txAdmin Explained: Setup, Ports and Security Settings
txAdmin ships with FXServer and binds to 0.0.0.0 port 40120 by default. See what that exposes, the settings that matter, and how to lock the panel down.
Roby Einstein
FairShieldAC Security Team
txAdmin is already running on your FiveM server. It ships inside FXServer, and its documented defaults bind it to `0.0.0.0` - every network interface - on TCP port `40120`, over plain HTTP. Whether the panel is reachable from the internet comes down to your firewall. Since it is a full remote console, that is worth checking rather than assuming.
Check these three things before anything else
- Is port 40120 reachable from outside your host? Test from a machine off your server's network. If it loads a login page for you, it loads for everyone.
- Is your master account linked to Cfx.re, with a unique password? It outranks any in-game admin role: it can stop the server and rewrite server.cfg.
- Who can write to your txData folder? Anyone able to replace `admins.json` on disk can take the panel.
What txAdmin is, and why you never installed it
txAdmin is the official web panel and in-game menu for managing an FXServer, and there is nothing to install. The FiveM documentation states it "already comes preinstalled with FXServer" and "is included in all FXServer builds above 2524".
It "requires to be launched from inside FXServer in monitor mode", which you get by running `run.sh` or `FXServer.exe` without any `+exec` arguments. Bare FXServer starts txAdmin, which then starts and supervises your game server. You end up with a second network service, on its own port, that many owners never consciously configured.
The txAdmin port question: 40120 is not 30120
Your game port and your panel port are separate. `30120` is where players connect; `40120` is where the panel listens. The split is deliberate - txAdmin's environment configuration documentation says the panel port "cannot be `30120` to prevent user confusion".
The bind address is where the risk lives. Pages claiming txAdmin defaults to localhost only are wrong, and it is the txAdmin folklore I see repeated most. The documented default for `TXHOST_INTERFACE` is `0.0.0.0`, meaning all interfaces, and txAdmin's boot output assumes the same model: reaching the panel from the internet means opening the port on both your OS firewall and your hosting provider's firewall. There is no TLS either, so credentials cross the wire in cleartext unless you terminate HTTPS in front of it.
txAdmin security: treat the panel as root access
Consider what the panel does: start and stop the server, write to the live console, edit `server.cfg`, manage resources, ban players, add admins. An attacker who gets in needs no cheat and no exploit - they already have the console.
- Do not expose the panel directly. Reach it over a VPN, an SSH tunnel, a Cloudflare Tunnel, or a reverse proxy with HTTPS and an IP allowlist. Moving it to an odd port is cosmetic by comparison.
- Treat the firewall as the real boundary. The bind is all interfaces, so your OS and provider firewalls decide reachability. Check both again after any migration or image rebuild.
- Prune the admin list. The permissions doc is blunt that `all_permissions` is "Root permission that allows the user to perform any action." Remove ex-staff the day they leave.
- Restrict filesystem access to txData. Casual FTP or file-manager access for staff is effectively admin access.
txAdmin does include a global per-IP rate limiter, aimed at request floods rather than credential attacks on one account. Its console message when that limiter trips says to "Make sure you have a proper firewall setup and/or a reverse proxy with rate limiting." If a flood is already underway, see what to do when your FiveM server is under DDoS attack.
txAdmin host settings: current variables and deprecated convars
This is where published guides most often lag behind. Host configuration moved from FXServer convars to `TXHOST_*` environment variables, and the repository documentation states that `txAdminPort`, `txAdminInterface`, `txDataPath` and `txAdminZapConfig.json` "are now considered deprecated and will cease to work in an upcoming update". They still work today, printing a warning rather than failing, so there is no need to panic-migrate a live server.
| Environment variable | What it does | Documented default |
|---|---|---|
| TXHOST_TXA_PORT | Which TCP port txAdmin should bind and listen to. Cannot be set to 30120, to prevent user confusion. | 40120 |
| TXHOST_INTERFACE | Which interface txAdmin will bind and enforce FXServer to bind to. | 0.0.0.0 |
| TXHOST_DATA_PATH | Path to the txData folder containing logs, configs and data. | Windows: <fxserver_root>/../txData ; Linux: <fxserver_root>/../../../txData |
| TXHOST_FXS_PORT | Forces FXServer to bind to the specified port. | Undefined |
| TXHOST_TXA_URL | Public URL displayed in the txAdmin boot message. | Undefined |
| TXHOST_GAME_NAME | Restricts the server to FiveM or RedM only (fivem / redm). | Undefined |
| TXHOST_MAX_SLOTS | Enforces a maximum sv_maxClients value. | Undefined |
| TXHOST_QUIET_MODE | Suppresses FXServer stdout/stderr piping to txAdmin stdout. | false |
| TXHOST_API_TOKEN | Token used to access the /host/status endpoint via the x-txadmin-envtoken header or the ?envtoken= URL parameter. | Undefined |
| TXHOST_IGNORE_DEPRECATED_CONFIGS | Disables the old config and silences the deprecation warnings. | not documented |
| TXHOST_DEFAULT_ACCOUNT | Used by hosting providers to set up an admins.json automatically on first boot. Contains a username, FiveM ID and password (as bcrypt hash) separated by colons. | Undefined |
| TXHOST_DEFAULT_CFXKEY | Pre-fills the Cfx.re key during setup. | Undefined |
Source: `docs/env-config.md` in the txAdmin repository, which also documents how to set them - `set VAR=VALUE` in your Windows batch file, `export VAR=VALUE` in `run.sh` on Linux, or an `.env` file loaded with `--env-file=.env` under Docker.
Note the credential rows. `TXHOST_DEFAULT_ACCOUNT` provisions a master account at first boot and `TXHOST_API_TOKEN` opens a status endpoint; a hosting image you did not build may have set either, which is a fair question for your provider. The same page says such variables "must not be widely available for other processes".
| Deprecated convar | Description | Documented default | Replacement |
|---|---|---|---|
| txAdminPort | The TCP port to use as HTTP Server | 40120 | TXHOST_TXA_PORT |
| txAdminInterface | The interface to use as HTTP Server | 0.0.0.0 | TXHOST_INTERFACE |
| txDataPath | Path of the data folder | Windows <citizen_root>/../txData ; Linux <citizen_root>/../../../txData | TXHOST_DATA_PATH |
| serverProfile | The name of the server profile to start | default | Deprecated, no direct replacement documented |
Sources: the docs.fivem.net txAdmin resource page for descriptions and defaults, plus the repo `docs/env-config.md` for deprecation status. That FiveM page still lists these convars as current, with no deprecation notice.
The in-game menu convars you can safely set by hand
The menu documentation opens its convar list with a warning worth taking literally: "Convars configured in the settings page should not be set manually." If a setting has a toggle in the panel, use the toggle. The four below are convar-only.
| Convar | Description | Default | Documented usage |
|---|---|---|---|
| txAdmin-debugMode | Toggles debug printing on the server and client. | false | setr txAdmin-debugMode true |
| txAdmin-menuPlayerIdDistance | Distance at which Player IDs become visible. The engine limits tags to around 300m. | 150 | setr txAdmin-menuPlayerIdDistance 100 |
| txAdmin-menuDrunkDuration | How many seconds the drunk effect (troll action) should last. | 30 | setr txAdmin-menuDrunkDuration 120 |
| txAdmin-menuAnnounceNotiPos | Location of the announcement notification. One of top-center, top-left, top-right, bottom-center, bottom-left, bottom-right. | top-center | set txAdmin-menuAnnounceNotiPos top-right |
| In-game command | What it does | Required permission |
|---|---|---|
| /tx (playerID) | Toggles the in-game menu. The optional player ID argument opens that player's info modal directly. | Must be an admin registered in the Admin Manager |
| /txAdmin-reauth | Retriggers the reauthentication process. | none |
Source for both tables: `docs/menu.md` in the txAdmin repo. Reproduce the `setr` and `set` prefixes exactly. One rule catches people out: a menu admin "must have a txAdmin account with either their Discord or Cfx.re identifiers tied to it", or `/tx` does nothing.
The txAdmin features a server owner actually uses
| Area | What it is for | Security note |
|---|---|---|
| Live console | Read server output and send commands to the running FXServer. | Gated by console.view and console.write. Console write is effectively command execution. |
| Server control | Start, stop, restart and schedule restarts. | Gated by control.server. Whoever holds this can take your server offline. |
| cfg editor | Edit server.cfg from the browser. | Gated by server.cfg.editor. Equivalent to file write on your most sensitive config. |
| Players and history | Search players, view identifiers and history, warn, kick and ban. | Separate permissions per action, including players.warn, players.kick and players.ban. |
| Ban templates and banlist | Reusable ban reasons and ban configuration, including HWID match requirements. | banlist.enabled defaults to true; banlist.requiredHwidMatches defaults to 1. |
| Allowlist | Gate who may connect: approved license, Discord membership, Discord roles, admin only, or external. | whitelist.mode defaults to disabled. The panel UI says allowlist while the config key is still whitelist. |
| Admin manager | Create admin accounts and assign granular permissions. | Gated by manage.admins. The account that can create accounts is the one to guard hardest. |
| Settings | All panel configuration, including the login rate limiter. | Split into settings.view and settings.write. |
| Action and console logs | Audit trail of administrative and automated actions, plus FXServer console output. | IPs are not logged except from authentication endpoints; FXServer console log retention is documented as 7 days. |
| Recipe deployer | Build a new server from a YAML template in one pass. | Recipes are jailed to the target folder, so they cannot write to admins.json. |
| In-game menu | Admin actions from inside the game via /tx. | Requires a linked Discord or Cfx.re identifier on the admin account. |
Permission identifiers come from `docs/permissions.md`; the banlist, allowlist and web server defaults come from the config schema files in the same repository. Two settings worth knowing by name: `webServer.limiterAttempts` (default `10`) and `webServer.limiterMinutes` (default `15`) set failed-login lockout.
A third, `webServer.disableNuiSourceCheck`, defaults to `false`, meaning the protection is on. The docs offer it only as a fix for multi-IP hosts hitting an "Invalid Request: source" error. Guides recommending it as a general remedy are wrong: outside that error it removes a check on the menu's auth request and buys nothing.
Recipes are a first-install tool, not an updater
The Recipe Deployer builds a server from a recipe, "a YAML document that describes how to deploy a server properly: from downloading resources, to configuring the `server.cfg` file". It is sandboxed: recipes "will be 'jailed' to the target folder, so for example they won't be able to execute `write_file` to your `admins.json`". Two notes of mine, not documentation: deploy into a clean folder rather than over a customised server, and be selective about third-party recipes, since they install resources that then run on your server.
Losing your master account, and what not to copy from hosting blogs
No official page covers recovering a lost master account, but the behaviour is verifiable. `admins.json` lives in your txData folder, and if it is absent at boot (and your host set no default account), txAdmin generates a random four-digit PIN and prints it with "Use this PIN to add a new master account". Registration then runs through Cfx.re login.
The defensive reading comes first: anyone who can delete or replace `admins.json` on disk can take your panel, which makes filesystem permissions on `txData/` a genuine security control.
If you have genuinely lost access: stop the server, rename `admins.json` in your txData profile folder, start it again, and register with the PIN txAdmin prints. Deleting it while the server runs fails - a periodic integrity check tries to restore the file, logging that it "was modified or deleted by an external source", logging that it "was modified or deleted by an external source". Finish registration immediately.
Two things I could not verify and will not publish as working: the `--reset-admin` flag repeated across hosting knowledge bases, which appears in no official doc or boot code, and any "default credentials" trick for hand-writing an `admins.json`. `txAdminVerbose` is on docs.fivem.net but absent from the current source, so it is not in the tables above.
txAdmin FAQ
Do I need to install txAdmin separately?
No. The FiveM documentation states txAdmin "already comes preinstalled with FXServer" and "is included in all FXServer builds above 2524". Start it by running `FXServer.exe` or `run.sh` with no `+exec` arguments, which launches monitor mode. It creates `txData` on first boot and prints a link and a registration PIN.
What port does txAdmin use, and is it my server port?
The documented default panel port is `40120`, separate from the game port `30120`. The documentation states the panel port "cannot be `30120` to prevent user confusion". Change it with the `TXHOST_TXA_PORT` environment variable; the legacy `txAdminPort` convar still works but prints a deprecation warning.
Is it safe to leave txAdmin open to the internet?
No, and the default bind is why it needs checking. `TXHOST_INTERFACE` defaults to `0.0.0.0` - all interfaces - and the panel serves plain HTTP with no TLS. Since it can stop your server and edit `server.cfg`, put it behind a VPN, SSH tunnel, Cloudflare Tunnel or a reverse proxy with an allowlist.
How do I change the txAdmin port or bind address?
Set `TXHOST_TXA_PORT` and `TXHOST_INTERFACE` before FXServer starts: `set VAR=VALUE` in your Windows batch file, `export VAR=VALUE` in `run.sh`, or an `.env` file under Docker. On a managed host, ask your provider - some set these for you.
Where txAdmin ends and an anti-cheat begins
txAdmin is administration tooling: console, bans, allowlist, audit trail. Watching what happens inside a player's game client mid-session is a different job, and that is the layer FairShieldAC covers - real-time detection of mod menus, Lua executors, aimbot, silent aim, ESP, godmode, noclip and teleport, using client- and server-side behavioural heuristics, plus an on-device deep scan for injectors and memory hooks.
Your next step is the dull one that matters: from outside your network, try to reach your panel on `40120`. If it answers, decide today whether it should, then prune the admin list. After that, see plans, and read how HWID bans stop repeat cheaters, how FiveM anti-cheat detection works, and what to do under a DDoS attack.