SourceMod admins and immunity, done properly

Almost every Source server that has ever been compromised from the inside was compromised the same way: somebody was given a flag they did not need, and the flag they did not need was z.

SourceMod's admin system is small and well documented. It is also the part of a server most often configured by copying a config from a friend, which is how servers end up handing root to a donor who paid three pounds for a coloured tag.

The two files, and which one you want

AlliedModders documents adding admins) two ways. admins_simple.ini is a flat list: one identity, one set of flags, one line. admins.cfg defines groups with inherited flags, and assigns people to groups.

Use admins.cfg. The flat file is faster to start with and becomes unmaintainable at about the fifth admin, because every change is a change to individual people rather than to a role. When you promote someone, you want to move them between groups, not audit a line of letters.

Flags are capabilities, not ranks

The flags are single letters and each one is a specific power. b is generic admin, c kick, d ban, e unban, f slay, g map change, j custom, and so on down the alphabet.

z is root. Root is not "the highest rank": it is every flag, including ones added later by plugins you have not installed yet. Giving somebody z grants them access to things that do not exist on your server today. That is the part people miss.

Almost nobody needs z. The owner needs it. A senior admin needs bcdefg and probably not z. Write out what each role actually does, then grant exactly those letters. It takes twenty minutes once and it is the cheapest security work on the whole box: cheaper than anything in the general security pass, because it needs no software.

Immunity, which is not a flag

Immunity is a number, separate from flags, and it decides who can act on whom. A higher immunity level cannot be kicked, banned or slayed by a lower one.

The default trap: everybody is created at the same immunity level, and at equal levels SourceMod's default allows the action. So your moderators can ban each other, and (more to the point) a compromised moderator account can ban your entire staff before anybody notices.

Set immunity in bands with real gaps. Owner 100, senior 80, admin 50, moderator 20, trusted 10. Gaps rather than consecutive numbers, so you can insert a role later without renumbering everybody.

Identities, and the one that is a mistake

An admin entry is keyed on an identity: a Steam ID, an IP, or a name with a password. Steam ID is the only one to use, and it is the same identifier every serious anti-cheat and ban system keys on, for the same reason: it is the only one the player cannot change on a whim.

Name-with-password exists for historical reasons and means anybody who learns the password is that admin. IP-based entries break the day somebody's router reboots, and grant admin to whoever gets that address next on a residential ISP. Both are in the documentation because the system is old, not because they are advisable.

Reloading, and the mistake that follows it

Admin changes do not take effect until they are reloaded: sm_reloadadmins from console. The failure mode is editing the file, testing in-game, seeing no change, assuming the syntax is wrong, and editing it again. Now you have two problems and no idea which edit caused what.

Change one thing. Reload. Test. This is the same discipline that makes a crash actually diagnosable, and it is the same reason people skip it.

Before any of this works

SourceMod needs Metamod:Source underneath it, and the installation order matters — Metamod first, confirmed loading with meta list, then SourceMod on top. Installing them together and finding neither loads is a bad afternoon, and the cause is almost always a version mismatch against the game's own updates.

That coupling is worth remembering every time the game updates. A Source engine update can break the pair on a Tuesday afternoon with no warning, and every plugin goes down together. Servers that survive that well are the ones that pinned versions deliberately and know which build they are on, which is the same habit that separates a server that recovers from an update from one that is quietly dying while nobody checks the console.