How to Install CSF on a cPanel Server: Complete Step-by-Step Guide
CSF (ConfigServer Security & Firewall) is a popular firewall management solution for cPanel & WHM servers. It provides an easy-to-use interface for managing firewall rules, blocking malicious IP addresses, whitelisting trusted addresses, and monitoring suspicious login activity through LFD (Login Failure Daemon).
Important update for 2026: The original ConfigServer/Way to the Web company permanently closed on August 31, 2025. cPanel now maintains its own fork of CSF for supported cPanel & WHM servers, focusing on security and stability updates. The current cPanel installation method uses the cpanel-csf package rather than the old ConfigServer installation script.
This guide explains how to install CSF on a cPanel server using the current cPanel-supported installation method.
What Is CSF?
CSF, or ConfigServer Security & Firewall, is a server firewall and security application designed to simplify firewall management on Linux servers.
On a cPanel server, CSF integrates with WHM and provides a graphical interface for managing firewall rules without requiring administrators to manually work with every iptables command.
CSF can be used to:
Allow or block IP addresses
Manage inbound and outbound ports
Whitelist trusted IP addresses
Automatically block suspicious connections
Monitor login failures
Detect certain types of malicious activity
Manage firewall rules through WHM
Provide alerts through LFD
Apply connection limits and other firewall controls
cPanel currently maintains a CSF fork for security and stability updates, although CSF remains a third-party firewall and cPanel does not provide general configuration or troubleshooting support for it.
Before Installing CSF on cPanel
Before installing a firewall, make sure you have root-level SSH access and, preferably, console or out-of-band access to your server.
A firewall misconfiguration can lock you out of your server. cPanel specifically recommends maintaining a way to regain access while changing firewall rules.
Check these items first
Confirm that you can log in to the server as root.
Keep your current SSH session open during installation.
Make sure you know your server’s public IP address.
Keep console access available through your hosting provider if possible.
Take a server backup or snapshot before making major firewall changes.
Check whether another firewall is already installed.
Confirm that the operating system is supported by your cPanel installation.
Important: CSF and firewalld
CSF does not function with the firewalld utility. cPanel’s current documentation states that firewalld must be removed before installing CSF.
On supported systems, check whether firewalld is installed:
systemctl status firewalld
If it is installed and you intend to use CSF, follow your operating system and cPanel requirements before removing it.
For example, on systems where yum is appropriate:
yum remove firewalld
Do not blindly run firewall-removal commands on a production server. First confirm which firewall currently manages your server and make sure you have another method of accessing the machine.
Step 1: Connect to Your cPanel Server Using SSH
Open an SSH client such as Terminal, PuTTY, Windows Terminal, or another SSH application.
Connect to your server:
ssh root@SERVER-IP
Replace:
SERVER-IP
with the IP address of your server.
Once connected, verify that you have root privileges:
whoami
The expected result is:
root
Step 2: Check Your Operating System
You can identify your Linux distribution with:
cat /etc/os-release
Modern cPanel servers commonly use operating systems such as:
AlmaLinux
Rocky Linux
CloudLinux
Ubuntu
Step 3: Install CSF on AlmaLinux, Rocky Linux, or CloudLinux
For AlmaLinux, Rocky Linux, or CloudLinux servers, cPanel’s current installation method is:
yum install cpanel-csf
The package installs the cPanel-maintained CSF version.
Depending on your system configuration, you may be asked to confirm the installation.
Enter:
y
when appropriate.
Step 4: Install CSF on Ubuntu
If your cPanel server uses Ubuntu, the current cPanel documentation provides:
apt install cpanel-csf
Again, confirm the installation when prompted.
Step 5: Verify the CSF Installation
After installation, verify that the CSF command is available:
csf -h
You can also check the installed version:
cat /etc/csf/version.txt
If CSF is installed correctly, the command should return the installed version information.
Step 6: Open WHM
After installing CSF, log in to WHM as root.
Navigate to:
WHM → Plugins → ConfigServer Security & Firewall
The CSF interface should now be available in WHM. cPanel’s current documentation identifies this as the standard location for CSF configuration.
Step 7: Review the CSF Configuration
Open:
ConfigServer Security & Firewall → Firewall Configuration
Before enabling the firewall permanently, review the configuration.
Pay particular attention to:
TCP incoming ports
TCP outgoing ports
UDP incoming ports
UDP outgoing ports
SSH access
cPanel ports
WHM ports
FTP ports
Mail ports
DNS ports
Custom application ports
cPanel recommends opening only the ports required by the services you actually use.
Step 8: Check the SSH Port
SSH access is particularly important.
If your server uses the standard SSH port, make sure it is permitted in the CSF configuration.
If your server uses a custom SSH port, make sure that port is also included.
For example, if SSH runs on port 2222, your configuration must allow that port.
Never activate a firewall without confirming that your SSH port is permitted.
Otherwise, you could lose remote access to your server.
Step 9: Check cPanel and WHM Ports
A cPanel server uses several ports for different services.
Common examples include:
Service | Common Port |
HTTP | 80 |
HTTPS | 443 |
FTP | 21 |
SSH | 22 |
SMTP | 25 |
Submission | 587 |
IMAP | 143 |
IMAPS | 993 |
POP3 | 110 |
POP3S | 995 |
DNS | 53 |
cPanel | 2083 |
WHM | 2087 |
Your actual firewall configuration should be based on the services enabled on your server.
cPanel recommends opening only the ports required for the services you use. Its official firewall documentation provides a broader list of cPanel & WHM service ports.
Step 10: Whitelist Your Administrative IP
Before enabling restrictive firewall rules, consider adding your trusted administrative IP address to the CSF allow list.
From SSH, you can use:
csf -a YOUR-IP
For example:
csf -a 203.0.113.10
Replace the example address with your actual public IP.
CSF’s command-line interface also supports removing an address from the allow list and blocking or unblocking IP addresses.
Important: Do not permanently whitelist an IP merely because it is currently convenient. Dynamic residential IP addresses can change.
Step 11: Disable CSF Testing Mode
New CSF installations use testing mode to reduce the risk of accidentally locking yourself out.
In WHM:
WHM → Plugins → ConfigServer Security & Firewall → Firewall Configuration
Find:
Testing
Change it to:
Off
Then click:
Change
After that, click:
Restart csf+lfd
cPanel’s current CSF installation instructions specifically recommend disabling testing mode after confirming the firewall configuration.
Step 12: Restart CSF and LFD
You can restart CSF from the WHM interface.
You can also use the command line:
csf -r
This reloads the CSF firewall rules.
Check the firewall status with:
csf -l
You can also view available CSF commands with:
csf -h
Useful CSF Commands
Once CSF is installed, several commands are particularly useful for server administrators.
Enable CSF
csf -e
Disable CSF
csf -x
Restart CSF
csf -r
Allow an IP
csf -a IP
Block an IP
csf -d IP
Remove an IP from the deny list
csf -dr IP
Search for an IP
csf -g IP
These commands are documented in cPanel’s current CSF command reference.
How to Block a Malicious IP Using CSF
If you identify a malicious IP address, you can block it from SSH.
For example:
csf -d 203.0.113.25
To remove the IP from the deny list:
csf -dr 203.0.113.25
You can also manage blocked and allowed IP addresses through the CSF interface in WHM.
Be careful when blocking addresses manually. Accidentally blocking an important service provider, monitoring system, CDN, mail server, or your own administrative IP can cause unexpected problems.
How to Allow a Trusted IP
To whitelist an IP:
csf -a 203.0.113.25
CSF will add the address to its allow configuration.
This can be useful for:
Administrator IP addresses
Monitoring systems
Trusted integrations
External services
Management networks
Always review your whitelist periodically. An unnecessarily large allow list can weaken firewall controls.
CSF and DDoS Protection
CSF provides several controls that can help mitigate certain types of abusive traffic, including connection and SYN-flood controls.
However, CSF is not a replacement for upstream DDoS protection.
If a server is subjected to a large volumetric DDoS attack, traffic may overwhelm the network connection before the server firewall can process it.
cPanel explicitly notes that server-level DDoS mitigation has limited effectiveness against attacks that saturate the server’s Internet connection. For significant attacks, mitigation should occur at the network or hosting-provider level.
Common Problems After Installing CSF
1. SSH stops working
This is one of the most serious firewall mistakes.
Possible causes include:
SSH port not allowed
Incorrect TCP rules
IP address accidentally blocked
Another firewall interfering
Incorrect custom port configuration
Use your hosting provider’s console or recovery access if SSH becomes unavailable.
2. Websites stop loading
Check whether ports 80 and 443 are allowed.
Also verify that Apache, NGINX, LiteSpeed, or the relevant web service is running.
3. Email stops working
If email is affected, check the firewall rules for the mail services actually used by your server.
Common mail-related ports include:
25
465
587
110
143
993
995
Do not automatically open every port. Enable only the services required by your mail configuration.
4. FTP stops working
FTP can require passive ports in addition to port 21.
cPanel notes that passive FTP ports may need to be permitted in the firewall configuration. The standard passive range can be 49152-65534, depending on the FTP configuration.
5. CSF does not start
Check whether another firewall service is active.
For example:
systemctl status firewalld
CSF and firewalld are not compatible, according to cPanel’s documentation.
Also check the CSF logs and system logs for errors before changing additional firewall settings.
CSF Security Best Practices for cPanel
Installing CSF is only the beginning of server security.
For better protection, combine firewall management with the following practices.
Keep cPanel Updated
Keep cPanel & WHM and the underlying operating system updated with security fixes.
Use Strong Root Authentication
Use strong credentials and consider SSH key authentication where appropriate.
Change the SSH Port Carefully
Changing the SSH port can reduce automated scanning noise, but it should not be considered a substitute for proper authentication and firewall controls.
Protect WHM Access
Restrict administrative access where practical and use strong authentication.
Monitor LFD Alerts
LFD can generate alerts about suspicious login activity and other events. Review recurring alerts rather than simply ignoring them.
Maintain Backups
A firewall cannot protect against every type of server failure, compromise, or accidental deletion. Maintain tested backups.
Keep an Emergency Access Method
Always maintain console or out-of-band access before making major firewall changes.
Open Only Required Ports
A smaller attack surface generally means fewer unnecessary services exposed to the Internet. cPanel also recommends opening only the ports required by services you actually use.
Is CSF Still Recommended for cPanel in 2026?
Yes, with an important qualification.
The original ConfigServer/Way to the Web organization closed permanently on August 31, 2025. However, cPanel began maintaining its own public fork of CSF in 2026 to provide critical security and stability updates.
For a new installation on a supported cPanel server, the current cPanel documentation recommends installing the cpanel-csf package:
AlmaLinux / Rocky Linux / CloudLinux
yum install cpanel-csf
Ubuntu
apt install cpanel-csf
This is preferable to relying on old tutorials that instruct administrators to download the original ConfigServer installation archive or run the historical ConfigServer installation script.
What Happened to the Old CSF Installation Method?
Many older articles recommend commands similar to:
cd /usr/src
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh
That procedure was associated with the original ConfigServer distribution.
Because the original developer organization closed in 2025 and cPanel now maintains its own CSF fork, new cPanel installations should use the current cpanel-csf package method rather than copying an old installation tutorial unchanged.
This distinction is important for anyone publishing or following older CSF installation guides.
How to Uninstall CSF
If you need to remove CSF, cPanel’s current documentation provides the following commands.
AlmaLinux, Rocky Linux, or CloudLinux
yum remove cpanel-csf
Ubuntu
apt remove cpanel-csf
The configuration directories may remain after removal. cPanel documents apt purge cpanel-csf when configuration files also need to be removed on Ubuntu.
Before uninstalling a firewall, make sure another firewall or appropriate network security mechanism is in place.
Final Checklist: CSF Installation on cPanel
Before considering your CSF installation complete, verify:
Root SSH access works
Emergency/console access is available
Server backups are available
Existing firewall configuration has been reviewed
firewalld compatibility has been checked
CSF is installed using the current cPanel package
CSF appears in WHM
SSH access is permitted
Required cPanel ports are permitted
Website ports are permitted
Required mail ports are permitted
FTP passive ports are configured if FTP is used
Trusted administrative IPs have been reviewed
Testing mode has been disabled only after testing
CSF and LFD have been restarted
Websites have been tested
Email has been tested
FTP has been tested if applicable
WHM and cPanel access have been tested
Conclusion
Installing CSF on a cPanel server provides administrators with a convenient way to manage firewall rules, control network access, block malicious IP addresses, and monitor suspicious activity through LFD.
However, CSF configuration must be performed carefully. An incorrectly configured firewall can block SSH, WHM, websites, email, FTP, or other essential services.
The biggest change for administrators following older CSF tutorials is that the original ConfigServer organization closed in 2025. For supported cPanel servers in 2026, cPanel maintains its own CSF fork and provides the cpanel-csf package for installation.
For a new cPanel installation, use the current package-based installation method, verify your required ports, retain emergency access, and test the server thoroughly before applying restrictive firewall policies.
Comments