7 Days to Die serverconfig.xml: the settings worth changing

Four groups of properties in serverconfig.xml shape a 7 Days to Die server: the ones that decide who finds and joins it (ServerName, ServerVisibility, Region, ServerMaxPlayerCount), the world it runs (GameWorld, WorldGenSeed, WorldGenSize), what it costs to run (MaxSpawnedZombies, ServerMaxAllowedViewDistance) and land claims. Since V3.0, difficulty, blood moons, day length and loot are set through one SandboxCode property instead.

What moved into SandboxCode

V3.0, "Dead Hot Summer", added around 150 sandbox options, and The Fun Pimps took thirty legacy properties out of serverconfig.xml to make room for them. They include GameDifficulty, XPMultiplier, DayNightLength and DayLightLength, the four BloodMoon settings, LootAbundance, LootRespawnDays, AirDropFrequency, the zombie speed settings and DropOnDeath. Guides written before mid-2026 still tell you to edit those lines, but TFP lists them as removed, and on a 3.x server their values come from one encoded string.

The route TFP gave server admins:

1. In the game, build the settings you want in the Sandbox Options menu, or start from one of the presets.
2. Copy the code the menu produces.
3. Paste it as the value of <property name="SandboxCode" value="..."/> in serverconfig.xml.
4. Restart the server.

The default value, AAAJABJACJADJARFBNC, is TFP's equivalent of the old default difficulty, Adventurer. The string itself tells you nothing, so keep a comment beside it saying what it sets, and keep the previous code in case you need to roll back.

Being found, and who gets in

ServerName, ServerDescription and ServerWebsiteURL are what the in-game server browser shows, and ServerPassword locks the door. ServerVisibility takes 2 for public, 1 for friends only and 0 for unlisted; the comment in the file warns that 1 only works once the first player has connected by IP, since nobody is ever friends with a dedicated server. Region and Language are browser filters, and when TFP added them in A20.4 they warned that a server with no region set can't be found.

ServerPort defaults to 26900. The file's comment suggests staying within 26900 to 26905 or 27015 to 27020 if PCs on the same LAN should see it, and if you move it, move your port forwarding with it. ServerMaxPlayerCount defaults to 8.

ServerAllowCrossplay lets PS5 and Xbox Series players onto a dedicated server, which 2.0 made possible. Consoles only accept settings inside their limits, and since 2.3 the server raises a startup error when crossplay is on and the config falls outside them. When crossplay first arrived, TFP gave those limits as eight players and a world size of 8192.

Picking the world

GameWorld is Navezgane, the hand-made map, or one of the pregenerated worlds named in the file's comment, or RWG for a random world. With RWG, WorldGenSeed and WorldGenSize decide the map. The size must be a multiple of 2048, and the comment is blunt that large sizes take a long time to generate, download and load. The world is generated on the first start with that seed; if a world with the resulting name already exists, the server simply loads it. GameName names the save and seeds where decorations such as trees go, without changing the layout of an RWG map.

A client without the world downloads it on first connect, no faster than ServerMaxWorldTransferSpeedKiBs allows, so every new player pays for a bigger map with a longer first join. Players arriving fresh can follow the install and join guide.

What costs CPU and memory

MaxSpawnedZombies caps zombies across the whole map at once, and the file's own comment says changing it has a huge impact on performance. MaxSpawnedAnimals matters less, since animals cost less CPU than zombies, and raising it only helps when players are spread out enough to hit the cap. ServerMaxAllowedViewDistance limits the view distance clients may request, from 6 to 12, and is flagged as heavy on memory. The Dynamic Mesh options draw changes to distant buildings, player bases included, and the server shares those meshes with players who join; a bigger DynamicMeshMaxItemCache uses more RAM.

Horde night is the real load test: whatever blood moon count you put in the sandbox code, run the worst night with a full server before promising anyone a slot. Which parts of the hardware matter is covered separately, and hosting at home has its own limits.

Land claims

LandClaimCount sets how many keystones a player may place, LandClaimSize how many blocks each protects, and LandClaimDeadZone how far apart keystones must be unless their owners are friends. LandClaimExpiryTime is the number of days a player can be offline before their claims stop protecting anything, and LandClaimDecayMode sets how protection fades until then: 0 slow, 1 fast, 2 full protection up to expiry. The online and offline durability modifiers multiply block hardness inside a claim, with 0 meaning the blocks can't be damaged, and LandClaimOfflineDelay is the minutes after logout before the offline value applies. On a PvP server the offline modifier decides whether an absent player's base can be raided, so set it on purpose and state it in your rules.

EAC, telnet and the web dashboard

EACEnabled switches EasyAntiCheat. Leave it on for a public server, and for crossplay, which TFP tied to EAC when crossplay launched. Telnet (TelnetEnabled, TelnetPort, TelnetPassword) gives a remote console, and with no password it only listens on the loopback interface, so only the machine itself can reach it. Set a password and it becomes reachable from the network, in plain text, so firewall that port. Remote consoles in general carry the same risks.

The web dashboard replaced the old control panel in A21: WebDashboardEnabled turns it on, WebDashboardPort sets its TCP port, WebDashboardUrl holds the full address when it sits behind a reverse proxy, and EnableMapRendering draws the map tiles it shows. API tokens go in serveradmin.xml, the file AdminFileName points to, or are created with the webtokens command.

Where the saves are

On Windows the default is %APPDATA%\7DaysToDie for the account that runs the server, holding the saves and the GeneratedWorlds folder where RWG maps go. UserDataFolder relocates everything the server generates, RWG worlds included, while SaveGameFolder moves only the saves. If they're commented out in your file, uncomment the one you use. On Linux, set UserDataFolder to a path you chose, and back up each generated world together with its save.

Changing settings after the world exists

The server reads serverconfig.xml when it starts (the start script passes it with -configfile), so every change needs a restart. Some changes don't touch the running world at all: a new GameName, WorldGenSeed or WorldGenSize points the server at a different save or world, which is how people lose a map they thought they were adjusting. Gameplay goes through SandboxCode, and when 3.0 arrived, TFP's route for carrying a 2.6 save forward was to rebuild the old values in the Sandbox Options menu and paste in the code.

New content is the other reason for a fresh start. In A21.1 TFP noted that newly added POIs only appear in newly created worlds, and they recommend a new game with every update, although 3.x point releases have kept saves working; for 3.1 they said a new game isn't required. The 3.2 notes for hosts cover the latest. Plan wipes around the big versions, announce them early and copy the old world first, because the 7 Days to Die server list is where returning players will look for your new map.