---
title: "Restricting Client Cvars (Cvar Checks and sv_consistency)"
excerpt: "Use sv_consistency and mp_consistency to force consistent models, and query_client_cvar in an AMX Mod X plugin to catch clients running cvars used to cheat."
category: "administration"
tags: "cvars, anticheat"
image: ""
read_time: "9 min read"
---
<p>Some of the oldest CS 1.6 "cheats" are not hacks at all — they are ordinary client cvars set to values that reveal enemies through walls, remove smoke, or brighten models. The engine gives you <code>sv_consistency</code> to force consistent files, and AMX Mod X gives you <code>query_client_cvar</code> to read and reject a client's cvar values. This shows how to use both to close the easy holes.</p>

<h2>1. Force file consistency</h2>
<p>The engine can require that clients use the server's versions of certain files (player models, sprites, sounds) rather than modified transparent or brightly-colored ones. Enable it in <a href="/tutorials/setup-server-cfg-cs16">server.cfg</a>:</p>
<pre>sv_consistency 1
mp_consistency 1</pre>
<p><code>sv_consistency 1</code> makes the server enforce a consistency list; <code>mp_consistency 1</code> in CS specifically forces player model and skin consistency, which blocks the classic bright/see-through player skins. A client with a mismatched forced file is dropped with a consistency error rather than being allowed to play with an advantage.</p>

<h2>2. Understand what consistency does and does not catch</h2>
<p>Consistency covers <em>files</em>. It does nothing about <em>cvars</em> — a player can still set rendering cvars that the engine honors and that give an edge. That is the gap <code>query_client_cvar</code> fills: it lets a plugin ask a connected client the value of any cvar and act on the answer. The two together — file consistency plus cvar checks — cover the common low-effort cheats. Neither replaces a real anti-cheat for signature hacks.</p>

<h2>3. A cvar-enforcement plugin</h2>
<p>This plugin queries each player shortly after they join and kicks anyone whose value on a monitored cvar is not allowed. It uses only the core <code>amxmodx</code> API:</p>
<pre>#include &lt;amxmodx&gt;

public plugin_init()
{
    register_plugin("CSB Cvar Guard", "1.0", "CSB")
}

public client_putinserver(id)
{
    if (is_user_bot(id) || is_user_hltv(id))
        return
    // give the client a moment to finish connecting
    set_task(3.0, "check_cvars", id)
}

public check_cvars(id)
{
    if (!is_user_connected(id))
        return
    query_client_cvar(id, "r_drawentities", "on_cvar")
    query_client_cvar(id, "gl_wireframe",   "on_cvar")
}

public on_cvar(id, const cvar[], const value[])
{
    // r_drawentities must be 1; anything else is a rendering exploit
    if (equal(cvar, "r_drawentities") &amp;&amp; str_to_num(value) != 1)
    {
        server_cmd("kick #%d \"Illegal cvar: r_drawentities\"", get_user_userid(id))
        return
    }
    // gl_wireframe must be 0
    if (equal(cvar, "gl_wireframe") &amp;&amp; str_to_num(value) != 0)
    {
        server_cmd("kick #%d \"Illegal cvar: gl_wireframe\"", get_user_userid(id))
        return
    }
}</pre>
<p>Compile it, drop the <code>.amxx</code> into <code>addons/amxmodx/plugins/</code>, and add it to <a href="/tutorials/plugins-ini-load-order">plugins.ini</a>. If you would rather not maintain your own, a ready-made version ships as the <a href="/plugins/csb-cvar-guard">CSB Cvar Guard</a> plugin with a configurable list.</p>

<h2>4. Which cvars are worth checking</h2>
<p>Values a legitimate player never needs to change, and which grant an advantage when tampered with:</p>
<ul>
<li><code>r_drawentities</code> — must be <code>1</code>; other values can alter how entities render.</li>
<li><code>gl_wireframe</code> — must be <code>0</code>; non-zero draws wireframe through geometry.</li>
<li><code>gl_zmax</code>, <code>gl_polyoffset</code> — tampering can affect depth/visibility on some renderers.</li>
</ul>
<p>Keep the list short and well-understood; over-restricting kicks legitimate players on hardware quirks. Do <strong>not</strong> guess at cvar names — query only ones you have verified exist and matter.</p>

<h2>5. Enforce sv_cheats and rates too</h2>
<p>Two engine-side basics belong alongside cvar checks: <code>sv_cheats 0</code> (so cheat-protected cvars like <code>r_fullbright</code> cannot be set at all) and sane rate limits so nobody games the netcode. Both are in the <a href="/tutorials/essential-server-cvars">essential server cvars</a> list.</p>

<h2>Troubleshooting</h2>
<ul>
<li><strong>Consistency kicks legitimate players</strong> — your server's forced files differ from stock in a way clients cannot obtain. Make sure the required files are on your <a href="/tutorials/fastdl-setup-guide">FastDL mirror</a> so clients can download the correct versions.</li>
<li><strong>query_client_cvar never fires</strong> — you queried too early (before the client finished connecting) or the client is a bot/HLTV. Delay with <code>set_task</code> and skip non-players, as the plugin does.</li>
<li><strong>Everyone gets kicked</strong> — your allowed value is wrong, or the cvar has a different legitimate default than you assumed. Log the values before you kick on them.</li>
<li><strong>Cheaters still get through</strong> — cvar checks only catch cvar-based tricks; binary aimbots/wallhacks need a dedicated anti-cheat. This is a floor, not a ceiling.</li>
<li><strong>Consistency does nothing</strong> — <code>sv_consistency 0</code>, or nothing is on the consistency list to enforce. Enable both cvars.</li>
</ul>

<h2>Verification</h2>
<p>On a test client, set a monitored cvar to a bad value before connecting:</p>
<pre>gl_wireframe 1
connect your.server.ip:27015</pre>
<p>You should be kicked within a few seconds with the <code>Illegal cvar</code> message. Set it back to <code>0</code> and confirm you connect normally. For consistency, join with a modified player model and confirm the server rejects it. When both the file check and the cvar check reject their test cases, the common low-effort cheats are closed.</p>