What RCON is and how to use it safely

RCON, short for remote console, lets a program send commands to your Minecraft server from outside. Server management tools, Discord bots and web dashboards use it. It is useful, and it is also one of the easiest ways to hand your server to a stranger if it is set up carelessly. Here is what it does and how to use it without exposing yourself.

What RCON does

When RCON is on, the server opens an extra port and waits for connections that supply a password. Anyone who connects with the right password can run any console command, including op, stop and whitelist. In other words, the RCON password is as powerful as full operator access.

Most people do not need it. If you only manage your server through your hosting panel's console, you can leave RCON off. Turn it on only when a tool you actually use requires it.

Turn it on

In server.properties, set:

enable-rcon=true
rcon.port=25575
rcon.password=a-long-random-password-here
  • rcon.port defaults to 25575, and it is separate from the game port.
  • rcon.password has no default. If it is empty, RCON does not start, which is a safety feature. Set a long random one.
  • Restart the server for the change to apply.

The risks

RCON has three weaknesses you should know:

  1. It is not encrypted. The password and commands travel as plain text. Anyone watching the network between you and the server can read them.
  2. Passwords can be guessed. If the RCON port is reachable from the internet, bots will try common passwords continuously.
  3. There is little logging of who did what. Commands run through RCON appear as coming from the console.

Using it safely

Keep the port private. The best protection is for the RCON port not to be reachable from the internet at all. If the tool that uses RCON runs on the same machine, connect to 127.0.0.1. On a VPS, block the port with a firewall as described in Set up a firewall on your VPS with UFW. On a managed host, do not publish the RCON port unless you must, and ask your host how to keep it internal.

Use a long random password. Not a word, not a variation of your server name. Treat it like a bank password, and store it in a password manager.

Do not reuse it. It should be unique, not the same as your hosting login.

Use a tunnel if you must connect from far away. An encrypted tunnel, such as SSH port forwarding, protects the traffic. See Connect to your VPS over SSH for the basics of SSH.

Limit who has it. Share it with as few tools and people as possible, and change it if a person with access leaves your team.

Safer alternatives

Often you do not need RCON at all:

  • The panel console lets you run commands in your browser. See Using the server console.
  • Plugins can accept commands from Discord with their own permission checks, which is safer than a raw password.
  • A proper API or dashboard plugin may offer logins, roles and audit logs that RCON lacks.

If you think the password leaked

  1. Change rcon.password immediately and restart.
  2. Check your operator list and whitelist for people you do not recognise.
  3. Review recent changes. Look in the logs, and check for new plugins you did not add. How to read your server logs shows where to look.
  4. Restore a clean backup if something has been altered. See Creating and restoring backups.

Treat an exposed RCON port the way you would treat an exposed password: change it first, investigate second.

Still stuck? Open a ticket on Discord - run /ticket in any channel, pick a department, and include your Server ID or Invoice ID so we can jump straight in.