Project Zomboid Dedicated Server Whitelist (Build 42.19)
Build 42.19 · closed-server account setup, password roles, access removal, and recovery
A private dedicated server has two separate controls: a shared join password, and a whitelist of account usernames.
Setting Open=false closes automatic account creation. You must create each username first with /adduser before players can log in.
Open to false and restart.
Server INI
Zomboid/Server/<servername>.ini
Holds Password, Open, and other network options. Default name is often servertest.
User database
Zomboid/db/<servername>.db
Stores whitelist accounts (usernames, passwords, roles, Steam IDs). Back this up before edits.
Main command
/adduser "username" "password"
Creates a whitelist account on a closed server. Prefer setting a password even if the help text lists it as optional.
Three different “passwords”
These are not interchangeable:
| What | Where | What it does |
|---|---|---|
| Server Password | Password= in <servername>.ini |
Shared secret every client must know to join. Ignored when hosting via the Host button. |
| Account password | Created with /adduser or changed with /setpassword |
Login password for that username on a whitelist (closed) server. |
| Admin / RCON secrets | Admin account password and optional RCONPassword |
Staff access and remote console—not the same as the shared join password. |
Steam still authenticates the client. Whitelist usernames are the server’s own account layer on top of that connection. In-game character first/last names are cosmetic; admin commands use the account username.
Step 1 — Optional shared join password
Stop the server. Open Zomboid/Server/<servername>.ini (example: servertest.ini).
Set a shared password if you want an extra gate even for open servers:
# Clients must know this password to join the server.
# (Ignored when hosting a server via the Host button)
Password=YourSharedJoinPassword
Save the file and restart so the option is loaded. This alone does not create a per-user whitelist. For broader option layout, see the server settings guide and hosting guide.
Password and Open in your current .ini after restart.Step 2 — Back up the user database
Before closing the server or mass-editing accounts, copy the entire Zomboid user-data folder if you can.
At minimum, copy Zomboid/db/<servername>.db (and any .db-journal beside it) while the server is stopped.
Step 3 — Create accounts with /adduser
Use the dedicated server console (or an in-game admin chat command) to create each username before you rely on a closed whitelist:
/adduser "alice" "her-password"
/adduser "bob" "his-password"
- Console vs chat: In the server console, commands are entered as admin input. In-game, use a leading
/while connected with an admin account. - Quotes: Always quote usernames or passwords that contain spaces.
- Password optional: Prefer setting one so accounts are protected, even if help text lists the password argument as optional.
- Who can run it: Only staff with permission to manage network users (admin-level accounts normally can).
- Change later:
/setpassword "alice" "new-password"updates an existing account password.
/adduser → set Open=false → restart → test a non-admin account login → only then tell players the join details.
Step 4 — Enable the closed whitelist (Open=false)
With accounts ready, stop the server and set:
# Clients may join without already having an account in the whitelist.
# If set to false, administrators must manually create username/password combos.
Open=false
Restart the server. Unknown usernames that were never created with /adduser should fail login.
The server can also log a reminder to create accounts with /adduser first.
Open=false servers until staff re-adds the user. Leave this off unless that hardcore rule is intentional.
Step 5 — Remove users
To revoke access for a username:
/removeuserfromwhitelist "alice"
This command is available in Build 42.19 and requires staff permission to manage the whitelist.
Removing a user deletes that account entry—confirm the username first with /players or your staff process.
Commands that are not the main path in Build 42.19
| Command | Build 42.19 status | Use instead |
|---|---|---|
/adduser "user" "pass" |
Active — primary way to create whitelist accounts | Main path for closed servers |
/setpassword "user" "pass" |
Active — change account password | When a player forgets their password |
/removeuserfromwhitelist "user" |
Active — remove whitelist entry | Revoke access |
/addusertowhitelist "user" |
Disabled in Build 42.19 | Create or re-create with /adduser |
/addalltowhitelist |
Disabled in Build 42.19 | Add players one by one with /adduser |
Older guides often tell you to run /addusertowhitelist for any username. That is not the working main flow on current 42.19 builds.
Even when those commands existed, they targeted users who were already connected with a password—not arbitrary offline IDs.
Locked out? Recovery
- Stop the server.
- Restore
Zomboid/db/<servername>.dbfrom your backup if you deleted the wrong accounts. - Or temporarily set
Open=truein the INI, restart, log in as admin, create missing users with/adduser, then setOpen=falseagain and restart. - If only the shared join password is wrong, fix
Password=in the INI—not the account password table. - If you lost the admin account entirely, use your host panel’s documented admin reset, the server console with a known admin path, or a clean DB restore. Prefer official/host tools over hand-editing password rows.
/setpassword, console adduser, or a known-good DB backup.
Quick checklist
- Stop server → back up
Zomboid/db/<servername>.db. - Set optional shared
Password=inZomboid/Server/<servername>.ini. - Start server →
/adduser "name" "pass"for every allowed player (and staff). - Stop server → set
Open=false→ start server. - Test a non-admin login; only then publish connection details.
- Remove access with
/removeuserfromwhitelist "name"when needed. - Ignore
/addusertowhitelistand/addalltowhitelistas primary steps on Build 42.19.
Related Articles
