A public player connection and an administrative control connection have different purposes and should receive different access. Secure the management path before sharing your server address widely. An exposed console or remote administration interface can allow more damage than an unwanted player joining a world.
Recommended steps
- Identify the ports and protocols used by your selected game server. Allow only the player traffic that is required, and keep administration services restricted to the intended management network or approved users.
- Use strong unique credentials for the hosting panel and any remote administration tool. Enable multifactor authentication where the panel supports it, and give moderators only the permissions needed for their role.
- Use the game's supported allowlist or access controls when the community is private. Test with a normal player account as well as an administrator so that you can confirm the intended restrictions actually work.
- Keep server software and extensions maintained. Obtain packages from the relevant project or publisher, review permissions and configuration, and test new plugins away from the only production world.
- Review access after a moderator leaves or a credential is exposed. Revoke the affected access, rotate related secrets and inspect recent changes. Keep a separate backup in case world or configuration recovery is required.
Do not post console passwords, panel links containing tokens or unredacted configuration files in public support channels. If you need a technician to investigate, ask for the approved temporary access method and remove that access after the work is complete.
