Free tools Windows power users keep installed
One-click scans. No signup required.
Secure a Conan Exiles server by separating player and administrator credentials, exposing only the game services you actually use, keeping RCON off the public internet, enabling BattlEye, and treating updates, backups and moderation as part of security. Funcom’s dedicated-server configuration places ServerName and ServerPassword in Engine.ini, while AdminPassword belongs in ServerSettings.ini.
Godlike.Host offers hosted Conan Exiles servers with its own game panel, SFTP access and free DDoS protection, if you would rather not host it yourself.
The safest deployment is an allow-list: publish the game and query ports needed by your platform, leave optional services closed, restrict administration to a private network or VPN, and keep a tested backup of the world and configuration before every change.
As an Amazon Associate I earn from qualifying purchases.
What a secure Conan Exiles server protects
A Conan Exiles server has several different trust boundaries. Players need access to the game service, server browsers need a query response, administrators may need console or RCON access, and the host operating system must remain private. Treating all of these as one open service creates avoidable risk.
Your goals are to prevent four common failures:
- Unauthorized joining: strangers discover or enter a private server because the server password is weak, shared, or absent.
- Administrative takeover: an exposed or reused admin/RCON credential lets someone change settings, ban players, or damage the world.
- Cheating and abuse: modified clients, exploits, harassment, or unmoderated activity disrupt play.
- Operational loss: a bad mod update, patch, configuration edit, or hardware failure destroys world data or leaves the server running an old vulnerable build.
Security is therefore a process rather than a single setting: install from the official distribution, configure credentials, restrict network exposure, enable anti-cheat, patch deliberately, retain logs and backups, and define how incidents will be handled.
#1 Best Overall
- The Adventures of Conan is an asymmetrical dice game of exploration, sorcery and glorious combat set in the Hyborian age.
- Let your blade be sharp and your heart unyielding, for in the fray, only the bold claim victory!
- Each role brings new challenges and routes to victory
- All of the characters, adventures, and art are drawn from the Dark Horse Comics line of Conan titles, including Conan, Conan the Cimmerian, Conan the Slayer and more.
Install the dedicated server and create a recovery point
Use the official distribution
Funcom’s setup guidance uses SteamCMD and dedicated-server app ID 443030. Install the server under a dedicated operating-system account or service context rather than using your everyday administrator account. Limit write permissions on the server directory to the account that runs the service and the small group of people who maintain it.
Keep the executable, configuration, mods, logs and world data in clearly identified directories. Do not place passwords in public documentation, startup scripts that are readable by every local user, screenshots, or chat messages.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteBack up before the first public launch
Create an offline or separately stored copy of the world and configuration before inviting players. A useful baseline includes the current world save, Engine.ini, ServerSettings.ini, mod lists and load order, launch parameters, and any ban or admin lists. Record when the copy was made and where it can be restored.
Test restoration on a second directory or temporary instance. A backup that has never been opened is only an assumption. Keep at least one copy that the running server cannot overwrite, so ransomware, a corrupted save, or an accidental deletion cannot remove every copy.
Use maintenance windows
Announce restarts before patching or changing mods. Stop the service cleanly, copy the relevant files, apply one logical change, start the server, and verify that the world loads and the expected player and admin settings remain in effect. This creates a rollback point and makes a failed change easy to identify.
Rank #2
- The treacherous waters of the Black Coast are filled with reavers and corsairs, as well as the infamous she-devil of the sea, Bêlit - the Queen of the Black Coast.
- New Adventures make these hazardous Encounters even more beneficial for Conan's foes.
- Delve deeper into the mighty Kingdoms with the Nemedian Chronicles expansion
- These expansions are contained in one box. The front cover features Queen of the Black Coast art and the back features Nemedian Chronicles art.
Set separate, strong passwords
Player password
Set ServerName and ServerPassword in Engine.ini, as documented by Funcom. A private community should use a long, randomly generated password shared only through its chosen member channel. Do not use the server name, clan name, map name, a common word, or a password used on another service.
If you run a public server, a password may not be appropriate for normal access, but administrative credentials still must be private. Reconsider whether a password-free server is compatible with your moderation capacity; an open listing attracts more unsolicited traffic and requires faster response to abuse.
Administrator password
Set AdminPassword in ServerSettings.ini. In game, an authorized operator uses the Make Me Admin flow with this value. Use a different secret from the player password, RCON credential, operating-system password, hosting-panel password and personal accounts.
Store the admin password in a password manager. Give it only to people who actually need administrator powers, and change it immediately when an administrator leaves the team or the value may have been exposed. Do not paste it into public support tickets or stream overlays.
Credential rules that prevent easy compromise
- Use randomly generated secrets of substantial length; uniqueness matters more than a clever phrase reused elsewhere.
- Never put credentials in a mod, batch file committed to source control, public paste, or shared screenshot.
- Rotate credentials after suspected disclosure, staff turnover, a compromised host account, or an unexplained administrative action.
- Keep a written list of who can administer the server and when access was granted or revoked.
Open only the ports your installation needs
Funcom documents these default services. Your firewall and router should allow only the entries required by your chosen platform and configuration.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Service | Protocol | Default port | Purpose | Exposure guidance |
|---|---|---|---|---|
| Game | UDP | 7777 | Player connections and gameplay traffic | Forward and allow it when hosting players from outside your network. |
| Browser pinger | UDP | 7778 | Server-browser discovery; hardcoded as game port plus one | Allow it when you want browser visibility; keep the rule tied to the server host. |
| PC server query | UDP | 27015 | Query responses used by server listings and tools | Open only if your platform and listing require it. |
| RCON | TCP | 25575 | Remote administration | Do not expose publicly; disable it when unused or restrict it to trusted addresses/VPN. |
| Mod download | Platform-dependent | Opened on demand | Direct mod downloads for PC/Epic Games Store clients | Open only when your client mix requires it. Steam clients use the Steam Workshop API. |
Funcom notes that a firewall exception may be needed for the server to appear in the Steam server browser. This does not mean opening every inbound port. Create narrow rules for the actual executable and ports, and make sure the rule applies to the correct network profile. Remove temporary rules after testing.
Router and host-firewall procedure
- Give the server a stable internal address, either a fixed lease on the router or a correctly configured static address.
- Forward only the game, browser-pinger and query ports you use from the internet-facing interface to that address. Add a mod-download port only when required.
- Create matching inbound rules on the host firewall for the server process and selected ports. Leave unrelated inbound traffic denied.
- Keep operating-system administration, file sharing and remote-desktop services off the public interface. Use a private management network or VPN instead.
- From an external network, verify that players can connect and the listing works. Then review the router and host rules and remove anything opened solely for diagnosis.
If you change the game port, query port, map, platform mix, hosting provider or mod arrangement, recheck both forwarding and firewall rules. A stale rule can make the server unreachable; an overly broad replacement can expose services you never intended to publish.
Keep RCON private or disabled
RCON is a separate TCP service and is documented on port 25575 by default. It is not required for ordinary gameplay. The safest setting is to leave it disabled unless a specific administration tool needs it.
When remote administration is necessary, put RCON behind a VPN, private management network, or a firewall allow-list containing only trusted administrator addresses. Do not rely on an obscure port number as protection. Use a unique RCON credential, separate from both server passwords, and rotate it after staff changes or any suspected exposure.
Recommended Free Tools
Log every RCON connection and administrative action where your tooling supports it. Investigate unexpected connections, repeated authentication failures, or commands issued outside a maintenance window. If you cannot restrict source addresses, disable RCON and use local console administration instead.
Enable BattlEye and build a moderation process
Anti-cheat setting
BattlEye is a server setting in the Conan Exiles technical manual. Funcom says it “highly recommends this to avoid cheaters from affecting your gameplay.” Enable it where your server and client combination supports it, then communicate the requirement to players so they understand why a protected client is necessary.
Anti-cheat reduces one class of abuse; it does not replace password controls, patching, logs or human moderation. Keep a record of kicks, bans, reports and the evidence behind a permanent action. Apply the same rules to regular players, friends and administrators.
Handling official-server abuse reports
For abuse or exploits on Funcom’s official servers, the published route is the in-game Request Help feature or the Help Center option labeled Report a Player. A private server operator should provide a comparable path: identify the moderator on duty, tell players where to report, preserve relevant timestamps and logs, and explain how urgent threats are escalated.
Moderation controls
- Define prohibited behavior before launch: cheating, exploit use, harassment, impersonation, hate speech, theft or griefing, as applicable to your community.
- Use temporary sanctions while facts are being checked and reserve permanent bans for documented violations.
- Keep administrator powers limited. A moderator who only needs to remove a disruptive player should not automatically receive every configuration privilege.
- Back up ban lists and moderation notes, but protect them as personal or sensitive information.
Patch the server, operating system and mods deliberately
Security updates can change behavior, dependencies or save compatibility. Subscribe to the official game and platform announcements, but schedule installation rather than applying an update while players are online.
- Announce the maintenance window and expected downtime.
- Stop the server cleanly and make a fresh world/configuration backup.
- Update the dedicated-server files and operating system packages through your normal trusted channels.
- Update mods one at a time when possible, recording versions and load order.
- Start the server with logging enabled; Funcom’s setup guidance documents the
-logparameter along with-MaxPlayersandQueryPort. - Check startup logs, connect with a test account, confirm BattlEye, verify administrator access, and inspect the world before reopening the server.
If a patch or mod causes crashes, missing assets or abnormal gameplay, stop the service, restore the last known-good files and world backup, and document the change that was reversed. Do not repeatedly restart a failing instance against the only copy of a save.
Best Value
Plan capacity without treating old figures as guarantees
Capacity problems can become security problems: an overloaded host may drop players, fail to write logs, or leave administrators unable to respond. Funcom’s 2017 setup guidance gave illustrative tiers of 10, 35 and 70 players, with example memory figures of 8 GB, 8 GB and 12 GB respectively.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →| Example player tier | Funcom guidance (2017) | How to interpret it today |
|---|---|---|
| 10 players | 8 GB RAM | Historical planning example, not a current guarantee. |
| 35 players | 8 GB RAM | Validate against current server build, operating system and mods. |
| 70 players | 12 GB RAM | Expect workload-dependent CPU, storage and memory testing before promising this capacity. |
These numbers are not a performance certification. Measure CPU headroom, memory use, storage latency and network behavior with your actual map, mods and peak concurrency. Leave enough capacity for the operating system, monitoring, backups and update tasks; a server that runs at its limit has little room to handle a sudden player spike or a diagnostic tool.
Choose between self-hosting and managed hosting
Self-hosting gives you direct control but makes you responsible for every security boundary. Managed hosting can reduce routine work, yet the provider’s controls and support quality become part of your threat model. Compare the following before moving a live world:
| Decision area | Self-hosting | Managed hosting questions |
|---|---|---|
| Patching and backups | You schedule, verify and retain them. | Who applies updates, how often are backups made, how long are they retained, and can you download and restore them? |
| Firewall and RCON | You define port forwards, allow-lists and VPN access. | Can you close RCON, restrict source addresses and inspect the actual firewall rules? |
| Mods | You control installation, order, testing and rollback. | Can you pin versions, stage updates and recover from a broken mod? |
| Capacity | You select CPU, RAM, storage and network headroom. | What resources are dedicated, and what happens when usage reaches the plan limit? |
| Operations | You build restart automation, monitoring and log retention. | Are scheduled restarts, log access and alerts included? |
| Network resilience | You provide your own upstream protection and region. | What DDoS mitigation, geographic regions and latency targets are actually included? |
| Support and cost | Your staff time is the hidden cost. | Check total monthly cost, support response times, export options and cancellation terms rather than relying on a headline price. |
Regardless of host, retain an independent backup and keep administrator credentials under your control. A provider account should not be the only way to recover the world.
Troubleshoot common security and connectivity failures
The server is not visible in the Steam browser
- Confirm the server process is running and listening on the intended game and query ports.
- Check that UDP 7777, UDP 7778 and the configured query port are forwarded to the correct internal address.
- Verify host-firewall exceptions for the server executable and selected ports. Funcom specifically notes that an exception may be needed for browser visibility.
- Check that the query port was not changed by a launch parameter such as
QueryPortwithout updating the firewall and router. - Test from outside the hosting network; a local test can succeed even when the public forwarding rule is wrong.
Strangers are joining a private server
Change ServerPassword, confirm the edited file is the one the running instance loads, and restart cleanly. Remove any public post containing the old value. Check that the server is not being started with a second configuration directory and that administrator or RCON credentials were not reused as the player password.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
An administrator credential may be exposed
Immediately rotate the admin, RCON and any related operating-system credentials. Disable RCON if it is not essential, review logs and ban or reverse unauthorized changes, then restore the world from a known-good backup if necessary. Do not continue normal play until you know which account was compromised.
A mod update breaks startup
Stop restarting the failing service. Preserve logs, identify the last changed mod or server build, restore the previous files and backup, and test the update in an isolated copy. Reopen the public instance only after a successful startup and a test connection.
Cheating or harassment continues
Confirm BattlEye is enabled, collect timestamps and player identifiers, apply your published moderation process, and preserve evidence. For official servers, use the in-game Request Help or Help Center Report a Player route; for a private server, enforce your own documented sanctions consistently.
Quick Recap
Operational checklist
- Dedicated-server files come from the official distribution and run under a restricted service account.
- World, configuration, mod and moderation data have a tested, separate backup.
ServerPasswordandAdminPasswordare long, unique and stored privately.- RCON is disabled or reachable only through a VPN/private allow-list, with a separate rotated credential.
- Only UDP 7777, UDP 7778, the required query port, and any genuinely needed mod-download service are exposed.
- BattlEye is enabled where supported.
- Updates, mod changes and restarts occur in announced maintenance windows with rollback points.
- Logs are retained long enough to investigate unexpected connections and administrative actions.
- Moderation rules, reporting channels and administrator responsibilities are written down.
- Firewall and router rules are rechecked after every port, map, mod, platform or hosting change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
