server.password (not a Rust ConVar)

server.password looks like it should exist next to server.hostname. On vanilla Rust it does not.

What the server says

On our test server (Rust build 25582902, September 2026):

• find . lists 1648 console variables and 771 commands. None is called server.password.
• The only name that contains "password" at all is rcon.maxpasswordfailures, an RCON setting.
• The name does not appear in the server's game code either (Assembly-CSharp.dll).

Because nothing in the game code uses that name, a server.password line in server.cfg or a +server.password startup argument cannot keep anyone out. Anyone who has the address can still join.

rcon.password is something else

rcon.password is the password for RCON, the remote admin console. It keeps strangers out of your console, not out of your game. Never hand it to players: anyone who has it can run every admin command.

How to actually restrict who joins

Vanilla Rust has no join password and no whitelist in its ConVar list, so the options are:

1. A plugin. With Oxide (uMod) or Carbon installed, a password or whitelist plugin checks players when they connect. uMod has at least one, called Password. Read the plugin's own page for how players enter the password, and remember its commands and settings belong to that plugin, not to Rust.
2. Ban after the fact. Without a plugin, anyone who has the address can connect. All you can do is kick (kick) or ban (ban) players once they are in.

If you set up a plugin, test it with a second account before you rely on it.

In Panelra

Panelra manages Oxide and Carbon plugins from the dashboard. If you add server.password as a Custom ConVar on a vanilla server, the panel marks it as "could not be read from the server", which is the hint that the name does not exist there.