Project Zomboid Whitelist: Setup, Commands, Settings

Q: How do I add someone to my Project Zomboid whitelist?

Set Open=false in the server .ini, then run adduser "username" "password" in the console, or /adduser in game as admin, and send the player their login.

Q: How do I remove a player from the whitelist?

Run removeuserfromwhitelist "username". On an Open=false server they can no longer log in. Use banuser if they broke the rules.

Q: Where is the Project Zomboid whitelist stored?

In the server database in the Zomboid/db folder, in a file named after your server. Include that folder in your backups.

A Project Zomboid whitelist means only accounts you created can log in. Set Open=false in your server's .ini file (servertest.ini on a default install), restart, and create each player with adduser "username" "password". Remove someone with removeuserfromwhitelist "username".

If you only want to keep strangers out with a password, our guide on how to make a Project Zomboid server private compares passwords, hidden servers and whitelists. This page goes deeper into running the whitelist itself: the settings that change how it behaves, the commands, one-life servers and the habits that keep a community list tidy.

How the Project Zomboid whitelist works

In Project Zomboid every player on a server has an account: a username and a password stored by the server, in its database in the Zomboid/db folder (the file takes the name of your server). The question is who creates those accounts.

Open=true (open server): anyone who reaches the server can join and get an account.
Open=false (whitelist): the PZwiki server settings page says clients cannot join without already having an account, so administrators must create the username and password combinations by hand.

That is the whole whitelist: an Open=false server plus the accounts you make. Because the list lives in the database and not in the .ini, back up the db folder along with your save.

Project Zomboid whitelist setup, step by step

Make a backup. On TheGameHosting, open your server in the panel, go to Backups and create one.
Make sure you have an admin account. On first start the server asks for an admin password and creates the admin user; if you need another admin, see Project Zomboid admin commands.
Stop the server from Console.
In Files, open Zomboid/Server/servertest.ini (or the file named after your server) and set Open=false.
Save and start the server.
In Console, create each player: adduser "name" "password". In game, an admin types the same with a slash: /adduser "name" "password".
Send each player their username and password privately, together with the IP and port from the panel.
Test it: try to join with a name that is not on the list. The server should refuse it.

servertest.ini

Open=false
DropOffWhiteListAfterDeath=false
MaxAccountsPerUser=1

Server console

adduser "Ana" "first-password-1"
adduser "Leo" "first-password-2"
removeuserfromwhitelist "OldPlayer"

Use quotes around names and passwords, as the PZwiki examples do. Pick a different first password for each player and ask them not to reuse one from another site.

Whitelist commands and what to expect

Command	What it does	Notes
`adduser "user" "pass"`	Adds a new user to a whitelisted server	The main way to add players
`removeuserfromwhitelist "user"`	Removes a user from the whitelist	They can no longer log in on an `Open=false` server
`addusertowhitelist user`	Whitelists a connected user who joined with a password	Listed in the PZwiki FAQ; the Build 41.66 changelog says this command was disabled as a duplicate
`addalltowhitelist`	Whitelists every connected user who joined with a password	Same caveat as above; test it on your build before you rely on it
`banuser "user"`	Bans a user; `-ip` bans the IP too	Use for rule breakers, not for people who simply left

The two addto commands are useful when you move an open server to a whitelist, because players who already joined do not need new accounts. Because the wiki's changelog lists them as disabled in Build 41.66, check that they answer on your build; if not, use adduser for each player.

Settings that change how the whitelist behaves

Three options in the server .ini work together with the whitelist. Our servertest.ini guide covers the rest of the file.

Setting	Default	What it does
`Open`	`true`	`false` turns the server into a whitelist
`DropOffWhiteListAfterDeath`	`false`	Removes a player's account from the whitelist after death, so they cannot make a new character on an `Open=false` server
`MaxAccountsPerUser`	`0` (no limit)	Limits how many accounts one Steam user can create on the server

One-life servers with DropOffWhiteListAfterDeath

Turn on DropOffWhiteListAfterDeath on a whitelisted server and death becomes final: when a character dies, that account leaves the whitelist and the player cannot come back until an admin re-adds them. Communities use it for hardcore seasons or roleplay where a death should matter.

Tell players clearly before you turn it on. It is a big change to how the server feels.
Decide your rule for comebacks: a waiting time, a new character story, or a new season.
The PZwiki notes fixes for this option over the years, including one in Build 42.15.0 for it not working. Test it with a spare account after every major update.

Running a whitelist for a community

Small groups can add five friends and forget about it. Bigger communities need a routine:

Use one place for applications, such as a Discord channel or form, with the username each player wants.
Let moderators help. Give trusted staff a lower access level such as moderator, and check which commands that level can use on your build before you count on it.
Keep a simple list of who has which account and when they joined.
Every month, remove accounts of people who left with removeuserfromwhitelist.
Keep backups on a schedule. The whitelist lives in the server database, so a restore also brings back the list from that day.

If a whitelisted player still cannot get in, check the spelling of the username first, then the build and mods: Project Zomboid can't connect to server goes through the usual causes.

A private Project Zomboid server that is always on

A whitelist is only useful if the server is up when your group wants to play. A Project Zomboid server from TheGameHosting runs 24/7, players join with the IP and port from the panel without opening ports, and you manage everything from the browser: servertest.ini in Files, adduser in Console, daily Backups through Schedules, and Users to give your moderators panel access with only the permissions they need. It runs on AMD Ryzen 9950X / 7950X3D CPUs up to 5.7 GHz with DDR5 and NVMe, with DDoS protection included.

On our plans Project Zomboid needs at least 8 GB of RAM, from $6.96 per month, with unlimited slots. See the plans and pricing and use the code FULL2026 for 15% off for life.

FAQ

How do I add someone to my Project Zomboid whitelist?

Set Open=false in the server .ini, then run adduser "username" "password" in the console, or /adduser in game as admin, and send the player their login.

How do I remove a player from the whitelist?

Run removeuserfromwhitelist "username". On an Open=false server they can no longer log in. Use banuser if they broke the rules.

Where is the Project Zomboid whitelist stored?

In the server database in the Zomboid/db folder, in a file named after your server. Include that folder in your backups.

What does DropOffWhiteListAfterDeath do?

It removes a player's account from the whitelist when their character dies, so on an Open=false server they cannot make a new character until an admin adds them again.

Hosting for these games

Project Zomboid server hostingPrivate servers, 24/7 uptime

Written by TheGameHosting Team, the people who run our servers in Dallas and Amsterdam and answer your tickets.

All posts