What is RCON and how do you use it?
RCON is a remote console protocol that lets a tool outside your server send admin commands to it. Here is what it is for, which games use it, and why you should treat its password like a key to the server.
6 min read · Updated Oct 21, 2026 · By GuavaHost Team
The idea in one paragraph
RCON stands for Remote Console. It is a small network protocol (an agreed way for two programs to talk) that a game server can switch on so that another program somewhere else can log in with a password and send the same commands you would type into the server's own console. Whatever the command prints comes back over the same connection. That is the whole thing: a password-protected pipe for admin commands.
It exists because a game server often runs with nobody sitting in front of it. RCON lets a Discord bot, a web dashboard, a phone app or a script talk to the server without anyone opening a console at all.
RCON versus the panel console
These two get mixed up constantly, so it is worth being clear.
| The panel Console | RCON | |
|---|---|---|
| Who you are | Signed in to your GuavaHost account | Anyone with the RCON password |
| What you see | The full live log, including startup and crashes | Only the reply to the command you sent |
| What it talks to | The server process directly | A network port the game listens on |
| Needs a password | No, your account login covers it | Yes, the RCON password |
| Best for | Watching, debugging, one-off commands | Automation and outside tools |
For almost everything you do by hand, the panel console is the better tool, because it shows the whole log rather than one reply. Using the console command box covers how to send commands there, and reading server logs and crash reports covers what the log is telling you when something breaks.
RCON earns its place when a program needs to do the talking.
What people actually use it for
- Discord bots. A bot that lets your staff whitelist a player, kick someone or announce a wipe from a Discord channel talks to the server over RCON.
- Web dashboards and phone apps. Rust's companion app and most third-party server dashboards are RCON clients underneath.
- Scheduled scripts. Running a save and a broadcast before a restart, or a nightly cleanup command.
- Multi-server tooling. One tool managing a handful of servers, each with its own RCON connection.
If what you want is an automatic restart or a repeated console command, you do not need RCON at all. The panel's Scheduled tasks page can send a console command on a timer; see scheduling automatic restarts.
Which games support it
RCON is not a universal standard, and the games that have it do not all implement it the same way.
| Game | RCON support | Notes |
|---|---|---|
| Minecraft Java | Yes, built in | Off by default. Enabled with enable-rcon, rcon.port and rcon.password in server.properties. |
| Rust | Yes | Rust uses a WebSocket-based RCON rather than the classic Source protocol, which is why some generic tools do not work with it. |
| Counter-Strike 2 | Yes, Source-style | rcon_password in the server config. |
| Palworld | Yes | Switched on in the settings file, alongside an optional REST API. |
| Project Zomboid | Yes | Enabled in the server config with its own port and password. |
| ARK | Yes | Needs RCON enabled in the game's settings. |
| Valheim, Enshrouded, Terraria, Don't Starve Together | No classic RCON | Admin work happens in the game, in the config, or in the panel console instead. |
Ports and option names change between game updates, so treat your own config file and console output as the truth rather than any list, including this one. For the ports each game uses by default, see TCP vs UDP game server ports. RCON almost always runs over TCP even when the game itself uses UDP.
The security part, which matters more than the setup
Think about what RCON is: a port, open to the internet, that accepts your admin password and then runs server commands. That is full control of the server for anyone who gets the password.
The classic Source RCON protocol sends its password without encryption. Rust's WebSocket version can run over a secure connection, but plenty of setups do not. So the realistic threats are a weak password being guessed, or a password you pasted somewhere public being reused.
What to do about it:
- Leave RCON off unless something needs it. Every game we host ships with it off. An unused feature cannot be attacked.
- Use a long random password, unique to RCON. Never the password on your GuavaHost account and never one you use anywhere else.
- Never paste it anywhere. This is the big one. People post a console log or a config file in a Discord channel when they are asking for help, and the RCON password is sitting in it. Blank it out first.
- Treat a leaked password as a compromised server. Change it, restart, and check your Activity log and in-game logs for commands you did not run.
- Prefer account-based access for humans. If a friend needs to run commands, give them their own panel access with only the permissions they need rather than handing over the RCON password. Adding sub-users and staff permissions done properly cover that properly.
For your own account, securing your panel account and two-step login are the equivalent habits.
Setting it up on a hosted server, in outline
The exact steps depend on the game, and every game's config guide in this help centre covers its own file. The shape is always the same:
- Switch RCON on in the game's config file, using the Files tab or SFTP. See editing configs in the file manager.
- Set a strong RCON password in that same file.
- Give the RCON service a port. On a hosted server you cannot pick any number you like: it has to be a port allocated to your server, which you manage yourself under Ports & network. See adding and managing server ports.
- Restart the server so the new settings load.
- Point your tool at your server's IP, that RCON port and the password.
If step 3 is skipped, the usual symptom is the server logging that it could not bind the RCON port, because the number you chose belongs to someone else on that machine.
Common questions
Do I need RCON to run my server?
No. Everything RCON can do, you can do in the panel console, and repeated jobs can run from the panel scheduled tasks page. RCON is only worth enabling when an outside program, such as a Discord bot or a dashboard, needs to send commands for you.
Is RCON safe to leave enabled?
It is acceptable with a long unique password and a tool you trust, but it is one more door into your server. If nothing is using it right now, turn it off. If something is, make sure the password has never been pasted into a channel, a screenshot or a public config.
Why does my RCON tool work with Minecraft but not with Rust?
Rust uses a WebSocket-based RCON instead of the older Source protocol that most generic tools speak. Pick a tool that specifically lists Rust support, and check that you are using the RCON port rather than the game port.
Can I use RCON while the server is offline?
No. RCON is the game server listening on a port, so if the process is not running there is nothing to connect to. Start the server from the panel first, and if it will not start, the console log is where the reason will be.
Still stuck? Jump into our Discord at discord.gg/GuavaHost and the team will help you out.
- rcon
- console
- admin
- security
- networking
Still need help? Our team is online 24/7 to answer questions.