How to Set Up a Whitelist on Your FiveM Server

A whitelist restricts your FiveM server so that only pre-approved players can connect. It is a powerful tool for maintaining community quality on serious roleplay servers, but it comes with real trade-offs. This guide covers everything: how to decide if you need one, how to install one, and how to manage it effectively.

Should You Whitelist Your Server?

Whitelisting is not the right choice for every server. Before setting one up, consider these trade-offs honestly.

Benefits of whitelisting:

• Full control over who joins your community before they ever connect
• Dramatically reduced griefing, trolling, and low-effort RP
• Stronger community identity — every member chose to be there
• Easier to hold players accountable (they applied under a known identity)
• Players who go through an application process are more invested from day one

Downsides of whitelisting:

• Significantly slows player count growth — new players cannot just try your server
• Requires dedicated staff time to review and process applications
• Creates a barrier that some legitimate players will not bother crossing
• Can lead to a stagnant community if application approval is too selective

Whitelist is right for you if you are targeting a serious, quality-focused roleplay community where player conduct and immersion are the top priority.

Whitelist is probably wrong for you if you are just starting out and need to build a player base quickly, or if your server type (racing, survival, casual) does not require strict conduct standards.

---

Option 1: Database-Backed Whitelist Script

The most common and flexible approach. A whitelist resource checks connecting players against a table in your MySQL database.

How it works:

1. A player tries to connect to your server
2. The whitelist script intercepts the connection
3. It checks the player's identifier (license, Steam ID, Discord ID) against the whitelist table
4. If found — the player connects normally
5. If not found — the player receives a rejection message with instructions to apply

Installation:

1. Download a whitelist resource compatible with your framework (e.g. qb-whitelist for QBCore)
2. Place it in your resources folder
3. Import the SQL file to create the whitelist table:

mysql -u root -p your_database < whitelist.sql

4. Add it to server.cfg before your framework so it intercepts connections early:

ensure whitelist
ensure qb-core

5. Configure the rejection message in config.lua:

Config.DeniedMessage = 'You are not whitelisted. Apply at discord.gg/yourserver'

Adding a player to the whitelist:

INSERT INTO whitelist (identifier) VALUES ('license:abc123def456789');

Most whitelist scripts also provide an in-game command for admins:

/whitelist add [playerid]

---

Option 2: Discord Role-Based Whitelist

A popular alternative that lets staff manage access entirely from Discord without touching the database. Players must be in your Discord server and have a specific role to connect.

How it works:

1. Player applies in your Discord and gets approved
2. Staff give them the "Whitelisted" role in Discord
3. When the player tries to connect, the whitelist script checks via your Discord bot if they have the required role
4. If they have the role — they connect
5. If not — they receive a message telling them to join Discord and apply

Setup requires:

• A Discord bot with guilds.members.read scope enabled
• Your bot token and guild ID configured in the whitelist script
• A specific Discord role ID designated as the whitelist role

This approach is popular because it integrates naturally with Discord-based application workflows.

---

Building a Whitelist Application Process

A whitelist is only as good as the process behind it. Here is a practical setup:

Application channel: Create a #whitelist-applications forum channel in your Discord. Require applicants to answer:

• Discord username and in-game name
• Age (if you have a minimum age requirement)
• Roleplay experience and previous servers
• Short character backstory
• Agreement to server rules

Review process: Have at least two staff members review each application independently before a decision is made. Set a target response time — 48 hours is reasonable and prevents applications from sitting unanswered for days.

Approval flow:

• Approved: Give the player the whitelist role in Discord (if Discord-based) or add their license identifier to the database. Send a welcome message with how to connect and what to expect.
• Denied: Send a private, polite message explaining why their application was declined and whether they can reapply and when.

Probationary period: Consider giving new members a 2-week trial period where they are whitelisted but easier to remove if they do not fit the community.

---

Player Identifier Types

When adding players to a database whitelist, you need their identifier. The most reliable identifiers in 2025 are:

• license: — Rockstar license key. Consistent across platforms. Recommended.
• steam: — Steam hex ID. Only works if the player uses Steam.
• discord: — Discord ID. Useful if you use Discord OAuth.

To find a player's identifier, check the server console when they connect, or use a resource like esx_multichar or qb-multicharacter which logs identifiers.

---

Removing Players from the Whitelist

When banning a player, always remove them from the whitelist table at the same time. Otherwise they can rejoin with a fresh identifier and get a confusing error instead of seeing your ban message.

DELETE FROM whitelist WHERE identifier = 'license:abc123def456789';

Most mature ban scripts handle this automatically — verify this is the case for your setup.

---

Browse whitelist scripts and player management tools at modforge.xyz.