TShock for Terraria servers: what it adds and when to skip it

TShock is a modified Terraria server that you run in place of Re-Logic's own. It adds what the vanilla dedicated server lacks: player accounts, permission groups, protected regions, server-side characters, proper bans and a REST API. Use it on any server strangers can join. Skip it for a private world shared with a few friends, or when you must run each new Terraria patch the day it ships.

What the vanilla server already does

Re-Logic's dedicated server is TerrariaServer.exe in the Steam install folder on Windows, with a separate download for Linux. Start it with -config serverconfig.txt and it reads keys such as world, autocreate, worldname, difficulty, maxplayers (up to 255), port (7777 by default), password, motd, banlist and secure, which turns on basic cheat protection. The console adds kick, ban, save and exit.

That is the whole toolkit. There is one password for everyone and nobody has a role. Players also arrive with whatever character they built elsewhere, items included. Among friends none of that matters, and whether a dedicated server is worth it at all is the better question. The player's side is in getting the game installed and connected.

What TShock adds

TShock 6 runs on .NET 9 and keeps its data in a tshock folder: config.json, sscconfig.json and, by default, the SQLite database tshock.sqlite. StorageType switches to MySQL, or to PostgreSQL, which TShock 6 added.

Accounts come first. Players use /register and /login, and RequireLogin in config.json keeps anyone without an account from playing. Every account belongs to a group, and the default groups form a chain in which each inherits from the one before: guest, default, vip, newadmin, admin, trustedadmin, owner. /group addperm <group> <permission> and /group parent <group> <parent> reshape it; read how inheritance holds up before adding ten custom groups.

Regions protect areas. Type /region set 1 and hit a block for one corner, /region set 2 and hit another for the opposite corner, then /region define spawn. A new region is protected from the start, and /region allow <player> <region> or /region allowg <group> <region> lets builders back in. Check the separate spawn radius (SpawnProtection, SpawnProtectionRadius, 10 tiles) in your own config: the current source ships it off, while older documentation lists it as on.

Bans cover account, UUID and IP together. /ban add <player> "Griefing" applies all three unless you pass flags, and a duration such as 10d30m0s can follow the reason. Individual items can be banned with /itemban, and projectiles and tiles with /projban and /tileban. When a griefer gets through anyway, the clean-up after a griefing incident takes over.

The REST API is off by default (RestApiEnabled) and listens on port 7878 when switched on, with access controlled by tokens. Keep that port behind a firewall; the argument for keeping RCON off the open internet applies unchanged.

First run and the setup code

1. Install the .NET 9 runtime, extract the TShock release for your platform and start TShock.Server (TShock.Server.exe on Windows). Passing -world, -port and -maxplayers skips the interactive prompts.
2. The console prints a line asking you to join and type /setup with a numeric code. The same code is saved in tshock/setup-code.txt.
3. Join and type /setup <code>. This grants temporary access for one command.
4. Create your permanent account with /user add <name> <password> owner.
5. Log in with /login <name> <password>, then type /setup again to switch the system off.

Once an account exists, TShock disables the setup system and writes setup.lock. Play day to day as owner: TShock's documentation advises against superadmin, which among other things bypasses server-side characters.

What server-side characters change

Set Enabled to true in sscconfig.json and the server owns inventories. New players start with the StartingInventory, StartingHealth (100) and StartingMana (20) you define, and their progress is saved on the server every five minutes by default. Their own character stays untouched on their PC, but nothing from it comes in. That is the point: without SSC, anyone can walk in carrying an item they spawned in single-player.

Players notice. A regular who expected to bring a late-game character starts again, so announce the change first. For people you trust, /uploadssc imports their character as it was when they joined, and /overridessc saves their current state.

Plugins

Plugins are .dll files in the ServerPlugins folder, built against TShock's API. TShock 6 changed the .NET version beneath them, and its first pre-release warned that plugins "almost certainly need to be rebuilt". The -ignoreversion switch loads plugins that fail the API version check, which only means you find out about an incompatibility later. Look for a build that names your TShock version.

Backups

TShock copies the world file to tshock/backups every BackupInterval minutes (10 by default) and keeps each copy for BackupKeepFor minutes (240). Accounts, groups, regions, bans and SSC inventories live in the database, so tshock.sqlite, or a dump of MySQL or PostgreSQL, needs its own backup kept off the machine. Four hours of rolling copies will not rescue you from damage nobody noticed until the weekend either, so keep dailies elsewhere; what to save and how goes through the options.

When Terraria updates before TShock does

TShock runs on OTAPI, a patched build of Re-Logic's server, so every Terraria release has to be patched and rebuilt before TShock supports it. In 2026, Terraria 1.4.5 arrived on 27 January and the first stable TShock for it, 6.0 for 1.4.5.5, on 8 March. Hotfix 1.4.5.6 came out on 9 March and TShock 6.1 two days later. Versions 1.4.5.7 and 1.4.5.8 followed on 19 and 23 August, and TShock 6.2.1, for 1.4.5.8, arrived on 27 September.

Meanwhile, players whose game has updated cannot join, because Terraria only connects to a server on the same version. Tell them in advance where the news will be posted. Think before starting the world on the vanilla server to fill the gap: vanilla does not read TShock's database, so regions protect nothing and players bring their own characters in. When the new build lands, back up the whole server folder, as TShock's release notes insist, and follow your usual update routine.