How to Secure Your GMod Server

Running a GMod server means running other people's code. Every addon you install is Lua that executes on your server with full access to the game environment. Some of it is malicious. This guide covers how to protect yourself.

Run the Backdoor Scanner

The Zeros Host panel includes a Backdoor Scanner. Open your server, go to the Backdoor Scanner page, and run a full scan. It parses the Lua in your addon files and checks it against known malicious patterns.

The scanner classifies findings by severity:

• Critical: direct code execution vectors like RunString combined with HTTP fetches. These are the signature of a working backdoor. Investigate immediately.
• High: obfuscated code, environment manipulation, or Base64-encoded payloads. Rarely legitimate in community addons.
• Medium: HTTP requests, file writes, or console commands. Sometimes legitimate (update checkers, logging), but worth reviewing in context.

Run the scanner after every addon install. Make it part of your workflow.

Common backdoor patterns

Most GMod backdoors follow a small number of patterns. Knowing what to look for helps you evaluate scan results and spot problems manually:

• RunString from HTTP: the addon fetches a URL with http.Fetch or http.Post, then passes the response body to RunString(). This lets an external server execute arbitrary code on your machine. It is the most common backdoor pattern.
• CompileString: similar to RunString but compiles the code into a function first. Same risk, slightly different implementation.
• Obfuscated payloads: long strings of string.char() calls, hex escapes, or Base64 blobs that decode to Lua code at runtime. Legitimate addons do not hide their source code this way.
• net library abuse: a net.Receive handler that takes a string from any connected client and runs it with RunString. This lets any player on your server execute arbitrary Lua.

Workshop collection hygiene

Do not subscribe to random "DarkRP addon packs" on the Workshop. These collections are often abandoned, contain outdated code, and sometimes include deliberately backdoored addons. Instead, build your collection addon by addon from known sources. If you download a leaked or cracked addon, assume it contains a backdoor until proven otherwise.

When adding a new addon, check its Workshop page. Look at the comments, the last update date, and the author's other uploads. If the addon was uploaded last week by an account with no history, be cautious.

ULX permissions

ULX is the standard admin mod for GMod. Set up permission groups properly from day one:

• Create groups for each staff rank (moderator, admin, superadmin) with only the permissions they need.
• Never give moderators access to ulx rcon, ulx luarun, or ulx cexec. These allow arbitrary code execution.
• Review the default permissions for each group. ULX ships with permissive defaults that you should tighten.
• Use CAMI (the Common Admin Mod Interface) if you run multiple admin tools that need to share permission data.

sv_allowcslua

The server variable sv_allowcslua controls whether clients can run Lua on their own machine while connected to your server. It defaults to 0 (disabled). Some server owners enable it for development or because an addon asks them to.

Do not enable it on a public server. When sv_allowcslua is set to 1, any player can open the Lua console and run arbitrary client-side code. This includes ESP (seeing players through walls), aimbot scripts, and exploits that send malicious net messages to the server.

Keep your server updated

Garry's Mod receives updates that patch security vulnerabilities. Keep your server on the latest version. The same applies to addons. Outdated addons with known vulnerabilities are an easy target. If an addon is no longer maintained by its author, consider finding an actively maintained alternative.

Security is not a one-time setup. It is an ongoing practice. Scan regularly, review what you install, and keep your permissions tight.

The Backdoor Scanner and all the security tools described here are included in every GMod hosting plan on Zeros Host. Start a 24-hour free trial at zerosrp.co.uk/register.