Restricting Access with a Server Whitelist
How to enable and manage the Factorio server whitelist to restrict which players can join your server.
Overview
The Factorio server whitelist restricts joins to a named list of Factorio account usernames. When enabled, anyone not on the list is rejected at the connection attempt, regardless of whether they have the correct password.
Enabling the Whitelist
Set the following in server-settings.json:
{
"create_group_whitelist": true
}
With this enabled, the server will read factorio/config/server-whitelist.json at startup and enforce it for all connection attempts.
server-whitelist.json Format
["Player1", "Player2", "Player3"]
This is a JSON array of Factorio.com account usernames. Usernames are case-sensitive and must match the Factorio account exactly. An empty array ([]) combined with create_group_whitelist: true means nobody can join — ensure you add yourself before enabling.
Adding and Removing Players
Edit server-whitelist.json directly via the panel Files tab. The file can be reloaded without a full restart using the in-game command:
/whitelist reload
Or manage the list in-game with:
/whitelist add PlayerName
/whitelist remove PlayerName
/whitelist get
/whitelist clear
These changes are reflected in the file immediately.
Important: Admins Are Not Auto-Exempt
Admins are not automatically exempt from the whitelist. If create_group_whitelist: true, every admin must also appear in server-whitelist.json or they will be denied entry. This is a common oversight — add all admins to both server-adminlist.json and server-whitelist.json.
Whitelist vs. Password
The whitelist and game_password are independent mechanisms:
- Whitelist: Only named accounts can join.
- Password: Any player with the password can join (subject to verification settings).
For maximum access control, use both:
{
"game_password": "sharedpassword",
"create_group_whitelist": true
}
Disabling the Whitelist
Set create_group_whitelist: false in server-settings.json and restart. The server-whitelist.json file is preserved but not enforced.
Use Cases
- Private friend group: Whitelist all players, disable public visibility, no password needed.
- Semi-private: No whitelist, but use a password for light gatekeeping.
- Community server with banning: Skip the whitelist, rely on bans in
server-banlist.json.