How to Make a Project Zomboid Server Private (Password, Whitelist, and Hidden Listing)

To make a Project Zomboid server private, stop it, set a join Password in the active server configuration, save the file, and restart the server. For account-level control, set Open=false and whitelist each intended player. Set Public=false separately if you also want to remove the server from the public browser. A hidden listing is not authentication, so use a password or whitelist even when the server is not advertised.

Playing with friends? Godlike.Host runs hosted Project Zomboid servers from 10 data-center locations, with free DDoS protection.

Choose the privacy level you actually need

Project Zomboid has three separate controls that are often treated as if they did the same job. They do not. A password controls knowledge of a shared join credential, Open controls whether admission is open or whitelist-based, and Public controls whether the server is advertised in the public browser.

#	Preview	Product	Price
1		Zombicide 2nd Edition Strategy Board Game | Cooperative Game for Teens and Adults | Zombie Board...		Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

For a small group, a password is usually the simplest arrangement. If the player list must be controlled per account, use Open=false and add each intended account to the whitelist. You can combine that with a password. If you want the server absent from public listings, set Public=false as an additional privacy measure.

Before changing the configuration

Identify how your server runs

An in-game Host session and a dedicated server expose similar privacy concepts but not necessarily the same menus or file names. A Host session is practical for a small group and normally exists only while the host is playing. A dedicated server runs as a separate process and keeps its configuration and world data in a server profile. Managed hosts add a control panel and may place the active file in a provider-specific directory.

#1 Best Overall

Zombicide 2nd Edition Strategy Board Game | Cooperative Game for Teens and Adults | Zombie Board Game | Ages 14+ | 1-6 Players | Avg. Playtime 1 Hour | Made by CMON

• UPDATED CLASSIC: Dive into Zombicide: 2nd Edition, the thrilling update to the classic zombie-slaying game. Experience enhanced gameplay and new challenges in the zombie apocalypse.
• COOPERATIVE SURVIVAL: Join forces as Survivors in a world overrun by zombies. Work together to navigate through missions, complete objectives, and fight for survival.
• ADRENALINE-POWERED ACTION: With each zombie kill, increase your Adrenaline Points. Gain strength and skills but attract more zombies with your actions – a double-edged sword.
• INTENSE MISSIONS: Face a series of challenging missions, each requiring strategic planning, teamwork, and bravery. Can you accomplish your objectives while fending off the undead?
• SURVIVE OR BECOME ZOMBIE PREY: The stakes are high - will you emerge as a triumphant survivor or fall victim to the relentless zombie hordes?

Buy on Amazon

Builds and hosting setups can change labels and paths. Use the configuration belonging to the active world and current build rather than copying a path from an unrelated installation.

Stop the server cleanly

Shut down the server process before editing. A running process can overwrite your changes when it saves its current state, and an edit made to a stopped server is easier to verify. On a hosted service, use the panel’s stop control and wait until the status shows that the process has stopped.

Keep a rollback copy

Before editing, make a copy of the current configuration or record its existing values. This gives you a way to restore the previous admission behavior if a typo prevents the server from starting or if a setting has a different meaning in your build.

Find the active server configuration

Self-hosted dedicated server

A commonly generated dedicated-server file is servertest.ini in the server profile directory. The exact profile location depends on how the server was installed and which profile name it uses. If several worlds or profiles exist, confirm that the file name matches the world you intend to protect.

Managed hosting panel

A provider’s file manager may expose a path such as cache/Server/Zomboid.ini instead of servertest.ini. The important distinction is not the filename; it is whether the file is the one loaded by the running instance. Editing a backup, template, or another world profile will have no effect on the server your friends are joining.

How to verify that you have the right file

• Check the profile or world name shown in the server panel against the profile represented by the file.
• Confirm that the file’s modification time changes after you save it.
• Restart the same server instance whose configuration you edited.
• If a setting appears ignored, stop and check for duplicate profiles before changing more values.

Set a password-only private server

Password protection is the least complicated option when everyone in the group may use the same invitation credential. It does not give you a separate approval list, so anyone who receives the password can attempt to join until you rotate it.

1. Stop the server completely.
2. Open the active configuration file in a text editor or the hosting panel’s editor.
3. Locate the Password field and replace its value with a strong, non-obvious join password.
4. Save the file without changing unrelated settings.
5. Restart the server process.
6. Give the password only to the players you intend to invite.

The join password is distinct from any RCON or administration credential. Do not reuse an administrative secret as the player-facing password, and do not assume that changing an RCON credential changes admission to the game.

Use a password that can be rotated

A shared password is convenient, but it is also shareable. If it appears in a public chat, is sent to the wrong person, or a former player still knows it, stop the server, replace the Password value, save, and restart again. Tell current players about the new value through a private channel rather than posting it where it can be copied by unintended readers.

Require approved accounts with a whitelist

Use whitelist admission when you need to decide who may join based on individual accounts rather than possession of one shared secret.

1. Stop the server and open the active configuration.
2. Set Open=false.
3. Use the server’s whitelist controls to add every intended player’s account.
4. Save the configuration and restart the server.
5. Have an approved player connect with the account that was added, not a different account on the same computer.

With Open=false, an account that is not on the whitelist should be refused even if the person knows the server address. The exact whitelist-editing command or panel control can vary by build and host, so use the control exposed by your active installation. If you also leave a Password configured, players must still satisfy the password requirement in addition to the admission mode used by that build.

Be cautious with automatic whitelist options

The configuration reference includes AutoCreateUserInWhiteList, but its behavior is tied to open-server workflows and can differ by build. Do not enable it as a shortcut without checking how the current build handles new accounts. If your objective is strict approval, add accounts deliberately and verify the result with a non-whitelisted test account.

Hide the server from public discovery

Set Public=false when you do not want the instance advertised in the public server browser. This reduces casual discovery but does not authenticate players. Someone who already has the address, port, or a saved favorite may still attempt a connection, so pair the hidden listing with a password or whitelist.

1. Stop the server.
2. Change Public to false in the active profile.
3. Save and restart.
4. Give intended players the direct connection details or have them use an existing favorite entry, as appropriate for your setup.

If nobody can find the server after this change, that may be the expected result rather than a failure. Discovery and admission are separate decisions.

Password versus whitelist: which setup fits?

For a stable group whose members you trust, password-only access is usually enough. For a recurring server with changing membership, a whitelist gives you a cleaner way to remove one account without distributing a new credential to everyone else.

Hosted-server workflow

Managed hosts generally reduce file-system work but do not change the order of operations.

1. Open the provider’s control panel and select the correct Project Zomboid instance.
2. Stop the instance using the panel’s stop action.
3. Open the file manager or configuration editor.
4. Locate the active server profile. A hosted setup may show a file such as cache/Server/Zomboid.ini.
5. Edit Password, Open, and, if needed, Public.
6. Save the file.
7. Start or restart the server from the panel.
8. Test admission with an intended account and an incorrect-password or non-whitelisted account.

The restart is required for the new password and related admission settings to take effect. If the panel has separate “save” and “restart” controls, completing only the save step is not enough.

Testing the privacy settings

Test both sides of the rule instead of relying on the editor showing the desired value.

1. From an intended player account, connect using the current server details and password, if one is configured.
2. From an account that is not on the whitelist, attempt to connect when Open=false. It should be rejected.
3. Try an incorrect password on a permitted account. It should not pass a password gate.
4. Check the public browser when Public=false. The server should not be advertised there, although existing favorites or direct connection methods may still work.
5. If a test gives an unexpected result, stop the server before changing another value and verify the active profile and restart sequence.

Troubleshoot the common failure modes

Friends can see the server but cannot join

• Confirm that they are entering the current value of Password, including capitalization and punctuation.
• Check whether Open=false requires their account to be on the whitelist.
• Verify that the account name added to the whitelist is the one they are using.
• Confirm that the process was restarted after the edit.
• Make sure you edited the active world profile rather than a backup or another server’s file.

The password seems to be ignored

• Check for duplicate configuration files and confirm which profile the server launches.
• Stop the process, edit the active file, save it, and restart instead of changing a live file.
• Verify that the password was entered in the server’s Password field, not in an RCON or administration field.
• Test with a deliberately incorrect password so you can distinguish a real password check from a client that reused a saved credential.

Nobody can discover the server

If Public=false, absence from the browser is expected. Give intended players the direct connection details or have them use a saved favorite. If the server should be visible, change Public back to true, save, and restart.

One approved player still fails while others connect

Compare the account actually used by that player with the account entry on the whitelist. A computer can have more than one game account, and adding one account does not automatically approve another. Also check for spelling differences and confirm that the whitelist change was saved before the restart.

Players on different networks cannot connect

Privacy settings do not configure Internet reachability. Port forwarding and firewall rules depend on the host network, operating system, provider, and active Project Zomboid build. Verify those networking requirements against current official or host documentation. Do not weaken the password or whitelist to compensate for a connectivity problem.

Maintain a private server safely

• Keep a copy of the working configuration before each substantial change.
• Rotate the shared password whenever it has been exposed or a player should lose access.
• Review the whitelist when the group changes, removing accounts that should no longer connect.
• Record whether the server is intentionally listed or hidden so a later configuration change does not surprise players.
• After an update, recheck the meaning and availability of privacy fields because menus, file names, and behavior can vary by build.
• When troubleshooting, change one setting at a time and restart before judging the result.

A practical private-server configuration

A typical friends-only configuration uses a strong Password, leaves Open=true when shared-credential access is acceptable, and sets Public=false when the group does not want browser discovery. A more controlled community configuration sets Open=false, adds each approved account to the whitelist, optionally keeps a password as an additional gate, and sets Public=false if direct invitations are preferred. In both cases, the sequence is the same: stop, edit the active profile, save, restart, and test with both an intended and an unintended account.

Quick Recap

Bestseller No. 1

Zombicide 2nd Edition Strategy Board Game | Cooperative Game for Teens and Adults | Zombie Board Game | Ages 14+ | 1-6 Players | Avg. Playtime 1 Hour | Made by CMON

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Game Hostingprivate serverProject Zomboidserver administrationwhitelist