Secure your txAdmin administration panel

txAdmin provides powerful controls over an entire FXServer installation. Treat access to its web panel, console, server configuration and administrator accounts as privileged server access.

1. Keep port 40120 off the public internet

txAdmin defaults to HTTP on TCP port 40120. FiveM players normally connect to the game server on 30120 TCP/UDP. Opening 40120 to the world is not required for players to join.

Use one of these administration paths:

Access http://localhost:40120 directly on the server.
Connect over a private VPN (for example, WireGuard or Tailscale).
On a Linux VPS, open an SSH tunnel from your workstation:
```
ssh -L 40120:127.0.0.1:40120 YOUR_SSH_USER@YOUR_SERVER_IP
```
Then browse to http://127.0.0.1:40120 locally.
Use your hosting provider’s authenticated panel or a properly secured TLS reverse proxy with independent access controls.

Firewall changes must not close your own SSH or recovery path. With UFW already enabled, an example restricted allow rule is:


sudo ufw allow from YOUR_TRUSTED_PUBLIC_IP to any port 40120 proto tcp
sudo ufw status numbered

Also verify that no wider rule already permits port 40120 and that your cloud firewall restricts it. A UFW allow rule alone does not remove pre-existing broader access. Where possible, block it at the provider firewall first.

2. Protect account linking and recovery

The current first-run flow asks for the one-time console PIN, then links a Cfx.re account and creates a txAdmin backup password. Use a strong, unique password stored in a password manager.

Keep the Cfx.re account secure using the security options actually offered by that account provider.
Never share the initial PIN, active sessions, backup password or txData admin data.
Remove departed staff accounts promptly.
Do not follow older guides that claim there is a universal Settings → Security → Enable Two-Factor Authentication toggle: that exact built-in menu flow is not documented in the current official txAdmin feature list. Verify any authentication feature against the installed version before describing or relying on it.

3. Grant only the permissions required

Use Admin Manager to grant specific txAdmin permissions. Do not hand out the Master account. For example:

Permission	Risk
`console.view`	Reads server output, which may contain private data
`console.write`	Executes commands and can affect the server
`control.server`	Stops/starts/restarts the server
`server.cfg.editor`	Changes configuration and potentially secrets
`manage.admins`	Grants or removes other administrators

txAdmin permissions and FXServer ACE permissions are separate. Granting a framework rank does not automatically grant txAdmin web access. See txAdmin Permissions and ACE Permissions.

4. Protect backups, logs and secrets

Restrict filesystem access to active txData profiles, server.cfg and backup-password material.
Keep Cfx.re registration keys, database credentials, Discord tokens and Steam keys out of public repositories, tickets and screenshots.
Review txAdmin action logs and the FXServer console for unexpected changes, but do not assume every action is captured.
Back up server resources, txData and the database separately, encrypt sensitive offsite backups, and test restores.

The web panel’s log and config editor can expose sensitive values even to staff with ostensibly limited roles.

5. Verify the security boundary

From an unauthorized network, verify the txAdmin port is not reachable.
From your VPN or SSH tunnel, verify an authorized login succeeds.
Sign in as a limited admin and confirm the server rejects an action they lack permission for.
Verify ordinary players can still connect on 30120 TCP/UDP.
Verify your backup/restore and emergency account-recovery procedures.

For launch arguments and available interfaces, consult official txAdmin documentation and the upstream project .