Use Centralized Banning on Rust

Centralized banning lets several Rust servers share one ban list that lives on a web server you run. It is a feature of the Rust dedicated server itself, described on Facepunch's wiki, so it needs no plugin. It also needs something we can't give you: Facepunch doesn't supply the ban API, so you must host your own. Checked against Facepunch's Centralized Banning wiki page and Rust build 2635, October 2026.

What it does

When a player connects, the server asks your web server whether that player is banned. The request is a plain GET to the address you set, with the player's 64-bit SteamID added on the end, for example GET /api/rustBans/{steamID64}. Your API answers:

• 404 means the player is not banned and can join.
• A 2xx reply with a JSON body means they are banned or muted. The body carries steamId, reason, expiryDate and isMute.
• reason is shown to the player when they try to connect.
• expiryDate is a Unix timestamp. A value of zero or less means the ban is permanent.
• isMute set to true mutes the player instead of banning them.

It only blocks people from entering. A player who is already on the server stays there, so use kick for them.

Point your server at the API

You need the three server.bans... convars. Type each one into the Console tab:

server.bansServerEndpoint "https://domain.tld/api/rustBans/"

Swap in your own address. The other two are optional:

• server.bansServerFailureMode decides what happens when the check itself fails, for instance when your API is down. The default is 0, which lets the player in and logs the error. 1 turns them away, logs the error, and shows them the failure.
• server.bansServerTimeout is how long the server waits for your API, in seconds. The default is five.

To see all three with the game's own descriptions and current values, type find bansserver in the Console. On a new server the endpoint is empty.

Facepunch says none of the three needs a restart, and changing the endpoint doesn't kick anyone already connected.

Keep the settings after a restart

A command typed into the Console lives in memory only. To keep it, put the same lines in server/rust/cfg/server.cfg and restart. A new server doesn't have that file yet, so open the File Manager, go to server/rust/cfg, and Upload a plain text file named server.cfg if it isn't there. Rust server.cfg and admin commands explains the file and how restarts treat it. Rust reads server.cfg at boot: we put server.bansservertimeout 7 in it on a test server and the game reported 7 after a restart.

Which failure mode to pick

• Choose 0 if you would rather have a ban list that sometimes lets someone through than a server that nobody can join while your API is down.
• Choose 1 if keeping banned players out matters more than uptime. Every connecting player is turned away while the API is unreachable.

Facepunch also advises making your API quicker rather than raising server.bansServerTimeout, since a slow answer makes every player wait longer to join.

Check it works

Ban a spare test account through your API, then try to join with it. The refusal should show the reason text you set. Errors from the system are written to the Console, so read it if a player gets in who shouldn't.