RCON gives whoever holds the password a console on your server. Bots scan for open RCON ports continuously, and a weak password is not a small risk — it is a full compromise the moment it is guessed.
Why it happens
Automated scanners sweep public IP ranges looking for RCON listening. When they find one, they try common and default passwords. A password like 12345 is found in seconds, and from there they can run any console command, including ones that delete files.
What to do
- Use a long random password
At least 16 characters, alphanumeric and randomly generated. Not a word, not a server name, not a number sequence.
- Turn RCON off if you are not using it
Set
enable-rcon=falseinserver.properties. A port that is not open cannot be scanned into. - Change it after sharing it
If a password was ever pasted in a chat, a ticket or a config you shared, treat it as public and rotate it.
We do not assume liability for command injection, griefing or data loss that came through an insecurely configured RCON.