and loads them from there. A determined player who joins your server can get at those files with the right tools, and no server setting changes that.

So the goal is not to make leaks impossible. It is to make sure only real players on your server can get the files, and to close the easier ways in.

Close the easy ways in

• Your server's file endpoint. By default, anyone who knows your server's IP and port can request resource files over HTTP without joining. If you use a proxy or CDN, FXServer build 10543 and later can limit the endpoint to it with sv_proxyIPRanges and sv_httpFileServerProxyOnly.
• Download URLs on a cache or CDN. A plain caching proxy serves files to anyone who has the URL. Check that your CDN only serves players who are connected to your server.
• Your adhesive_cdnKey. With a fixed key the files are the same for everyone, so treat the key like a password. Keep it out of screenshots, public repositories and Discord channels. More about the key.
• Access to your server files. Many leaks do not come from players at all. They come from staff or developers with FTP, txAdmin or panel access who copy the resources folder. Give access only to people who need it, use separate accounts, and remove access when someone leaves.
• Old test servers and backups. A forgotten test server with an open file endpoint, or a backup in a public place, is as good as a leak.

Keep important code on the server

Files listed as server_script in a resource's fxmanifest are never sent to players. Client scripts, shared scripts and everything under files are. Logic that matters, such as prices, payouts and permissions, belongs in server scripts.

For resources you buy, Cfx.re's Asset Escrow system ties a resource to the Cfx.re account that bought it, and it only starts on servers that use that account's license key. That mainly protects the creator, but it also means a leaked copy of an escrowed resource will not start on someone else's server.

Send less

• Remove resources you no longer use. A resource that still starts is still downloaded by every player.
• Do not list files players do not need under files, such as source files, READMEs or editor projects. Everything in that list is sent to every player.

How FiveMCDN handles it

FiveMCDN only serves your assets to FiveM clients. Requests without a client session token are rejected at the edge, the first download of every file is checked with your server, which only accepts players connected at that moment, and cached files are only served to requests that carry a token and the file's exact content hash, which your server hands out to admitted players only. Someone who only has a file URL gets nothing. Two optional lines in your server.cfg lock your own file endpoint so it only answers the CDN. See asset protection in the docs, or read how resource and asset caching works.