ConfigServer Security & Firewall (CSF) is the most widely used host firewall on cPanel servers. It wraps iptables/nftables in a simple config file, adds a WHM interface, and ships with LFD (Login Failure Daemon), which watches logs and temporarily blocks IPs that brute-force SSH, cPanel, FTP or email.
This guide installs CSF on a server you manage as root and sets the options that matter most.
Before you start
- Root SSH access to a cPanel/WHM server (VPS or dedicated). On MdmHost shared and reseller hosting the firewall is managed for you.
- Make sure no other firewall is active. Stop
firewalldfirst, and do not run CSF alongside the Imunify360 firewall unless you follow Imunify360's integration notes. - Have your own public IP ready (check it with the IP checker) so you can allow it first.
- Keep a second way into the server, such as a VNC/console from your provider, in case you lock yourself out. See firewall lockout recovery.
Install CSF
- Log in over SSH as root. See connect to a Linux VPS with SSH.
- Disable firewalld if it is running:
systemctl disable --now firewalld - Download and run the installer:
cd /usr/src && curl -LO https://download.configserver.com/csf.tgz && tar -xzf csf.tgz && cd csf && sh install.sh - Check that the required kernel modules are present:The last line should say RESULT: csf should function on this server.
perl /usr/local/csf/bin/csftest.pl - Allow your own IP straight away:
csf -a 203.0.113.10 "admin office"
Note: The ConfigServer project changed hands in 2025. If the download URL above stops working, use the current official CSF repository named by cPanel's documentation; the configuration and commands stay the same.
Set the essential csf.conf options
Open WHM → Plugins → ConfigServer Security & Firewall → Firewall Configuration, or edit /etc/csf/csf.conf. Review these settings:
| Option | Recommended | What it does |
|---|---|---|
TESTING | 0 (after testing) | In testing mode a cron job flushes all rules every 5 minutes. |
TCP_IN / TCP_OUT | Only ports you use | Allowed ports. See open and close ports in CSF. |
RESTRICT_SYSLOG | 3 | Only root can write to syslog, stopping log spoofing. |
LF_SSHD, LF_CPANEL, LF_SMTPAUTH | 5–10 | Failed logins before LFD blocks the IP. |
LF_TRIGGER_PERM / LF_PERMBLOCK | On | Turns repeated temporary blocks into permanent ones. |
CT_LIMIT | 150–300 | Connection tracking: blocks IPs with too many open connections. |
SMTP_BLOCK | 1 | Stops scripts sending mail directly, a common sign of a hacked site. |
LF_ALERT_TO | Your email | Where LFD sends alerts. |
Click Change, then Restart csf+lfd.
Take CSF out of testing mode
- Confirm you can still open WHM, cPanel, webmail and SSH from a new session.
- Set
TESTING = "0"and restart:csf -ra - Make sure both services start at boot:
systemctl enable csf lfd
Check it is working
- Run
csf -lto list active rules, andsystemctl status lfdto confirm LFD is running. - In WHM run Check Server Security on the CSF page and fix the warnings that apply to you.
- Test from outside that closed ports really are closed; see check open ports on Linux.
Troubleshooting
- Locked out after enabling: use the provider console and run
csf -xto disable CSF, then add your IP and re-enable withcsf -e. - A customer cannot connect: search for their IP with
csf -g 198.51.100.7; see unblock an IP in WHM CSF. - Too many alert emails: tune LFD as described in tune LFD alerts and blocking.