Community owner manual

Running your community

Written for the person who owns the community — the one who pays for it, connects the server, and decides who gets to ban people. Read it once from the top; after that use the contents on the left.

1   Getting set up

1. Sign in with SteamThere is no separate password. Your Steam account is your login, so there is nothing to remember and nothing to leak.
2. Create your communityOn the welcome page. This starts your 14-day free trial automatically — no payment details, and nothing charges you when it ends.
3. Add your serverSettings → Edit Servers. Name, the ip:port your players connect to, and your RCON password.
4. Install the resourceCovered in the next section. Takes about five minutes.

2   Connecting your game server

There is nothing to configure by hand. The download is generated for your server, with your community ID and address already inside it.

1. Support → DownloadsClick Download next to the server you added.
2. Extract into resources/The staff folder goes in whole.
3. Add one line to server.cfg

   ensure staff
   ensure screenshot-basic   # only if you want screenshots

   Use a built copy of screenshot-basic — the one that ships with most FiveM server builds is ideal. The GitHub source needs yarn and webpack to build before FiveM can load it. If yours is missing or unbuilt, the panel says so in your server console rather than failing silently.

4. RestartYour players appear under Servers within about 30 seconds.

If the download hands you a config.json instead of a zip, your host simply cannot build archives. Put that file into the staff folder yourself; nothing else changes.

What the detections do, and what they deliberately do not

The resource watches for explosion floods, entity spam and client-triggered server events, and reports them to the player’s record. Two of those also cancel the action. It is worth knowing where the lines are drawn, because the wrong setting here makes the panel accuse ordinary players.

Explosions are limited by rate, not by type. Twelve per player per ten seconds; over that they are cancelled and reported. Rate is the honest test — a script blowing up the map is abnormal by volume whatever it uses, and nobody reaches that many by playing. explosion_types_blocked lets you block particular types outright and ships empty, because which explosions are legitimate depends on your server. A rocket is griefing on one server and a gang war on another. Take particular care before listing petrol pumps, barrels, planes, trains, fireworks or snowballs: all six happen in normal play, so blocking them stops the world reacting the way players expect and marks them as griefers for shooting a petrol station.

Entity spam only reports; it does not cancel. GTA streams its pedestrians and traffic in through whichever player is nearest, so those count as entities that player created — loading into the world creates hundreds in seconds, and even mid-session, ordinary driving along a busy road produces a burst of the same vehicle model repeating, because GTA's population system leans on one vehicle type per road class rather than varying it. The limit is therefore high (150 per ten seconds), nothing is counted for the first minute after someone connects, and cancelling is off. You can turn cancelling on with entity_cancel while dealing with an active spawner, but leave it off the rest of the time: the entities being blocked are mostly scenery, so it deletes the world around your players rather than stopping an attack.

Protected events report; they do not block. List the server events in your framework that a client should never fire — usually the ones handing out money, items or jobs — and anyone who fires one is named on their record. It cannot stop the event: cancelling only works where the code that raised the event checks for it, which the game engine does for connections, entities, explosions and chat, but no framework does for its own events. So the money is still granted; what you get is the person who did it. protected_events_kick adds a kick, off by default, and it stops the next attempt rather than the first one.

All of these live under detections in config.json, and the whole thing switches off with "enabled": false.

The numbers you can change

Every one of these is optional. Leave it out and the default below applies, which is what the download ships with. The two _cancel settings are the only ones that change what a player experiences rather than only what you are told about.

A limit is per player, per ten seconds, and a given kind of report is only written once per player per minute — so a burst leaves one entry explaining itself, not hundreds burying everything else on their record.

Every detection on a player's page has Mark reviewed and Delete, both needing Delete Records. Reviewing keeps the entry but marks it looked at, so a busy queue shows what still needs attention. Delete removes it outright — for a false positive, since the checks above are deliberately generous and still catch the odd legitimate player.

Optional: refusing connections before they start

Two settings in config.json are left empty on purpose, because switching them on will refuse real players as well as the ones you are aiming at. Both are checked on the server, before the player is admitted, so neither can be defeated by a modified client.

"connection": {
    "require_identifiers": ["steam"],
    "blocked_names": ["admin", "moderator"]
}

require_identifiers is the one worth understanding. A ban recorded against a Steam ID does nothing to someone who closes Steam before reconnecting — there is no Steam ID left to match. Listing steam here refuses that connection instead of letting it through. You can also list discord, fivem, license2, xbl or live. There is no point listing license: it is always present, and it is what every ban is matched on regardless.

blocked_names refuses anyone whose name contains one of these words, ignoring case. It is a substring match because impersonation is nearly always [admin] or admin  rather than exactly admin.

Both write a refusal to the player’s record, so you can see who was turned away and why rather than only finding it in the console.

The messages those refusals show sit in the same block and can be reworded:

Every setting in config.json

The download fills in the first four for you. You should not need to touch them unless something moves.

ip_address and debug appear in the file but the resource never reads them — they do nothing. They are left in place so an existing config is not invalidated; changing them has no effect either way.

3   Staff and permissions

Go to Settings → Edit Staff. The dropdown is searchable and offers everyone who has played on your servers, most recent first and shown by their in-game name — usually exactly who you are looking for. Existing panel accounts are listed separately.

Pick a person, choose a rank, submit. They do not need to visit the panel first. Adding them creates their account straight away; the first time they sign in with Steam their real name fills itself in and their rank is already waiting. People already on your staff are hidden from the list, so it only ever offers people you can actually add.

Deciding what each rank may do

Settings → Panel Settings has a grid of permissions down the side and your ranks across the top. Tick what each rank may do; every permission carries a line explaining what it actually covers.

The first column is your owner rank, and it always holds every permission. Its boxes are fixed on purpose. There is no hidden override behind the scenes — the panel checks the rank's own list and nothing else — so an owner rank missing Edit Panel would mean nobody could ever open this page again, and only a change made directly in the database would undo it.

Someone can be staff in several communities at once. Adding them here has no effect on their rank anywhere else, and every warning, kick, ban and note they issue records their name against it.

Staff cannot moderate each other

Two rules are enforced regardless of what you tick, because they are about conduct rather than capability:

The owner rank is the first rank in your permissions list. It is exempt from the second rule but not the first.

4   Moderating players

What the dashboard tells you

Two things worth glancing at before anything else.

Staff online lists which of your staff are in game right now, with their rank and which server. Useful for the question you actually ask at 9pm on a Saturday — is anybody covering, or is the server unstaffed?

Moderation, last 14 days plots warnings, kicks and bans per day, with the last seven days compared against the seven before. The comparison is the part that matters — a count on its own tells you nothing, but “up 40% on last week” is the difference between a quiet fortnight and something starting.

It also shows how many new players arrived this week, which is the other half of the same picture: more moderation with more players is normal, more moderation with the same players is not.

Recent Players — who just left

Player Data → Recent Players List shows everyone who has disconnected recently, newest first, with their playtime and trust score. It is the page for the question that comes up straight after something happens in game: somebody did it and immediately dropped, and you need their name before you can do anything about it.

A name appears within a second or two of them leaving, and the page keeps itself current on its own — you do not need to refresh it. Anyone still in game is left out, so the list is only people who have actually gone.

How far back it looks is Recent Players Time Limit in Panel Settings, ten minutes by default, and the heading on the page says which. If your server stops reporting in — it crashed, or the staff resource is not running — the panel cannot tell who is still on it, and everyone it last saw will drift into this list. That is the honest answer rather than a wrong one.

The player profile

Reach a player from Servers (whoever is online right now) or Player Data → Player List (everyone ever seen). Their profile carries these tabs:

Freeze

Under Other Actions, behind its own Freeze permission (off by default). Holds a player in place so they cannot run off mid-conversation — the thing you actually want when someone is being questioned but has done nothing worth kicking them for yet.

It survives a reconnect. Dropping out to escape it no longer works: the freeze lives on their record, and the game server re-applies it the moment they load back in. If they are offline when you freeze them, it takes effect next time they join.

They see a notice on screen for as long as the freeze lasts, showing your reason and the time remaining. It stays put through death and respawn, so somebody cannot miss it and be left wondering why they are stuck. It was previously a chat message, which scrolls away and is invisible to anyone playing with chat hidden — if you froze someone before and they seemed confused rather than co-operative, that is why. Re-download the resource to get the notice.

They are also made invincible while held — a frozen player cannot run away, so without that they are a stationary target while you are talking to them.

Every freeze and release is listed on the Freeze Log page under Server Data, with the staff member's name. Search a name there to read only theirs — freezing holds someone in place, so it is worth being able to see who uses it and how often.

Trust score rises with playtime and commends, and falls with warnings, kicks and bans. Treat it as a rough reputation signal, not a verdict.

Wherever it appears — the player list, a profile, the server page, the dashboard, and on the labels in game — it is drawn the same way: the number, and four small bars filled to its band.

The bar count says the same thing the colour does on purpose. Printed in black and white, or read by somebody who cannot separate red from green — roughly one man in twelve — the band is still legible.

Reading identifiers

Steam IDs, licences, hardware IDs and Discord IDs are set in a monospaced typeface with figures that line up in a column, because the only thing you ever do with them is compare one against another, character by character. In an ordinary typeface a 1 and a 7, or an 8 and a B, are close enough to slide past.

A Discord ID is an eighteen-digit number that tells you nothing on sight. If you have set up a Discord bot in Panel Settings, the panel looks up the name behind it and shows that alongside — preferring their nickname in your Discord server over their global name, because the nickname is what your staff will recognise. Names are refreshed once a day, and only for players who are actually online. Without a bot configured the row simply does not appear.

On a player’s profile the long ones do not wrap. Breaking a licence across two lines gives you two ragged rows of near-identical characters, which is the worst possible way to show the one thing those fields are for — so they scroll sideways instead and fade at the right-hand edge to show there is more. Hover to see the whole value, or click once to select all of it: copying takes the entire identifier, including the part off screen.

Donator vehicles

Further down the same player profile. Grant a vehicle and it belongs to that player: it is tied to their account, not to a character, so a character wipe, a new character or a fresh start does not take away something they paid you for. Enter the spawn name (adder), and optionally a display name and a plate.

The player picks from a menu. They type /mycars in game and see everything they own plus anything a friend has shared with them, and spawn any of it. Shared vehicles are marked with the name of the friend who shared it.

Owners share with friends themselves, from their own record page — up to five people per vehicle, added and removed whenever they like. You do not have to do it for them, and a friend can drive it whether or not the owner is online.

Revoking a grant is immediate and also removes every share on it.

Unlike the freeze above, this check runs on your game server rather than on the player's computer, so a modified game client cannot skip it. A cheater can decline to tell the server they got in; they cannot hide from the server that they are sitting in the driver seat, which is re-checked every few seconds regardless.

Selling perks through your own Tebex store

A different thing from paying for the panel itself — this is your own Tebex store, selling to your own players. In Settings → Panel Settings, map a package you sell to something it should grant, and a purchase delivers itself without you touching the panel.

Setting it up: paste the webhook URL Settings shows you into your Tebex store's webhook configuration, along with the secret from that same page. Add one row per package, with the Tebex package ID from that package's URL on your store, and what it should grant.

A purchase is matched against the players on record for your community by that username, case-insensitively. If nobody matches, or more than one player shares the name, it is not guessed at — it lands in the Donator Queue (in the sidebar, same permission as granting a vehicle manually) with the reason, for a staff member to type in the right license and resolve it, or dismiss it.

Bulk actions

On Servers, select several online players with the checkboxes and act on all of them at once. Each needs its own permission, off by default, in Settings → Panel Settings:

Give these to a rank deliberately. Bulk item-give in particular is an easy way for a compromised staff account to duplicate items at scale — that is why it is a separate permission from giving a single player something, not bundled in with the moderation tabs above.

Server permissions — FiveM's ACE system

Under Settings → Server Permissions, owner only. This manages FiveM's own permission system, the one most scripts check with IsPlayerAceAllowed, so you can grant and revoke without editing server.cfg and restarting to find out whether it worked.

Set it up once. Add this line to your server.cfg, after your existing permission lines so these win:

exec @staff/panel_permissions.cfg

If your console says No such config file: @staff/panel_permissions.cfg, you are on a resource downloaded before 16 August 2026. The file now ships with it, empty, precisely so that line works from the first boot — re-download from Support → Downloads. Nothing is broken in the meantime; the server logs the line and carries on.

The in-game staff menu

Press F6 in game. A narrow panel opens in the corner: a title, a counter showing where you are in the current list, one list at a time, and a line at the bottom describing whatever is highlighted. The key is rebindable in the game’s own settings under FiveM — nothing to edit in a config file.

It is driven with the keyboard, not the mouse. There is no cursor, which is deliberate: taking the mouse also hands the game your camera, so aiming at a button swung your view. With keyboard control the game receives nothing at all while the menu is open and your character stands still.

Lists open inside each other rather than side by side: Staff → Players → that player → the actions your rank allows. Each list remembers where you were, so backing out of a player puts you back on that player and not at the top.

Choosing a player does nothing to them. It opens their list of actions; nothing is sent until you select one.

The menu sits in a corner on purpose rather than filling the screen. You are looking at the world while you use it, and the in-world labels draw into that same world — anything centred covers the thing you are trying to look at.

The ESP overlay — seeing who is where

Switched on from the ESP section of the F6 menu. It draws a label over every connected player and every vehicle in the world: the player’s name and server id, or the vehicle’s model and plate. Labels fade with distance and stop being drawn past it — players at 300 metres, vehicles at 120.

The labels stay when you close the menu. That is the point of them: you switch them on, close the panel, and then look around. They keep drawing until you switch them off again, and that choice is remembered until you do.

A player’s label is coloured by their trust score, using the same four bands the player list and the website use, so one colour means one thing everywhere:

To act on somebody you can see but cannot find in a list: open the menu, choose Free look under Tools, and the cursor is released so you can aim the camera. Point at a label — it turns amber — and press G. That target’s actions open on their own, including Ghost if your rank has it, which puts you next to them invisible and non-colliding so you can watch what is actually happening before deciding anything.

The Audit Log — yours alone

Under Servers in the sidebar, and only the owner rank can open it. No other rank sees the link, and none can reach the data behind it either — showing it to the people it covers would defeat the point of keeping it.

It records the actions that change what your panel holds, or who is allowed to change it:

Each entry is written out in plain words — “Licence claim failed”, “Donator reward marked as received” — with the panel’s own stored name for it printed underneath in small type. The stored name is what the search box matches on, and it is the exact string to quote if you ever need to ask us about a specific entry.

Kept indefinitely. Your Server Log is pruned on a schedule because chat fills it up; the audit log is not, because the entries most likely to be asked about later are the ones worth keeping longest. It is included in Export My Data, so it can leave the panel if somebody asks you for it in writing.

What it does not record: who merely looked at a player's record. On a busy panel that is thousands of entries a day and it would bury the ones that matter. If you need read-tracking for a specific reason, ask — it is a deliberate omission, not an oversight.

Staff Activity — also yours alone

Under Servers in the sidebar, next to the Audit Log, and gated the same way — owner rank only. It answers a different question than the audit log: not what got deleted, but who is doing the work, and how well.

Server Logs and Chat Logs — two pages, on purpose

Both under Servers in the sidebar, visible to anyone who can already see the Servers group — not owner-only, unlike Audit Log and Staff Activity above. Server Logs and Chat Logs used to be one page; they were split because the two are read for different reasons: server logs are scanned for what happened — joins, leaves, warnings, kicks, bans — while chat is searched for what was said. A busy server's chat drowns out a join/leave line within seconds, so leaving them mixed meant the moderation trail was the thing that got buried.

Reasons — what your players are actually doing

Under Player Data → Reasons. Every warning, kick and ban you have issued, grouped by the reason written on it. Unlike the two reports above, this one is not owner-only — no staff name appears on it. It reports on your players, not on your team, so anyone who can already read the warnings list can read this.

Staff Activity answers how much moderation is happening and who is doing it. This answers what it is all for, which is usually the one you can act on: a rule producing a third of your warnings is either a rule people cannot follow or one that needs saying more clearly, and neither of those is visible from a count.

5   How bans really work

A ban is not attached to one account. When you ban someone, the panel stores every identifier they had at that moment — Steam, Discord, licence, licence2, their Cfx.re account, their Xbox Live account if they have one, and their hardware IDs. On every connection attempt it checks all of them, and matching any single one blocks entry.

So a banned player coming back on a brand-new Steam account, from the same machine, is still stopped by the hardware ID.

The two worth understanding are the ones a new account does not shake off. Making a new Rockstar account changes both licence identifiers, and someone evading deliberately is usually not running Steam and never linked Discord — so those give you nothing. But playing FiveM at all needs a Cfx.re account, and a Microsoft Store or Xbox app copy of the game carries the Xbox Live account it was bought with. Replacing that one means buying the game again, which is a real cost rather than a few minutes of effort.

6   Investigating

Linked accounts

Under Other Actions. Lists other players sharing this one's Steam, Discord, licence2, Cfx.re account, Xbox Live account or any hardware ID — showing which identifiers overlap and whether that account is already banned. This is how you find alt accounts and ban evaders.

Risk summary

Trust score, Steam account age (flagged under 30 days, typical of throwaway evasion accounts), recent warnings and kicks, and total bans.

Name mismatch

Compares the name the game client reports against the real Steam account name. Cheat menus can fake the in-game name; they cannot fake the Steam one.

Identifier analysis

Every player page carries a short analysis of the identifiers that player has connected with. It exists because of the uncomfortable fact above: since hardware IDs can be faked, what is worth watching is not the values themselves but whether they stay consistent. A player whose hardware ID changes every session is telling you something.

Live map

On each server's page, needs the Live Map permission (off by default — Settings → Panel Settings). Plots every connected player's current position as an arrow pointing the way they are facing. A player still loading in has no position yet and is left off rather than shown at the wrong spot; one whose direction is not known yet shows as a plain dot.

While you have the map open it refreshes every two seconds. Opening it is what asks your game server for that: it starts sending fast position updates, and stops within a few seconds of the last map being closed, so a server nobody is watching sends nothing extra at all. Going live takes up to 30 seconds — the request rides on the heartbeat your server already sends, and that runs on a 30-second timer. Until then the map shows the 30-second snapshot it always did.

The badge in the top-left corner says which you are looking at:

• Live — positions are two seconds old at most.
• Every 30s — the snapshot. Either the map has only just been opened, or the server is on a resource older than 2.4.1.
• No data — nobody is connected, or the server has not reported in.

The fast updates carry three numbers per player and nothing else — no names, no identifiers. Those come from the 30-second report as they always have, and the two are read together. Somebody who connected in the last half-minute therefore appears at the next 30-second beat, which is also when the panel first learns their name.

No game map image ships by default — positions plot on a plain grid until you supply one. This is deliberate: the in-game map texture belongs to the game, not to us, so sourcing an image is left to you rather than decided on your behalf.

Inventory, trunk and glovebox

On a player's own page, needs the Screenshot permission (the same one that gates screenshot requests — both are "look at what this player actually has right now" tools). Reads live from the game server: their inventory, or whatever vehicle they are currently sitting in.

Trunk and glovebox only work for the vehicle the player is currently in — not an arbitrary plate. A parked, unattended vehicle cannot be read this way; that is a limit of how the game server tracks vehicles, not a bug.

7   The player portal

Your players have their own page at /me on the panel. They sign in with Steam — no account to create — and see what your community records about them.

It covers every community they play on that uses this panel — each one separately, and only their own rows.

Sharing a donator vehicle

If a player owns a donator vehicle, it is listed on the same page with a box to share it. They type a friend's exact in-game name, and that friend can then drive it whenever they like — the owner does not need to be online. Up to five friends per vehicle, removed again with one click.

Deliberately the player's job rather than yours. The alternative is your staff handling “can you add my mate to my car” tickets forever, and there is nothing in that decision a staff member needs to approve.

Ban appeals

A banned player can appeal from that page. The appeal arrives as an ordinary support ticket in your queue, so it lands where you already look rather than somewhere new. One open appeal at a time, so a frustrated player cannot flood you.

This is worth turning on in your community's mind: it saves your staff answering the same "why was I banned" question in Discord all week.

8   Settings worth doing

All under Settings → Panel Settings.

Your framework

Qbox, QBCore, ESX, or Sandbox — no framework, which is the default. It controls one thing today: whether the panel offers features that need an inventory to exist.

Left on None, Give to Selected on the Servers page is hidden. That is deliberate — on a server with no item system there is nothing to give, so offering the box would only ever produce a silent failure.

The list is refreshed every time the resource starts, so adding items to your server and restarting is all it takes to see them here.

Your own Steam API key

Optional, free, and takes about a minute. The panel uses a Steam key to turn a player’s Steam ID into their real Steam name and account age — which is what powers name-mismatch detection and the “this account is four days old” signal when you are investigating somebody.

Leave it blank and the panel’s own key is used. That works, and nothing breaks. But Steam limits requests per key, and on a hosted panel that one key is shared with every other community here — so a busy neighbour can eat into what is available to you.

Get one at steamcommunity.com/dev/apikey, paste it into Settings → Panel Settings, and save.

Self-hosted? There is only ever one key on your install, and this field simply is not needed — set it in your config file instead.

Approved server addresses

Your community ID is how your game server proves itself to the panel. It sits in a file on that server, so treat it as something that could be discovered rather than as a password.

It cannot be used to warn, kick or ban anyone — those need a signed-in panel account. But it is worth a second lock: list the addresses your game server actually calls from, and the community ID alone stops being enough.

The panel records every address it sees, so you can copy real values rather than typing one from memory. A wrong entry stops your bans being enforced, so use the recorded list.

Server signing, and the “New key” button

Under Settings → Edit Servers, each server shows a signed or unsigned label. Signed means it is running a resource built after each server got its own individual credentials, so it proves which server is calling rather than just quoting your shared community ID. Unsigned means it predates that — re-download it from Support → Downloads when convenient. Nothing is broken in the meantime; an unsigned server keeps working exactly as before.

Import Moderation History — bringing records over from another tool

Under Settings → Import Moderation History, owner only — it writes bulk records straight into your bans, warnings and kicks, the same tier as deleting a community. It lets you bring a CSV export from another moderation tool into the panel instead of losing that history when you switch.

1. Upload a CSV of bans, warnings or kicks (pick which one first — each import is one type at a time).
2. Map columns — tell the panel which column in your file is the player name, reason, identifier, date and so on. It guesses from your header row where it can; you confirm or correct it.
3. Review a dry-run summary before anything is written — how many rows will import, how many will be skipped, and why.

Every completed import writes one entry to your Audit Log: how many records were imported and how many rows were skipped.

Discord bot (for bulk roles)

A separate integration from the webhook above — a webhook can only post messages, this can grant Discord roles, so it needs its own bot with its own token. It only powers Bulk Discord Roles; nothing else in the panel needs it.

1. Create a bot at discord.com/developers/applications.
2. Invite it to your server with the Manage Roles permission — nothing wider than that.
3. Move its own role above any role you want it able to grant, in your Discord server's own role list. This is a Discord rule, not ours: a bot can never assign a role equal to or higher than its own.
4. Paste the token and Server ID into Settings → Panel Settings, add the roles you want available, and hit Test Connection. It checks both the token and, if you have already listed roles, whether the bot can actually grant each one — so a role-order mistake is caught here rather than mid-assignment later.

The bot token is write-only once saved — the field always shows blank, the same as your RCON passwords. Leaving it blank on a later save keeps the existing token; nothing is ever redisplayed.

9   Your plan and paying

Sidebar → Account → Landing Page shows your current plan, how much of your allowance you have used, and days remaining.

Renewing early adds to your remaining time rather than replacing it, so there is no reason to leave it late. Belonging to other people's communities is always free and never counts against your allowance — the limit is only on communities you own. If you own more than one, a dropdown appears at the top of the sidebar to switch between them.

If you bought on our store instead of in the panel

A purchase made directly on our Tebex store arrives without an account attached to it, because only a checkout started inside the panel knows who you are. Nothing is lost when that happens — the payment is held, not discarded — but it does not apply itself.

On the Landing Page there is a link reading Bought on our Tebex store instead? Claim it here. Enter the transaction reference from your receipt (it starts with tbx-) and the email you used at checkout, tick the immediate-access box, and your plan applies straight away.

Both the reference and the email are required, and repeated wrong guesses are refused for an hour. That is deliberate: without it, somebody who guessed a reference could claim a stranger's purchase. If you are stuck, email [email protected] and we will apply it by hand.

Once you have claimed once, later renewals of that subscription attach themselves automatically. You only ever do this the first time.

Before you pay

On the same Landing Page, under the packages, there is a box headed Before you pay. Do this before sending any money:

1. Choose your package from the dropdown — the one you actually intend to buy.
2. Tick the box confirming you want immediate access and understand you give up the 14-day cancellation right by taking it.

This exists so both sides know where they stand. It is recorded with the exact wording, the package and the time.

You are warned on Discord, not by email

The panel has no email feature. Before your plan ends it posts to your own Discord webhook at 7 days, 3 days and 1 day — once each. Receipts come from the payment provider, not from us.

10   Your players' data

You hold real personal data about real people: identifiers, hardware IDs, chat and screenshots. Two tools exist so you can meet requests without asking anyone's permission.

Download everything

Settings → Download My Data gives you the whole community as JSON, CSV and the screenshot image files.

Delete one player

On that player's page, for when a player asks you to. It permanently removes their profile, warnings, kicks, notes, commends and screenshots in your community, and the image files on disk. You confirm by typing ERASE, because it is irreversible. Records held by other communities are theirs, not yours, and are untouched.

Delete one screenshot

Each screenshot on a player's page has a Remove label next to it, for anyone with the Delete Records permission. It deletes the database record and the image file together — there is nothing left to clean up afterwards. Use it for a screenshot that should not have been kept, without erasing the rest of that player's history.

Delete the whole community

Available to the registered owner only, and confirmed by typing a phrase so it cannot happen by accident.

Our side of this is set out in the Data Processing Addendum. Worth reading once if you take players from the EU or UK.

11   Using the panel without a mouse

Everything below works today, on both the hosted and self-hosted panel. Nothing here needs turning on.

Keyboard

Tab moves forward through the page, Shift+Tab back, Enter or Space activates whatever has focus. Whatever holds the keyboard draws a blue ring around itself, so you can always see where you are. The ring only appears when you are actually using the keyboard — clicking a button with the mouse does not leave one behind.

The first Tab on any page is “Skip to main content”. It stays hidden until you get to it. The sidebar is around thirty links and it comes before the page content, so without this you would press Tab thirty times on every page before reaching the thing you came for. Press Enter on it and you land in the content itself.

Screen readers

Every field is tied to the label printed beside it, so the field announces the same words you can see — and clicking a label puts the cursor in its box, which is useful with a mouse too. Buttons that show only an icon, like the map's zoom controls, say what they do. In the permissions grid each checkbox announces both of its coordinates, as “kick for moderator”, because a bare checkbox in the middle of a grid tells you nothing on its own.

Each page has one top-level heading naming the page, then a heading per card, so you can jump between sections by heading rather than reading through. Tables announce their column headings as you move across a row.

Zoom and text size

The panel is usable at 200% zoom without the page scrolling sideways. Browser zoom (Ctrl and +, or Cmd and + on a Mac) is the one to use. An older version of the panel told your browser to block pinch-zoom on a phone; that is gone.

12   Upgrading a self-hosted panel

However the panel is run, a tab that was open before a new version went live notices within a minute — or as soon as you switch back to it — and shows a bar at the top of the page with a Refresh button. It never refreshes on its own, so a half-written ban reason is never lost. After refreshing, What’s New lists what changed.

Hosted customers can skip the rest of this section — we run these steps for you, and you will simply see the new version appear. This is for licensees running the panel on their own server.

An upgrade is three things, in this order: replace the files, run the migration tool, then re-download the game-server resource if the release says to.

1. Replace the files, keep your config

Overwrite the panel files with the new release, but keep your own config.php — it holds your database details and two encryption keys that cannot be regenerated. If you lose those keys, the stored RCON and server credentials they protect cannot be read back. Take a copy before you start.

2. Run the migration tool

From the panel folder, on the server:

php tools/migrate-schema.php

Run without --apply it changes nothing — it prints exactly what it would do, and you decide. Add --apply when you are happy. It brings an older database up to what the release expects: text stored so that every alphabet survives, timestamps that no longer reject a missing value, and the relationships between tables.

Two flags are worth knowing:

If you are upgrading a panel that predates per-server keys, there is also php tools/migrate-server-keys.php, which gives each of your servers its own credentials. The release notes say when this is needed.

3. Re-download the resource, if the release says so

Some releases change how your game server talks to the panel — the move to signed requests did. When that happens the release notes say re-download the resource. Get it from Support → Downloads, replace the staff folder on each game server, and restart that resource. Your panel keeps working with an older copy in the meantime; it just keeps doing the old thing until you update.

Check it worked

Platform Admin → Diagnostics reads its numbers from the running server rather than from a config file, so it will tell you what PHP is actually doing, which extensions are present, your database version, and whether signed requests are being required. Anything below what the panel needs is marked.

13   When something breaks

Opening a ticket

Support → Support Tickets. Status moves through Open, In-Progress, Pending and Closed. Replies appear on your dashboard with a New reply badge, and are posted to your Discord webhook if you have set one.