When Imunify360 manages the firewall, it replaces tools like CSF. Besides IP lists, it controls which ports are open, can block whole countries and protects against simple denial-of-service attempts. Getting the port list right is essential: closing the wrong port takes services offline.
MdmHost manages this on its hosting plans. This guide is for administrators of their own cPanel server with root access.
Before you start
- Imunify360 installed (see installing Imunify360).
- Your admin IP whitelisted first (see firewall lists).
- Console access from your provider in case of lockout.
Port settings
- Go to WHM → Plugins → Imunify360 → Settings → Firewall (port options may be under Blocked ports or similar, depending on version).
- Review open TCP and UDP ports. A cPanel server typically needs:
| Port | Service |
|---|---|
| 80, 443 (TCP), 443 (UDP) | Websites, HTTP/3 |
| 2082–2083, 2086–2087, 2095–2096 | cPanel, WHM, Webmail |
| 25, 465, 587 | SMTP |
| 110, 995, 143, 993 | POP3, IMAP |
| 21 and passive range | FTP |
| 53 (TCP/UDP) | DNS, if the server hosts DNS |
| 22 or custom | SSH |
Close ports for services you do not run, such as FTP if customers only use SFTP.
Warning: If you move SSH to a custom port, open the new port in Imunify360 before changing sshd_config, and test a new session before closing the old one.
Country blocking
You can block or whitelist countries for all services or specific ports. Blocking countries where you have no customers reduces attack traffic, but can lock out travelling customers and remote staff. Prefer blocking for admin ports only, such as SSH and WHM.
DoS protection
Enable Imunify360's DoS protection to block IPs opening excessive numbers of connections. Combine it with LiteSpeed's per-client throttling for HTTP floods (see LiteSpeed anti-DDoS). Large network attacks still need upstream filtering by the data centre.
Check after changes
- Test websites, cPanel, WHM, Webmail, IMAP and SMTP from an outside network.
- Watch the Incidents tab for unexpected blocks (see Incidents log).
Troubleshooting
A service is unreachable after a change
Re-open its port, or use the CLI from the console. Check imunify360-agent config show for the current port settings (see CLI commands).
Frequently asked questions
Can I still use CSF?
Running CSF and the Imunify360 firewall together causes conflicts. Use one firewall manager.
Do port changes affect customers?
Closing ports used by customers (for example FTP) breaks their tools. Announce changes and suggest alternatives such as SFTP.
How do I block one IP immediately?
Add it to the blacklist in the Imunify360 Firewall tab or with imunify360-agent blacklist ip add.
Which FTP passive range should I open?
The range set in your FTP server configuration (Pure-FTPd or ProFTPD). Open exactly that range, or passive transfers will hang.
Should I close port 2082 and 2086?
They are the unencrypted cPanel and WHM ports. Closing them forces users to the secure 2083 and 2087, which is good practice once you announce it.