Steam-Only CS 1.6 Server: Configuration and Trade-Offs

A "Steam-only" server is defined by what you do not install: no Reunion, no dproto, nothing that fakes or accepts non-Steam authentication. The engine then validates every joining client against Steam and hands you a real, unique SteamID for each player. That single fact changes how bans, stats and admin flags behave. This covers the configuration and the genuine trade-off you are accepting.

1. What Steam-only actually means

Stock HLDS or ReHLDS, with no non-Steam patch loaded, already is Steam-only. Non-Steam clients connect only when you deliberately add Reunion (for ReHLDS) or dproto (for original HLDS). So building a Steam-only server is mostly about not installing those, plus a few cvars that make the intent explicit and keep the server on the public list. If you have previously experimented with a non-Steam patch, removing it is step one.

2. The core cvars

In server.cfg:

sv_lan 0            // appear on the internet master list, validate via Steam
sv_password ""       // public server (set a value to make it private)
sv_allowdownload 1  // still allow custom content downloads

sv_lan 0 is the critical line: on a LAN server the engine does not perform internet Steam validation, so it must be 0 for a real Steam-authenticated public server. These and the rest are covered in the essential cvars guide.

3. Confirm no non-Steam patch is loaded

If you run Metamod, check its plugin list for a Reunion or dproto entry and remove it:

cat cstrike/addons/metamod/plugins.ini

Any line referencing reunion or dproto means non-Steam clients are being admitted. Delete the line and restart. On ReHLDS specifically, Reunion is the usual culprit; without it, the engine falls back to strict Steam validation.

4. Why the real SteamID matters

With Steam-only, every player carries a genuine, globally-unique STEAM_0:x:xxxxxxx. That gives you:

• Bans that stick. A SteamID ban blocks that account everywhere; the player cannot dodge it by picking a new name.
• Honest stats. A rank system keyed by SteamID never confuses two people, because no two players share an ID.
• Reliable admin flags. Admins added by SteamID cannot be impersonated, unlike name/password admins.

On a non-Steam server, IDs are frequently duplicated or forged, so all three of these become unreliable — two players can share one ID and thus one rank, one ban, or one admin flag.

5. The trade-off, stated honestly

The cost of Steam-only is audience. A large share of the CS 1.6 population, particularly in some regions, still plays non-Steam clients, and they simply cannot join a Steam-only server — they are rejected at validation. You are trading raw player count for integrity. Decide by your goal:

• Competitive, stats-driven, or heavily-moderated community — Steam-only is the right call. Integrity beats headcount.
• Maximum population, casual public play — you may want to admit non-Steam clients via the non-Steam guide, accepting the weaker identity model.

There is no universally correct answer; there is only which trade you are making with eyes open.

6. Optional: reduce spoofing further

Even Steam-only servers see occasional connection issues after Valve updates. Keep the engine current (ReHLDS is actively maintained and validates cleanly), and if the 25th Anniversary update broke client connections, the steam_legacy branch is the known rollback on the client side. Do not paste in cvars claiming to "force Steam validation" beyond sv_lan 0 — validation is engine behavior, not a magic cvar.

Troubleshooting

• Non-Steam players still join — a Reunion or dproto plugin is loaded. Check addons/metamod/plugins.ini and remove it.
• Nobody can join and the server is not listed — sv_lan 1 disables internet validation and listing. Set it to 0.
• Legitimate Steam players rejected after a Valve update — an engine/version mismatch. Update ReHLDS/HLDS, and have affected clients try the steam_legacy branch.
• Two players share a rank — you are not actually Steam-only; a non-Steam patch is handing out colliding IDs.

Verification

Join your own server and open the console; run status. Every connected player should show a proper STEAM_0: ID rather than VALVE_ or a duplicated pattern. Then confirm the server appears in the internet tab with sv_lan 0. If real SteamIDs show and non-Steam clients are refused, your server is genuinely Steam-only and your bans and stats will behave as intended.