Community owner manual

Running your community

Written for the person who owns the community — the one who pays for it, connects the server, and decides who gets to ban people. Read it once from the top; after that use the contents on the left.

1   Getting set up

1. Sign in with SteamThere is no separate password. Your Steam account is your login, so there is nothing to remember and nothing to leak.
2. Create your communityOn the welcome page. This starts your 7-day free trial automatically — no payment details, and nothing charges you when it ends.
3. Add your serverSettings → Edit Servers. Name, the ip:port your players connect to, and your RCON password.
4. Install the resourceCovered in the next section. Takes about five minutes.

2   Connecting your game server

There is nothing to configure by hand. The download is generated for your server, with your community ID and address already inside it.

1. Support → DownloadsClick Download next to the server you added.
2. Extract into resources/The staff folder goes in whole.
3. Add one line to server.cfg

   ensure staff
   ensure screenshot-basic   # only if you want screenshots

   Use a built copy of screenshot-basic — the one that ships with most FiveM server builds is ideal. The GitHub source needs yarn and webpack to build before FiveM can load it. If yours is missing or unbuilt, the panel says so in your server console rather than failing silently.

4. RestartYour players appear under Servers within about 30 seconds.

If the download hands you a config.json instead of a zip, your host simply cannot build archives. Put that file into the staff folder yourself; nothing else changes.

What the detections do, and what they deliberately do not

The resource watches for explosion floods, entity spam and client-triggered server events, and reports them to the player’s record. Two of those also cancel the action. It is worth knowing where the lines are drawn, because the wrong setting here makes the panel accuse ordinary players.

Explosions are limited by rate, not by type. Twelve per player per ten seconds; over that they are cancelled and reported. Rate is the honest test — a script blowing up the map is abnormal by volume whatever it uses, and nobody reaches that many by playing. explosion_types_blocked lets you block particular types outright and ships empty, because which explosions are legitimate depends on your server. A rocket is griefing on one server and a gang war on another. Take particular care before listing petrol pumps, barrels, planes, trains, fireworks or snowballs: all six happen in normal play, so blocking them stops the world reacting the way players expect and marks them as griefers for shooting a petrol station.

Entity spam only reports; it does not cancel. GTA streams its pedestrians and traffic in through whichever player is nearest, so those count as entities that player created — loading into the world creates hundreds in seconds, and even mid-session, ordinary driving along a busy road produces a burst of the same vehicle model repeating, because GTA's population system leans on one vehicle type per road class rather than varying it. The limit is therefore high (150 per ten seconds), nothing is counted for the first minute after someone connects, and cancelling is off. You can turn cancelling on with entity_cancel while dealing with an active spawner, but leave it off the rest of the time: the entities being blocked are mostly scenery, so it deletes the world around your players rather than stopping an attack.

Protected events report; they do not block. List the server events in your framework that a client should never fire — usually the ones handing out money, items or jobs — and anyone who fires one is named on their record. It cannot stop the event: cancelling only works where the code that raised the event checks for it, which the game engine does for connections, entities, explosions and chat, but no framework does for its own events. So the money is still granted; what you get is the person who did it. protected_events_kick adds a kick, off by default, and it stops the next attempt rather than the first one.

All of these live under detections in config.json, and the whole thing switches off with "enabled": false.

Every detection on a player's page has Mark reviewed and Delete, both needing Delete Records. Reviewing keeps the entry but marks it looked at, so a busy queue shows what still needs attention. Delete removes it outright — for a false positive, since the checks above are deliberately generous and still catch the odd legitimate player.

Optional: refusing connections before they start

Two settings in config.json are left empty on purpose, because switching them on will refuse real players as well as the ones you are aiming at. Both are checked on the server, before the player is admitted, so neither can be defeated by a modified client.

"connection": {
    "require_identifiers": ["steam"],
    "blocked_names": ["admin", "moderator"]
}

require_identifiers is the one worth understanding. A ban recorded against a Steam ID does nothing to someone who closes Steam before reconnecting — there is no Steam ID left to match. Listing steam here refuses that connection instead of letting it through. The cost is that players who genuinely do not run Steam are refused too, which is why it is off by default. You can also list discord, fivem or license2. There is no point listing license: it is always present, and it is what every ban is matched on regardless.

blocked_names refuses anyone whose name contains one of these words, ignoring case. It is a substring match because impersonation is nearly always [admin] or admin  rather than exactly admin.

Both write a refusal to the player’s record, so you can see who was turned away and why rather than only finding it in the console. The messages shown to the player are in the same block and can be reworded.

Every setting in config.json

The download fills in the first four for you. You should not need to touch them unless something moves.

ip_address and debug appear in the file but the resource never reads them — they do nothing. They are left in place so an existing config is not invalidated; changing them has no effect either way.

3   Staff and permissions

Go to Settings → Edit Staff. The dropdown is searchable and offers everyone who has played on your servers, most recent first and shown by their in-game name — usually exactly who you are looking for. Existing panel accounts are listed separately.

Pick a person, choose a rank, submit. They do not need to visit the panel first. Adding them creates their account straight away; the first time they sign in with Steam their real name fills itself in and their rank is already waiting. People already on your staff are hidden from the list, so it only ever offers people you can actually add.

Deciding what each rank may do

Settings → Panel Settings has a grid of ranks against permissions. Tick what each rank may do.

Someone can be staff in several communities at once. Adding them here has no effect on their rank anywhere else, and every warning, kick, ban and note they issue records their name against it.

Staff cannot moderate each other

Two rules are enforced regardless of what you tick, because they are about conduct rather than capability:

The owner rank is the first rank in your permissions list. It is exempt from the second rule but not the first.

4   Moderating players

What the dashboard tells you

Two things worth glancing at before anything else.

Staff online lists which of your staff are in game right now, with their rank and which server. Useful for the question you actually ask at 9pm on a Saturday — is anybody covering, or is the server unstaffed?

Moderation, last 14 days plots warnings, kicks and bans per day, with the last seven days compared against the seven before. The comparison is the part that matters — a count on its own tells you nothing, but “up 40% on last week” is the difference between a quiet fortnight and something starting.

It also shows how many new players arrived this week, which is the other half of the same picture: more moderation with more players is normal, more moderation with the same players is not.

The player profile

Reach a player from Servers (whoever is online right now) or Player Data → Player List (everyone ever seen). Their profile carries these tabs:

Freeze

Under Other Actions, behind its own Freeze permission (off by default). Holds a player in place so they cannot run off mid-conversation — the thing you actually want when someone is being questioned but has done nothing worth kicking them for yet.

It survives a reconnect. Dropping out to escape it no longer works: the freeze lives on their record, and the game server re-applies it the moment they load back in. If they are offline when you freeze them, it takes effect next time they join.

They see a notice on screen for as long as the freeze lasts, showing your reason and the time remaining. It stays put through death and respawn, so somebody cannot miss it and be left wondering why they are stuck. It was previously a chat message, which scrolls away and is invisible to anyone playing with chat hidden — if you froze someone before and they seemed confused rather than co-operative, that is why. Re-download the resource to get the notice.

They are also made invincible while held — a frozen player cannot run away, so without that they are a stationary target while you are talking to them.

Every freeze and release is listed on the Freeze Log page under Server Data, with the staff member's name. Search a name there to read only theirs — freezing holds someone in place, so it is worth being able to see who uses it and how often.

Trust score rises with playtime and commends, and falls with warnings, kicks and bans. Treat it as a rough reputation signal, not a verdict.

Donator vehicles

Further down the same player profile. Grant a vehicle and it belongs to that player: it is tied to their account, not to a character, so a character wipe, a new character or a fresh start does not take away something they paid you for. Enter the spawn name (adder), and optionally a display name and a plate.

The player picks from a menu. They type /mycars in game and see everything they own plus anything a friend has shared with them, and spawn any of it. Shared vehicles are marked with the name of the friend who shared it.

Owners share with friends themselves, from their own record page — up to five people per vehicle, added and removed whenever they like. You do not have to do it for them, and a friend can drive it whether or not the owner is online.

Revoking a grant is immediate and also removes every share on it.

Unlike the freeze above, this check runs on your game server rather than on the player's computer, so a modified game client cannot skip it. A cheater can decline to tell the server they got in; they cannot hide from the server that they are sitting in the driver seat, which is re-checked every few seconds regardless.

Bulk actions

On Servers, select several online players with the checkboxes and act on all of them at once. Each needs its own permission, off by default, in Settings → Panel Settings:

Give these to a rank deliberately. Bulk item-give in particular is an easy way for a compromised staff account to duplicate items at scale — that is why it is a separate permission from giving a single player something, not bundled in with the moderation tabs above.

The Audit Log — yours alone

Under Servers in the sidebar, and only the owner rank can open it. No other rank sees the link, and none can reach the data behind it either — showing it to the people it covers would defeat the point of keeping it.

It records the actions that change what your panel holds, or who is allowed to change it:

Kept indefinitely. Your Server Log is pruned on a schedule because chat fills it up; the audit log is not, because the entries most likely to be asked about later are the ones worth keeping longest. It is included in Export My Data, so it can leave the panel if somebody asks you for it in writing.

What it does not record: who merely looked at a player's record. On a busy panel that is thousands of entries a day and it would bury the ones that matter. If you need read-tracking for a specific reason, ask — it is a deliberate omission, not an oversight.

5   How bans really work

A ban is not attached to one account. When you ban someone, the panel stores every identifier they had at that moment — Steam, Discord, licence, licence2 and their hardware IDs. On every connection attempt it checks all of them, and matching any single one blocks entry.

So a banned player coming back on a brand-new Steam account, from the same machine, is still stopped by the hardware ID.

6   Investigating

Linked accounts

Under Other Actions. Lists other players sharing this one's Steam, Discord, licence2 or any hardware ID — showing which identifiers overlap and whether that account is already banned. This is how you find alt accounts and ban evaders.

Risk summary

Trust score, Steam account age (flagged under 30 days, typical of throwaway evasion accounts), recent warnings and kicks, and total bans.

Name mismatch

Compares the name the game client reports against the real Steam account name. Cheat menus can fake the in-game name; they cannot fake the Steam one.

Identifier analysis

Every player page carries a short analysis of the identifiers that player has connected with. It exists because of the uncomfortable fact above: since hardware IDs can be faked, what is worth watching is not the values themselves but whether they stay consistent. A player whose hardware ID changes every session is telling you something.

Live map

On each server's page, needs the Live Map permission (off by default — Settings → Panel Settings). Plots every connected player's current position, refreshed every 30 seconds — the same rate the panel already hears from your game server, so this adds nothing extra for it to report. A player still loading in has no position yet and is left off rather than shown at the wrong spot.

No game map image ships by default — positions plot on a plain grid until you supply one. This is deliberate: the in-game map texture belongs to the game, not to us, so sourcing an image is left to you rather than decided on your behalf.

Inventory, trunk and glovebox

On a player's own page, needs the Screenshot permission (the same one that gates screenshot requests — both are "look at what this player actually has right now" tools). Reads live from the game server: their inventory, or whatever vehicle they are currently sitting in.

Trunk and glovebox only work for the vehicle the player is currently in — not an arbitrary plate. A parked, unattended vehicle cannot be read this way; that is a limit of how the game server tracks vehicles, not a bug.

7   The player portal

Your players have their own page at /me on the panel. They sign in with Steam — no account to create — and see what your community records about them.

It covers every community they play on that uses this panel — each one separately, and only their own rows.

Sharing a donator vehicle

If a player owns a donator vehicle, it is listed on the same page with a box to share it. They type a friend's exact in-game name, and that friend can then drive it whenever they like — the owner does not need to be online. Up to five friends per vehicle, removed again with one click.

Deliberately the player's job rather than yours. The alternative is your staff handling “can you add my mate to my car” tickets forever, and there is nothing in that decision a staff member needs to approve.

Ban appeals

A banned player can appeal from that page. The appeal arrives as an ordinary support ticket in your queue, so it lands where you already look rather than somewhere new. One open appeal at a time, so a frustrated player cannot flood you.

This is worth turning on in your community's mind: it saves your staff answering the same "why was I banned" question in Discord all week.

8   Settings worth doing

All under Settings → Panel Settings.

Your framework

Qbox, QBCore, ESX, or None / not sure, which is the default. It controls one thing today: whether the panel offers features that need an inventory to exist.

Left on None, Give to Selected on the Servers page is hidden. That is deliberate — on a server with no item system there is nothing to give, so offering the box would only ever produce a silent failure.

The list is refreshed every time the resource starts, so adding items to your server and restarting is all it takes to see them here.

Your own Steam API key

Optional, free, and takes about a minute. The panel uses a Steam key to turn a player’s Steam ID into their real Steam name and account age — which is what powers name-mismatch detection and the “this account is four days old” signal when you are investigating somebody.

Leave it blank and the panel’s own key is used. That works, and nothing breaks. But Steam limits requests per key, and on a hosted panel that one key is shared with every other community here — so a busy neighbour can eat into what is available to you.

Get one at steamcommunity.com/dev/apikey, paste it into Settings → Panel Settings, and save.

Self-hosted? There is only ever one key on your install, and this field simply is not needed — set it in your config file instead.

Approved server addresses

Your community ID is how your game server proves itself to the panel. It sits in a file on that server, so treat it as something that could be discovered rather than as a password.

It cannot be used to warn, kick or ban anyone — those need a signed-in panel account. But it is worth a second lock: list the addresses your game server actually calls from, and the community ID alone stops being enough.

The panel records every address it sees, so you can copy real values rather than typing one from memory. A wrong entry stops your bans being enforced, so use the recorded list.

Discord bot (for bulk roles)

A separate integration from the webhook above — a webhook can only post messages, this can grant Discord roles, so it needs its own bot with its own token. It only powers Bulk Discord Roles; nothing else in the panel needs it.

1. Create a bot at discord.com/developers/applications.
2. Invite it to your server with the Manage Roles permission — nothing wider than that.
3. Move its own role above any role you want it able to grant, in your Discord server's own role list. This is a Discord rule, not ours: a bot can never assign a role equal to or higher than its own.
4. Paste the token and Server ID into Settings → Panel Settings, add the roles you want available, and hit Test Connection. It checks both the token and, if you have already listed roles, whether the bot can actually grant each one — so a role-order mistake is caught here rather than mid-assignment later.

The bot token is write-only once saved — the field always shows blank, the same as your RCON passwords. Leaving it blank on a later save keeps the existing token; nothing is ever redisplayed.

9   Your plan and paying

Sidebar → Account → Landing Page shows your current plan, how much of your allowance you have used, and days remaining.

Renewing early adds to your remaining time rather than replacing it, so there is no reason to leave it late. Belonging to other people's communities is always free and never counts against your allowance — the limit is only on communities you own. If you own more than one, a dropdown appears at the top of the sidebar to switch between them.

Before you pay

On the same Landing Page, under the packages, there is a box headed Before you pay. Do this before sending any money:

1. Choose your package from the dropdown — the one you actually intend to buy.
2. Tick the box confirming you want immediate access and understand you give up the 14-day cancellation right by taking it.

This exists so both sides know where they stand. It is recorded with the exact wording, the package and the time.

You are warned on Discord, not by email

The panel has no email feature. Before your plan ends it posts to your own Discord webhook at 7 days, 3 days and 1 day — once each. Receipts come from the payment provider, not from us.

10   Your players' data

You hold real personal data about real people: identifiers, hardware IDs, chat and screenshots. Two tools exist so you can meet requests without asking anyone's permission.

Download everything

Settings → Download My Data gives you the whole community as JSON, CSV and the screenshot image files.

Delete one player

On that player's page, for when a player asks you to. It permanently removes their profile, warnings, kicks, notes, commends and screenshots in your community, and the image files on disk. You confirm by typing ERASE, because it is irreversible. Records held by other communities are theirs, not yours, and are untouched.

Delete one screenshot

Each screenshot on a player's page has a Remove label next to it, for anyone with the Delete Records permission. It deletes the database record and the image file together — there is nothing left to clean up afterwards. Use it for a screenshot that should not have been kept, without erasing the rest of that player's history.

Delete the whole community

Available to the registered owner only, and confirmed by typing a phrase so it cannot happen by accident.

Our side of this is set out in the Data Processing Addendum. Worth reading once if you take players from the EU or UK.

11   When something breaks

Opening a ticket

Support → Support Tickets. Status moves through Open, In-Progress, Pending and Closed. Replies appear on your dashboard with a New reply badge, and are posted to your Discord webhook if you have set one.