Everything your Build 42 server is — name, password, PvP, difficulty, mods — lives in two files: servertest.ini (server behaviour) and servertest_SandboxVars.lua (world rules). This is the practical walkthrough of the keys admins actually change, current as of Build 42.20, and the handful of traps around editing them.
Where the files live, and the golden rule
With default -cachedir and -servername:
~/Zomboid/Server/servertest.ini
~/Zomboid/Server/servertest_SandboxVars.lua
Golden rule: edit with the server stopped. The server reads config at boot and can rewrite files on shutdown — an edit made while it runs can be silently lost. Stop, edit, start. (First boot generates both files with defaults — if you don't see them, the server hasn't completed a first run; see the setup guide.)
Identity & access
PublicName=Our Thursday Night Server PublicDescription=Vanilla-ish, PVE, EU evenings. Public=true Password= MaxPlayers=16 Open=true
Public=truelists you in the in-game browser;falsemeans direct-connect only (players use IP:16261).Passwordgates joining — the standard friends-server combo isPublic=false+ a password shared in Discord.Open=trueauto-creates accounts on join.Open=false= whitelist mode: only accounts you create (/adduserfrom the console) get in. The strongest griefer defence there is.MaxPlayers: set what your RAM supports — the honest table is in the RAM guide.
The rules of engagement
PVP=false SafetySystem=true PauseEmpty=true
PVP=falsemakes the server PVE outright. With PVP on,SafetySystemgives players a toggleable protection state so ganking requires mutual opt-in.PauseEmpty=truefreezes the world when the last player leaves — zombies don't migrate, food doesn't rot, generators don't burn fuel at 4am. Keep it on for private servers; 24/7 community servers turn it off deliberately, accepting the cost described in lag and desync fixes.
Persistence & safety nets
SaveWorldEveryMinutes=0 BackupsCount=5 BackupsOnStart=true BackupsOnVersionChange=true
- Periodic world saves plus the server's own rolling backups (count and triggers above).
BackupsOnVersionChangehas earned its keep every B42 patch day. - These are local backups on the same disk — they don't survive the disk. Off-machine copies of the save + config files remain your job (or your host's).
Mods
WorkshopItems=2857548524;2200148440 Mods=tsarslib;Brita
Two lists, semicolon-separated, numeric Workshop IDs in one and Mod IDs in the other, dependencies first. The traps are numerous enough to have their own guides: mods not loading and load order.
Anti-cheat & integrity
B42 retains server-side anti-cheat protections and Lua integrity checking (DoLuaChecksum=true) — defaults are sensible; the occasional legitimate reason to touch them is a mod conflicting with a specific protection type, and the mod's page will say so explicitly. Loosen the specific protection a trusted mod requires, never the whole system: on a public server these settings are what stand between you and item-spawning visitors.
The other file: SandboxVars
servertest_SandboxVars.lua holds the world rules — the same options as single-player sandbox: XP multipliers, loot rarity, zombie population/senses/speed, day length, water/electricity shutoff, and B42's animal-population dials. Two notes:
- It's Lua, not ini — different syntax, same stop-edit-start rule.
- Some choices are world-permanent: population and loot settings bake into already-generated map areas. Change them before launch, not week three; a mid-life change applies unevenly between visited and unvisited cells.
A vanilla-plus baseline that most groups land near: slower XP than solo (the group compensates), loot slightly rarer, population default, day length 2–3 hours real-time.
Loot respawn and corpse cleanup: the keys that keep old worlds alive
Two ini decisions quietly determine whether your world is still pleasant in month three:
HoursForLootRespawn=0 MaxItemsForLootRespawn=4 HoursForCorpseRemoval=216
HoursForLootRespawn=0(never) is the purist default and the correct choice for short-lived hardcore worlds. For a persistent community server it slowly starves the map — every building eventually looted, new joiners finding nothing. A respawn window of several in-game days, paired withMaxItemsForLootRespawnso stockpiled containers don't refill, keeps the map livable without breaking scarcity.HoursForCorpseRemovalmatters twice: atmosphere and performance — thousands of persistent corpses around a base are exactly the kind of tracked world state the lag guide warns about.
Decide both at launch and say so in your server description — "loot respawns weekly" is a feature statement players care about.
A starter ini for a friends server
The complete diff from defaults most private groups actually want:
PublicName=Our Server Public=false Password=ask-in-discord Open=true MaxPlayers=12 PVP=false PauseEmpty=true BackupsOnStart=true BackupsOnVersionChange=true
Everything else can stay default until the group has opinions. Public community servers differ on the obvious lines (Public=true, Open policy, PVP posture) and should read the anti-cheat section above before opening the doors.
Frequently Asked Questions
Why do my setting changes not apply?
Almost always: edited while the server was running. Stop the server, edit, start. Second suspects: edited the wrong profile's file (a custom -servername means differently-named files) or the wrong -cachedir.
What's the difference between servertest.ini and SandboxVars.lua?
The ini is the server — identity, ports, players, mods, backups. SandboxVars is the world — difficulty, loot, zombies, XP. Rule of thumb: if a single-player sandbox screen could set it, it's SandboxVars.
Can I rename servertest to something else?
Yes — run with -servername myserver and the server uses myserver.ini + myserver_SandboxVars.lua and a matching save folder. Players never see the profile name (they see PublicName), so most admins keep the default.
Which settings can't be changed after the world exists?
World-generation-adjacent sandbox choices — population baselines, loot rarity — bake into generated cells. You can change them later but the world applies them inconsistently. Decide those at launch; identity/access/mods keys in the ini are freely changeable forever.
Our Project Zomboid hosting exposes both files with the server-state guard handled — and takes a backup before every config save, so week-three experiments stay reversible.
