DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PC×
Skip to content
VGSources
Blog

How to Secure a Conan Exiles Server

A practical guide to securing a Conan Exiles server: configure the right files, expose only required ports, lock down RCON, enable BattlEye, and maintain reliable backups and moderation.
Length11 min Posted Quest giverVGSources Team
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A secure Conan Exiles server uses separate, strong credentials; exposes only the network services players actually need; keeps RCON private; enables BattlEye; and follows a repeatable patching, backup, and moderation routine. Configure those controls before publishing the server address, then test the exact ports and join flow from outside your network.

What “secure” means for a Conan Exiles server

Server security is more than hiding an IP address. You are protecting three things at once: access to the game world, administrative control, and the availability and integrity of the world data.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Access control: only the people you intend should be able to join. A private password is the first barrier for a community or friends-only server.
  • Administrative control: the admin credential can grant powerful in-game permissions. It must not be reused for the server password, RCON, or the operating-system account that runs the server.
  • Network exposure: the Internet should reach only the game, query, and optional services you have deliberately enabled. Administrative interfaces should remain private.
  • Integrity and availability: updates, mods, backups, logs, and a recovery plan reduce the damage from a bad update, a compromised account, griefing, or a damaged save.

Funcom’s dedicated-server documentation identifies the services and configuration files; the firewall design below is a conservative allow-listing approach based on that service list, not a complete firewall policy published by Funcom.

Prepare the server before opening any ports

Install from the official distribution

Use the official dedicated-server distribution and keep the installation under an account with only the permissions required to run it. Funcom’s SteamCMD setup guidance uses app ID 443030. Record the installation location, the account that owns the files, and the command used to start the server so another administrator can reproduce the setup.

#1 Best Overall
Sale
Gaoye Blue Light Blocking Glasses
  • BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
  • EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
  • COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
  • LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
  • WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.

Do not run unrelated services from the same process account. If the host is shared, isolate the game server from web panels, databases, and other applications so a compromise in one service does not automatically grant access to the others.

Back up configuration and world data

Before the first public launch, make a rollback-capable copy of the configuration and world data. Keep at least one backup separate from the live machine. A useful routine is:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Stop the server cleanly during a maintenance window.
  2. Copy the world data, configuration files, and the current mod list or mod configuration.
  3. Label the backup with the date, server build, and mod state.
  4. Verify that the archive can be read and periodically perform a test restore to a separate location.

A backup that has never been restored is only an assumption. Retain several known-good points so you can return to the state before a bad mod update or an exploit.

Separate operating-system access

Use a unique operating-system account and a strong credential or key appropriate to your host. Limit remote administration to trusted addresses or a VPN when your network permits it. The game’s admin password is not a substitute for host security, and an RCON credential should never be reused for either account.

Set distinct, strong passwords

Server password

Funcom documents ServerName and ServerPassword in Engine.ini. Set a long, randomly generated server password before advertising the server. Send it through a private channel rather than posting it with the public server address. If the community grows beyond the people who should have access, rotate the password instead of trying to identify every old copy.

Admin password

Set AdminPassword in ServerSettings.ini. This credential is used with the in-game Make Me Admin flow, so anyone who obtains it may gain administrative powers. Use a different random value from the server password, store it in a password manager, and share it only with the smallest possible group of moderators. Remove access promptly when a moderator leaves.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)
  • WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
  • AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
  • PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
  • ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
  • COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed

RCON credential

RCON is a separate administrative service. If you enable it, give it its own long, unique credential and rotate it whenever an administrator or hosting arrangement changes. Never place the RCON password in public documentation, screenshots, chat messages, or a repository containing configuration files.

Password strength does not compensate for public exposure. A credential that is never reachable from the Internet is safer than one protected only by complexity, which is why RCON should normally remain disabled or restricted to a private management network.

Open only the required network services

Funcom’s documented defaults are listed below. Treat them as starting values, not a requirement to expose every service on every server.

Service Default port and protocol When it is needed Security treatment
Game traffic UDP 7777 Player connections to the game server. Allow only to the server host and monitor unexpected traffic.
Browser pinger UDP 7778 Server-browser discovery; hardcoded as the game port plus one. Open only if you want browser discovery and your chosen platform requires it.
PC server query UDP 27015 by default Querying server status and listing information on PC. Use the configured query port; do not assume the default if you changed it.
RCON TCP 25575 by default Remote administration. Keep off the public Internet. Prefer disabled, localhost, VPN, or a tightly scoped trusted-address rule.
Mod download Opened on demand PC and Epic Games Store clients when your setup requires a mod-download service. Expose only when needed. Steam clients use the Steam Workshop API instead.

Funcom notes that you might need a firewall exception for the server to appear in the Steam server browser. That does not mean opening an unrestricted range of ports. Create narrow inbound rules for the services you actually use, and keep the operating system’s default-deny posture for everything else.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Apply the same decision at every firewall layer

Check the host firewall, the router or cloud security group, and any provider-level firewall. A port-forward that is open on the router but blocked on the host will fail; a host rule that is open while the cloud security group is unrestricted can expose more than intended. Document the protocol, port, source scope, and reason for each rule.

If you change the game port, query port, map, mods, or hosting provider, review the rules again. The browser pinger relationship to the game port is especially easy to overlook: it remains the game port plus one.

Rank #3
Sale
LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men
  • Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
  • Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
  • Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
  • ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
  • Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)

Configure the server files and startup command

Put each setting in the documented file

  1. Open Engine.ini and set ServerName and ServerPassword.
  2. Open ServerSettings.ini and set AdminPassword.
  3. Save a backup of both files before changing additional settings.
  4. Restart the server and verify that the name, password prompt, and administrative flow behave as expected.

Keep credentials out of public launch scripts and screen-sharing sessions. If the host uses a control panel, confirm which file the panel writes; manually editing a different copy can make a secure change appear to have no effect.

Use command-line parameters deliberately

Funcom’s setup blog documents parameters including -log, -MaxPlayers, and QueryPort. Use -log while validating a new installation or diagnosing joins, but store logs where only trusted administrators can read them because operational output may reveal addresses, player names, or configuration details. If you set QueryPort, update the corresponding firewall rule and browser expectations together.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Keep a versioned copy of the complete startup command. An undocumented change made through a hosting panel can silently alter the query port, player cap, or logging behavior and leave the firewall out of sync.

Enable BattlEye and build a moderation process

Turn on BattlEye where supported

BattlEye is a server setting in the Funcom technical manual, which says: “Funcom highly recommends this to avoid cheaters from affecting your gameplay.” Enable it where your platform and server build support it, and tell players that the server uses anti-cheat protection. Anti-cheat is one layer: it does not replace passwords, patching, access control, or human moderation.

Define what moderators can do

Write a short policy before the first dispute. Specify who can use administrative powers, what evidence moderators should retain, which behavior leads to a warning or removal, and who can approve a permanent ban. Keep the policy and the current moderator list in a private, access-controlled location.

Use the least privilege that works. A moderator who only needs to remove a disruptive player should not automatically receive every administrative capability. Review the list after staff changes and rotate the admin credential when access has been shared more widely than intended.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack
  • Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
  • Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
  • 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
  • Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
  • USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC

Report abuse on official servers

For abuse or exploits on official servers, Funcom directs players to the in-game Request Help feature or the Help Center’s Report a Player route. Community-hosted servers should also publish their own contact method so players know whether an issue belongs with the server team or Funcom.

Keep RCON private

RCON is convenient for scripted restarts and remote moderation, but it is an administrative control plane, not a player-facing service. The default is TCP 25575; the port may be changed, but changing it alone is not a security boundary.

  • Disable RCON when you do not need it.
  • If it is required, bind or filter it to localhost, a VPN, or a small list of trusted administrator addresses.
  • Do not create a broad “anywhere” inbound rule for TCP 25575.
  • Use a unique credential and rotate it after staff or host changes.
  • Record RCON actions and review them when investigating an incident.

If your provider exposes RCON through a web panel, secure the panel account and its multi-factor authentication separately. A protected panel does not justify opening the raw RCON port to the Internet.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Patch the server and mods safely

Use maintenance windows

Announce restarts, stop the server cleanly, take a fresh backup, apply the server update, and then update mods in a controlled order. Keep a record of the previous build and mod versions so you can roll back if players cannot connect or the world behaves unexpectedly.

Test after every change

After starting the updated server, check the log, join with a test account, verify the password prompt, confirm that administrators can use the intended Make Me Admin flow, and test a normal player session. Confirm that the server appears in the expected browser and that the query service reports the right name and player capacity.

Mods expand the attack and failure surface. Install only mods you trust, keep their source and version documented, remove abandoned or unnecessary mods, and avoid updating several unrelated components at once. If a mod update breaks the world, stop rather than repeatedly restarting over a damaged save; restore the last verified backup and investigate in a separate test copy.

Best Value
Sale
HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs
  • Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
  • Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
  • Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
  • Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
  • Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Plan capacity without treating old figures as guarantees

Funcom’s 2017 setup guidance gave example planning tiers of 10, 35, and 70 players with example RAM figures of 8 GB, 8 GB, and 12 GB respectively. Those are historical planning figures, not a current performance guarantee. Actual requirements depend on the current server build, operating system, mods, map activity, save size, and concurrent workload.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Example tier in Funcom’s 2017 guidance Example RAM figure How to use it today
10 players 8 GB Historical reference only; validate against your current build and workload.
35 players 8 GB Historical reference only; monitor CPU, memory, save time, and player latency.
70 players 12 GB Historical reference only; leave headroom for mods and concurrent activity.

Security and capacity are linked. A host that is permanently out of memory may fail to save cleanly or restart reliably, while an overloaded machine makes incident response harder. Measure your own server during peak activity and reserve headroom for updates, logs, and backups.

Self-hosting versus managed hosting

Both models can be secure. The important difference is who performs and verifies each control.

Decision area Self-hosted server Managed server
Patching and backups You schedule updates, retain backups, and test restores. The host may automate them; verify frequency, retention, and whether you can download and restore your data.
Firewall and RCON You control port rules, source restrictions, and private administration. Confirm that the panel supports narrow rules, private RCON, and credential rotation.
Mods You control installation, ordering, testing, and rollback. Check how mods are uploaded, updated, locked to versions, and recovered after a failed update.
Capacity You choose CPU, RAM, storage, and network headroom. Check actual allocations and upgrade limits rather than relying on a player-count label.
Restart automation You build scheduled restarts and maintenance notifications. Verify restart controls, warning messages, and behavior after a crash.
Logs and support You retain logs and investigate incidents yourself. Confirm log access, retention, export options, and support response times.
Network protection You are responsible for host, router, and upstream protection. Ask what DDoS mitigation and geographic network coverage actually apply to your plan.
Region and latency You select the physical location and network route. Choose a region close to the player base and test latency before committing.
Total cost Includes hardware, electricity, bandwidth, storage, and your administration time. Includes the monthly fee plus any charges for backups, extra slots, storage, or support.

Do not assume that “managed” means secure by default. Ask who can access RCON, whether backups are independent of the live host, how quickly security updates are applied, and how you retrieve data if you leave.

Monitor, document, and rehearse recovery

Keep useful logs

Retain server and administrative logs long enough to investigate disputes and unauthorized access. Restrict log access because logs can contain player identifiers and operational details. Record the time zone used by the host so events from the game, firewall, and operating system can be correlated.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Watch for warning signs

  • Unexpected changes to ServerPassword, AdminPassword, startup parameters, or mod files.
  • Repeated failed administrative connections or traffic to the RCON port from unfamiliar addresses.
  • Sudden player-count, CPU, memory, storage, or bandwidth spikes.
  • World rollbacks, missing structures, unexplained bans, or commands no moderator acknowledges.
  • A server that disappears from the browser after a port or provider change.

Use an incident sequence

  1. Remove public access by stopping the server or tightening the firewall.
  2. Preserve logs and the most recent known-good backup before deleting or overwriting files.
  3. Rotate the server, admin, RCON, and relevant host credentials from a clean device.
  4. Review administrative actions, firewall events, recent updates, and mod changes.
  5. Restore to a verified point, patch the underlying cause, and test privately.
  6. Reopen access with the minimum required rules and tell players what changed.

If you suspect the host operating system itself is compromised, do not trust a cleanup performed only from that machine. Build a clean replacement or involve the hosting provider, then restore data that you have verified.

Pre-launch security checklist

  • Dedicated-server software came from the official distribution, and the installation and startup command are documented.
  • ServerName and ServerPassword are set in Engine.ini.
  • AdminPassword is set in ServerSettings.ini and differs from every other credential.
  • Backups of configuration and world data exist off the live host, and a restore has been tested.
  • Only the game, query, browser-pinger, and optional mod-download services actually required by your platform are exposed.
  • RCON is disabled or limited to a private management path; its credential is unique.
  • BattlEye is enabled where supported.
  • Firewall rules exist at every relevant layer and identify protocol, port, source scope, and owner.
  • Patch, mod-update, restart, logging, and moderation procedures are written down.
  • Players know the server password through a controlled channel and know how to report problems.

Recheck this list after changing ports, maps, mods, player limits, or hosting providers. Security is maintained by the routine you repeat after every change, not by a one-time configuration.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More quests from Patch Notes

  1. How to Set Up a RedM (RDR2) Server in 2026: License Key, txAdmin and server.cfg, Step by StepBlog11min
  2. Best RedM (RDR2) Server Hosting in 2026: Comparing Four Hosts on Slots, Memory and PriceBlog10min
  3. How to Host a Mindustry Server in 2026: server-release.jar, Port 6567 and the Commands That MatterBlog7min
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.