Windrose Plus RCON Dashboard Guide
How to open the Windrose Plus web dashboard, what its two tabs contain, and the HTTP API behind them.
Opening the dashboard
Go to the Windrose Plus tab in your server panel. Windrose Plus is on every Windrose server (GameGrid installs it), and the tab has a "Live Dashboard" row with an "Open Dashboard" link and, beside it, the port it is on and the words "TLS-proxied".
Click that link. GameGrid checks you are signed in and that the server is yours, then opens the dashboard in a new tab on its own secure address (wpdash.wdcgamegrid.com) with a one-time link that works once, for about a minute.
You cannot reach the dashboard by typing an address and port into a browser. Its HTTP port — your base port + 80 — is firewalled to the host itself, deliberately, so a plain-HTTP admin console is never exposed to the internet. The proxied link in the panel is the only route.
The dashboard does not ask you for a password. It opens already signed in: the platform relays it from the game host itself, through the host agent, and the dashboard treats that relay as a caller who has already been authenticated — which you have been, before anything is relayed.
Your GameGrid account is the gate instead. Anyone signed in with access to that server can open the dashboard and read it — the status panel, the RCON log, the Sea Chart. Anything that changes something — running a command from the console tab, a kick or a ban, a configuration write — additionally needs the permission that lets you change that server’s settings, so a view-only account can watch the dashboard but cannot act from it.
The RCON password has not gone away. It is what Windrose Plus itself uses. A random one is generated when GameGrid installs Windrose Plus, and you can reveal it at any time with the eye icon beside the RCON Password field. It is what anything reaching the dashboard directly on the game host, rather than through the panel link, logs in with.
What is on it
Two tabs: CONSOLE and SEA CHART.
The console tab is the admin console. Type a command and it runs against the game; there is autocomplete and a command reference panel you can expand, and the commands themselves are covered in Windrose Admin Commands Reference.
Beside the console it shows the server’s name, the Windrose version, the Windrose Plus version, the game port, the invite code, whether a password is set, the player count against the maximum, the live player list, and the gameplay multipliers Windrose Plus currently has applied.
There is also an RCON log — every command run through the dashboard, with a count — and a "Repair character save" tool for uploading a character save zip when one has gone bad.
The SEA CHART tab is the live map. See Windrose Plus Live Map (Sea Chart) Guide.
What is NOT on it, despite what you may have read: there is no CPU or memory graph, no configuration viewer and no mod manager. For CPU and memory use the Resource Usage card on your server’s Overview tab, which shows your game process’s own figures refreshed every 10 seconds. For configuration, use the Windrose Plus tab in the panel.
The RCON settings
Both live on the Windrose Plus tab, under RCON / Admin Console.
Enable RCON (default true): the dashboard’s command channel. Turn it off and the dashboard has nothing to run commands with.
RCON Password: the mod’s own admin password, not something the panel link asks you for. Type a new one and press "Save Changes" to replace it; the field shows "Password is set" rather than the value until you press the eye icon. Saving a new password is flagged as needing a server restart.
Anyone with this password has full admin control of your game server through the dashboard. Treat it like the admin password it is, and do not reuse your GameGrid password for it.
The HTTP API
The dashboard is a small HTTP server and its own endpoints are available to anything that can reach it. In practice that means a script running on the same machine, or a request through the platform’s authenticated proxy — the port itself is not open to the internet.
Everything except /api/health is authenticated. Through the panel’s Open Dashboard button that is a sign-in for this server, made from your GameGrid account and checked on every request: a read goes through if your account can view the server, and the endpoints that change something — POST /api/rcon, POST /api/character-repair — need the permission that lets you change server settings. A caller reaching the dashboard directly on the game host logs in with the RCON password instead, which sets a session cookie that lasts 24 hours.
GET /api/health — no authentication. Status, version and timestamp.
GET /api/status — server name, version, player list, multipliers.
GET /api/livemap — live player, creature and resource-node positions.
GET /api/pois, GET /api/layout, GET /api/layout/runtime, GET /api/runtime-overlay, GET /api/mapinfo, GET /api/terrain_height — the map’s overlays, layout and coordinate metadata.
GET /api/config — the current Windrose Plus configuration, with the RCON password masked.
GET /api/commands — the command documentation the console autocompletes from.
GET /api/pak-status — whether the override PAK matches the current settings.
GET /api/rcon/log — the recent command audit log. POST /api/rcon — run a command.
POST /api/character-repair — the character-save repair tool.
There is no /api/mods endpoint. Earlier versions of this article listed one; it does not exist.
The /api/public/* family and /public-map serve the public map and are gated by the public-map setting rather than by the cookie — see the live map guide for what that does and does not currently allow.
Security
The dashboard is not on the public internet. It is reached on its own secure address, wpdash.wdcgamegrid.com, with a one-time link the panel gives only a signed-in GameGrid account with access to that server. That account is the gate: access to the server to open the dashboard and read it, and the permission to change the server’s settings to run anything from the console.
The auto-generated password is 16 characters from an alphabet that leaves out the easily-confused ones. If you set your own, make it at least as strong; the dashboard will refuse an empty one and the mod’s shipped default.
The RCON password is never shown in Discord. The /windrose commands refuse password fields on purpose, because a Discord slash command publishes its options to the channel.
Check /api/rcon/log, or the log panel in the console tab, if you want to see what has been run and when.