Project Zomboid server.ini and SandboxVars.lua Settings

Back up and find the active profile

Stop the server gracefully and copy the entire Zomboid folder. Profiles normally live in %UserProfile%\Zomboid\Server\ on Windows and ~/Zomboid/Server/ on Linux. Find the value passed to -servername in the launch command. A profile named friends uses friends.ini and friends_SandboxVars.lua, not the servertest files.

Keep a dated copy of both files. Use a UTF-8 text editor rather than a word processor that may replace quotation marks. One malformed Lua character can prevent the sandbox rules from loading.

Network and access settings in the INI

Make one small change, restart and read the log:

• Open allows or rejects new connections;
• Public controls public discovery;
• PublicName and PublicDescription describe the server;
• Password is the player join password, not an RCON credential;
• MaxPlayers is a logical limit, not a performance guarantee;
• PauseEmpty can pause simulation when the server is empty;
• PVP, SafetySystem and faction options shape player interaction;
• DefaultPort must agree with the launch command and firewall rules.

Never publish an RCON password in a screenshot or repository. If you do not use RCON, keep it unreachable instead of opening its port pre-emptively.

World rules in SandboxVars.lua

SandboxVars.lua covers zombie population, time, loot, vehicles, water, electricity and progression. Exact fields can evolve during Build 42. Generate a current profile first and edit that generated file instead of pasting an old Build 41 example.

Before changing an active world:

1. write down the intended outcome, such as reducing loot respawn;
2. back up the world and configuration;
3. change one group of settings at a time;
4. restart and inspect the log for Lua errors;
5. verify the result with a non-administrator account.

Some rules mainly affect newly generated cells or world creation. A valid setting does not necessarily rewrite explored areas. Test major map, population or mod changes against a copy before deciding on a wipe.

Validation and common failures

If the server starts with old rules, confirm the loaded profile and file permissions. If it stops starting, restore the last known-good INI/Lua pair and compare the edit. If only new players are blocked, inspect Open, password, whitelist and account-registration rules before changing ports.

Record each configuration change with a date and reason. Once the vanilla rules work, continue with the Build 42 Workshop mod guide. The Project Zomboid hosting comparison also shows where configuration files and backups are available.