---
title: "Steam-Only CS 1.6 Server: Configuration and Trade-Offs"
excerpt: "How to run a server that admits only legitimate Steam clients, why that gives you reliable SteamIDs, and the honest audience trade-off versus allowing non-Steam players."
category: "installation"
tags: "steam, config"
image: ""
read_time: "8 min read"
---
<p>A "Steam-only" server is defined by what you <em>do not</em> install: no <a href="/tutorials/install-reunion">Reunion</a>, no <a href="/tutorials/install-dproto">dproto</a>, nothing that fakes or accepts non-Steam authentication. The engine then validates every joining client against Steam and hands you a real, unique SteamID for each player. That single fact changes how bans, stats and admin flags behave. This covers the configuration and the genuine trade-off you are accepting.</p>
<h2>1. What Steam-only actually means</h2>
<p>Stock HLDS or ReHLDS, with no non-Steam patch loaded, already <em>is</em> Steam-only. Non-Steam clients connect only when you deliberately add Reunion (for ReHLDS) or dproto (for original HLDS). So building a Steam-only server is mostly about <strong>not</strong> installing those, plus a few cvars that make the intent explicit and keep the server on the public list. If you have previously experimented with a non-Steam patch, removing it is step one.</p>
<h2>2. The core cvars</h2>
<p>In <a href="/tutorials/setup-server-cfg-cs16">server.cfg</a>:</p>
<pre>sv_lan 0            // appear on the internet master list, validate via Steam
sv_password ""       // public server (set a value to make it private)
sv_allowdownload 1  // still allow custom content downloads</pre>
<p><code>sv_lan 0</code> is the critical line: on a LAN server the engine does not perform internet Steam validation, so it must be <code>0</code> for a real Steam-authenticated public server. These and the rest are covered in <a href="/tutorials/essential-server-cvars">the essential cvars guide</a>.</p>
<h2>3. Confirm no non-Steam patch is loaded</h2>
<p>If you run Metamod, check its plugin list for a Reunion or dproto entry and remove it:</p>
<pre>cat cstrike/addons/metamod/plugins.ini</pre>
<p>Any line referencing <code>reunion</code> or <code>dproto</code> means non-Steam clients are being admitted. Delete the line and restart. On ReHLDS specifically, Reunion is the usual culprit; without it, the engine falls back to strict Steam validation.</p>
<h2>4. Why the real SteamID matters</h2>
<p>With Steam-only, every player carries a genuine, globally-unique <code>STEAM_0:x:xxxxxxx</code>. That gives you:</p>
<ul>
<li><strong>Bans that stick.</strong> A SteamID ban blocks that account everywhere; the player cannot dodge it by picking a new name.</li>
<li><strong>Honest stats.</strong> A <a href="/tutorials/install-amx-mod-x-1-9">rank system</a> keyed by SteamID never confuses two people, because no two players share an ID.</li>
<li><strong>Reliable admin flags.</strong> Admins added by SteamID cannot be impersonated, unlike name/password admins.</li>
</ul>
<p>On a non-Steam server, IDs are frequently duplicated or forged, so all three of these become unreliable &mdash; two players can share one ID and thus one rank, one ban, or one admin flag.</p>
<h2>5. The trade-off, stated honestly</h2>
<p>The cost of Steam-only is audience. A large share of the CS 1.6 population, particularly in some regions, still plays non-Steam clients, and they simply cannot join a Steam-only server &mdash; they are rejected at validation. You are trading raw player count for integrity. Decide by your goal:</p>
<ul>
<li><strong>Competitive, stats-driven, or heavily-moderated community</strong> &mdash; Steam-only is the right call. Integrity beats headcount.</li>
<li><strong>Maximum population, casual public play</strong> &mdash; you may want to admit non-Steam clients via <a href="/tutorials/make-server-accept-nonsteam">the non-Steam guide</a>, accepting the weaker identity model.</li>
</ul>
<p>There is no universally correct answer; there is only which trade you are making with eyes open.</p>
<h2>6. Optional: reduce spoofing further</h2>
<p>Even Steam-only servers see occasional connection issues after Valve updates. Keep the engine current (ReHLDS is actively maintained and validates cleanly), and if the 25th Anniversary update broke client connections, the <code>steam_legacy</code> branch is the known rollback on the client side. Do not paste in cvars claiming to "force Steam validation" beyond <code>sv_lan 0</code> &mdash; validation is engine behavior, not a magic cvar.</p>
<h2>Troubleshooting</h2>
<ul>
<li><strong>Non-Steam players still join</strong> &mdash; a Reunion or dproto plugin is loaded. Check <code>addons/metamod/plugins.ini</code> and remove it.</li>
<li><strong>Nobody can join and the server is not listed</strong> &mdash; <code>sv_lan 1</code> disables internet validation and listing. Set it to <code>0</code>.</li>
<li><strong>Legitimate Steam players rejected after a Valve update</strong> &mdash; an engine/version mismatch. Update ReHLDS/HLDS, and have affected clients try the <code>steam_legacy</code> branch.</li>
<li><strong>Two players share a rank</strong> &mdash; you are not actually Steam-only; a non-Steam patch is handing out colliding IDs.</li>
</ul>
<h2>Verification</h2>
<p>Join your own server and open the console; run <code>status</code>. Every connected player should show a proper <code>STEAM_0:</code> ID rather than <code>VALVE_</code> or a duplicated pattern. Then confirm the server appears in the internet tab with <code>sv_lan 0</code>. If real SteamIDs show and non-Steam clients are refused, your server is genuinely Steam-only and your bans and stats will behave as intended.</p>