ValheimEnforcer

Valheim Enforcer

Lightweight mod synchronization and server-side character progression for Valheim.

A drop-in, no-maintenance solution for people who would rather play than configure. Install it on the server and on your clients and it works: every mod the server loads becomes a required mod, and characters are saved on the server rather than trusted from the player's own machine. All of it is configurable, and the server always decides.

Full documentation — every feature, setting and command explained.

Install

1. Install on the server and on every client. Both sides need it; only the server's copy decides anything.
2. Start the server.

That is the whole setup. There is no mod list to write — the server publishes the plugins it loaded and requires them of everyone. Characters are already server-side.

Requires BepInEx, Jotunn and YamlDotNet (handled for you by any mod manager).

> Already have players? Anyone joining for the first time since you installed this has no save yet and counts as a new character. Check the new-character rules first. > > Coming from ServerCharacters? Import your saves so nobody loses anything. The two mods cannot run at the same time.

Features

On by default

Mod enforcement — every client is checked at connect against the mods this server allows, and is told exactly what to fix when it does not match. Optional per-mod lists for required, optional, admin-only and server-only mods; strict version pinning; SHA256 file verification that catches a mod recompiled with the version string untouched; an allowlist for BepInEx patchers; and per-connection attestation so a mod report cannot be a replayed canned answer. Full docs →

Character progression — items, skills and custom data live on the server. Untracked items are confiscated and kept so you can hand them back, skills raised elsewhere are clamped and every reduction is recorded so it can be undone, and a character whose local save was lost gets its progress back. Optionally holds Forsaken Power, eaten food, the map, known recipes, known texts, trophies, statistics and spawn point too; optionally hands new characters a starter kit or limits an account to one character. NewCharacterClearKnownTexts (on) has a first-time joiner forget the compendium entries it read somewhere this server never saw, which vanilla's own recipe reset leaves untouched; KnownTextPassthroughPrefixes (EpicMMOSystem) leaves known-text keys a mod owns to that mod, so EpicMMO's level, experience and attribute points are neither tracked nor overwritten. Full docs →

Cheat detection — clients are checked against a catalog of known cheat tools across running processes, DLLs injected into the game, open window titles, the managed assemblies loaded into the game, and DLLs dropped beside valheim.exe. The last two are what see an injected cheat menu, which is not a mod and so has no plugin file to hash and nothing in the declared mod list. Code in the game that no installed mod accounts for is reported whatever it is called; the server checks in with every client on a schedule, so a scan that has stopped does not pass for a clean one; and known cheat tools' own markers are read straight out of the world by the server. Log, kick or ban; dedicated game-cheating loaders and menus are banned on sight, and the server makes that call from its own catalog and hash lists. Process lists, window titles and folder paths never leave the player's machine. Full docs →

Player activity audit — the evidence layer under everything else. What a player is carrying, what they gained and lost, what they took from or put into chests, graves, ships and carts, and a rolling summary of the damage they are dealing. Seven days on disk, searchable with grep, downloadable to your own machine. It records and reports only — it never kicks, bans or confiscates. Full docs →

Off until you switch them on

Structure validation — catches a client spawning world-generation geometry (dungeon rooms, dvergr towns, ruins) instead of building, and pieces whose health has been set above what the prefab allows, which is how an indestructible structure is made. Blueprint and bulk-build mods cannot trip it, by design. enforcer-structures-scan finds what is already in your world. Full docs →

Network integrity — guards on the vanilla RPCs the server otherwise relays without looking at them. Binds chat messages to the name the server holds, refuses the player-teleport message from non-admins, filters mass object deletion down to what the sender owns, drops impossible damage values, and optionally re-decides PvP and restricts global keys. These read packets the server already holds, so there is nothing for a client to lie about. Full docs →