> For the complete documentation index, see [llms.txt](https://mango-5m.gitbook.io/mango5m-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mango-5m.gitbook.io/mango5m-docs/resources/mango-admin/features/entity-protection.md).

# Entity Protection

Catching somebody spawning vehicles, peds or objects faster than a person could - and stopping the spawn rather than cleaning up after it.

A cheat menu's first move is usually volume: fifty cars, two hundred props, the same model over and over until the server crawls. This watches every networked spawn on the **server**, counts them per player, and refuses the ones past your limit.

{% hint style="success" %}
**It blocks rather than tidies up.** FiveM raises `entityCreating` on the server before a networked entity exists, and that event can be cancelled — so a spawn past the block threshold never happens, instead of being deleted a second later.
{% endhint %}

## Where it lives

There is **no Entity Protection page in the panel**. It is set up in a config file, and every warning and block is written to the audit log under **Entities**.

{% code title="shared/config/entities.lua" %}

```lua
Config.EntityProtection = {
    Enabled = true,
    Vehicles = { Enabled = true, WarningThreshold = 10, WarningWindow = 10, BlockThreshold = 20, BlockWindow = 10 },
    Objects  = { Enabled = true, WarningThreshold = 25, WarningWindow = 10, BlockThreshold = 50, BlockWindow = 10 },
    ModelSpam = { Enabled = true, Threshold = 10, Window = 10, BlockThreshold = 20 },
}
```

{% endcode %}

## What it counts, and what it ignores

This is the part worth understanding, because it is the difference between a useful alarm and one nobody believes.

The server is told about **every** networked entity a client creates — and most of those are not anybody's doing. GTA's ambient population puts pedestrians and traffic into the world constantly, and whichever client happens to own one is named as its creator. On a stock server that is hundreds of peds a minute.

So every entity is checked against `GET_ENTITY_POPULATION_TYPE`, which says what kind of thing made it:

| Type |                                            | Counted |
| ---- | ------------------------------------------ | ------- |
| 1–5  | `RANDOM_*` — the game populating the world | No      |
| 6    | `PERMANENT`                                | Yes     |
| 7    | `MISSION` — what a script spawn is         | Yes     |
| 10   | `TOOL`                                     | Yes     |

A spawn from a menu is type 7. Everything in the RANDOM family is the game itself and is ignored.

{% hint style="warning" %}
**If you saw players accused of spawning a `a_m_y_beverly_02`, this is why, and it is fixed.** Before the population type was checked, driving past a pedestrian could be counted as spawning one.
{% endhint %}

```lua
-- the set that counts. Widening it catches a menu using CreateRandomPed - and also every
-- ambient pedestrian, so raise the thresholds a long way at the same time.
Config.EntityProtection.CountPopulationTypes = { 6, 7, 10 }
```

## What it watches

Every type has its own limits, because ten helicopters is not ten sedans.

| Type         | Warns at  | Blocks at |
| ------------ | --------- | --------- |
| **Vehicles** | 10 in 10s | 20 in 10s |
| **Peds**     | 10 in 10s | 20 in 10s |
| **Objects**  | 25 in 10s | 50 in 10s |
| **Aircraft** | 4 in 10s  | 8 in 10s  |
| **Boats**    | 5 in 10s  | 10 in 10s |
| **Trains**   | 2 in 30s  | 4 in 30s  |

Plus **the same model over and over**, which is the shape of a spawn loop where twenty different cars is more often somebody testing. Ten of one model in ten seconds is an alert on its own.

Every number is yours to change, and any of them can be switched off.

## What happens

|                           | Warning | Block              |
| ------------------------- | ------- | ------------------ |
| Recorded in the audit log | Yes     | Yes                |
| Staff told                | Yes     | Yes                |
| Spawn refused             | No      | Yes                |
| Kick / ban                | No      | **Off by default** |

Nothing bans anybody out of the box. Kick and ban are there, switched off, because a threshold that bans is a threshold that eventually bans the wrong person.

## Not flagging your own scripts

{% tabs %}
{% tab title="Models" %}
Anything on the list is never counted — the prop your furniture script places a hundred of, for instance.

```lua
Config.EntityProtection.WhitelistedModels = { 'prop_bench_01a' }
```

{% endtab %}

{% tab title="A resource" %}
A resource of yours that is about to spawn a lot can say so, and be ignored while it does:

```lua
exports.mango_admin:EntityProtectionSpawning(15)   -- seconds
```

It only works for resources you have named, and a resource can only ever excuse **itself** — the caller comes from the server's own record of who is calling.

```lua
Config.EntityProtection.WhitelistedResources = { 'my_mission_script' }
```

{% endtab %}

{% tab title="People" %}
A list of identifiers that are never counted.

```lua
Config.EntityProtection.Bypass = { Identifiers = { 'license:abc123' } }
```

It is deliberately **not** "anyone with an admin permission": that would make the account a cheat most wants into the one account nothing watches.
{% endtab %}
{% endtabs %}

## What it cannot tell you

{% hint style="warning" %}
**Which resource spawned an entity is not something the server is told.** A client created it; which script asked it to is not part of what arrives. So there is no "resource" column filled in with a guess — the whitelist above exists precisely because that attribution does not.

**Entities the server itself creates have no player behind them.** They are counted, and never held against anybody.
{% endhint %}

## Switching it off

`Config.EntityProtection.Enabled = false` and it is gone: no events registered, nothing tracked, and nothing written to the audit log.