How to set up WARDOGS RCON (and why a shared password is a problem)

What RCON is in WARDOGS, how the approved hosts expose it, what the single password can do, and how to give every admin their own login instead.

Updated 16 September 2026

What RCON is in WARDOGS

A WARDOGS dedicated server is rented from one of the approved hosts — there are no public server files to run yourself — and every one of them exposes the same remote-control interface: an HTTP API on the server, protected by a single password set in the server’s configuration. Send that password as the bearer token and the server does what you ask.

“What you ask” is the whole list. The same token that reads the scoreboard also kicks, bans, changes the map, ends the match, and replaces the entire configuration file. There are no scopes, no per-user keys, and no record on the server of who sent which command.

Why one shared password is a problem

• Everyone with it can do everything. A moderator you trust to kick can also rewrite the map rotation, or end a tournament match by accident.
• Nobody knows who did what. When a player asks why they were banned, the answer is “somebody with the password”.
• Leaving is expensive. When an admin steps down, the only way to remove their access is to change the password and hand the new one to everybody else.
• It ends up in the wrong places. Discord DMs, a pinned message, a screenshot of a settings page.

Setting it up with per-admin logins

BulletMeta holds the password and does the talking. Each admin signs in with their own Steam account, gets a role, and every action they take is written to an audit log before it is sent. The setup takes a few minutes:

1. Get the address and RCON password from your host’s control panel. It is the same value the server’s configuration file lists under its RCON section.
2. Create a community on BulletMeta. Sign in with Steam, open the dashboard, and the onboarding walks you through it. The free base needs no payment method.
3. Register the server with its address and password. Choose admin features for a server you want to control from the browser, or stats onlyfor one you only want on the leaderboards — stats-only servers are free and never use a plan slot.
4. Invite your admins by name or with a one-time link, and give each a role. The built-in ladder is owner, admin and moderator; you can edit those or add your own.
5. Open the live page. The roster, the match clock, kick, message, switch team, ban, broadcast and change map are all there, and the configuration editor is one click away.

Where the password goes

Into a secret manager, and nowhere else. It is not in the database, it is never sent to a browser, and the admins using the console cannot read it back — the configuration editor masks the RCON password and any token in the file view, and the audit log records which keys changed, never their values. BulletMeta’s own service dials out to your server over the game’s HTTP interface; nothing is installed on the box, and if you rotate the password you update it in one place.

When the server cannot be reached

A command is not sent until its audit row exists, and when the server does not answer, that same row is marked failed. In the console that reads as a difference between “an admin authorised this” and “the server did it”, which a shared password can never show you. The live page also tells you whether the box is up but refusing commands, or simply not responding.

Before you rely on it

• Keep the host panel’s own access for emergencies — BulletMeta is in front of RCON, not a replacement for your hosting account.
• Turn on two-factor for the community if more than a couple of people will hold the ban permission.
• Read the roles guide before inviting anybody: the default moderator can kick and ban, and you may want a narrower role for new helpers.