Players must be able to reach a public network endpoint to join your FiveM server. A join code or domain makes the address easier to use; it does not make the destination secret. To keep a backend address separate, you need a properly configured proxy and a firewall that prevents direct access.
Do not use endpoint privacy as IP protection
The older sv_endpointPrivacy setting concerns player endpoints in public reports, not concealment of the game server address. Current upstream source marks that setting as removed. Do not add it as a DDoS fix or assume that it hides server or player names. Check the documentation and startup warnings for your installed artifact.
Understand the two traffic paths
FiveM uses a connection endpoint and game-server traffic. The official proxy guide describes the HTTP connection path separately from raw TCP/UDP forwarding. A website reverse proxy or a DNS record alone does not provide both.
Before selecting a provider, confirm that its service supports the actual FiveM traffic paths, ports and expected load. Ask how backend access is restricted and how legitimate players reconnect during mitigation.
Configure and test a protected backend
Keep an independent administration route before changing firewall rules. Configure the documented proxy paths, then allow only the necessary sources to reach the backend. Do not copy a firewall allowlist from an unrelated host.
Test server-list joining and direct connection through the intended public endpoint with an external client. Verify that normal gameplay and resource downloads work and that unauthorised direct backend access is blocked. Test recovery before relying on the setup.
Treat exposure as a network question
Check whether old DNS records, public configuration, resource URLs or a website on the same host reveal the backend. An address that has already been exposed may need a provider-assisted change. Keep software updated and restrict administration services; obscurity does not replace those controls.