How to Install ConfigServer Security & Firewall (CSF) on cPanel/WHM

Applicable to: cPanel & WHM Linux Servers
Firewall: ConfigServer Security & Firewall (CSF)
Access Required: Root / WHM root access

Overview

ConfigServer Security & Firewall (CSF) is a firewall and login-failure detection solution commonly used with cPanel & WHM servers.

CSF provides:

• Firewall management

• Brute-force protection

• Login failure detection

• IP allow/block management

• Port access control

• Login and security alerts

• Firewall management through WHM

Important: The original developers of CSF, Way to the Web Ltd., ceased operations on August 31, 2025. cPanel now maintains its own CSF fork for supported cPanel & WHM systems, focusing on security and stability updates. The cPanel-maintained package is distributed as cpanel-csf. (cPanel Support)

Requirements

Before installing CSF, make sure:

1. You have root SSH access to the server.

2. The server is running cPanel & WHM.

3. The cPanel installation is supported and up to date.

4. You have access to WHM.

5. You have console/KVM access available if possible, especially when making firewall changes.

Warning: Incorrect firewall configuration can block SSH, WHM, email, FTP, DNS, or website traffic. Always verify the required ports before enabling or modifying firewall rules.

Step 1 – Connect to the Server

Log in to the server using SSH as the root user.

For example:

ssh root@SERVER-IP

Replace SERVER-IP with the IP address of your server.

Step 2 – Install CSF

On supported cPanel & WHM servers, install the cPanel-maintained CSF package using the system package manager.

AlmaLinux / CloudLinux

Run:

dnf install cpanel-csf -y

On systems where yum is used, you can also run:

yum install cpanel-csf -y

Ubuntu

For supported Ubuntu cPanel installations, run:

apt install cpanel-csf -y

cPanel's current documentation identifies cpanel-csf as the package used for its maintained CSF fork. (cPanel Support)

Step 3 – Verify CSF Installation

After installation, verify that CSF is available:

csf --version

You can also check the installed package:

rpm -qa | grep cpanel-csf

For Ubuntu:

dpkg -l | grep cpanel-csf

If CSF is installed correctly, the version information should be displayed.

Step 4 – Access CSF from WHM

Once installed, log in to WHM as root.

Navigate to:

WHM → Plugins → ConfigServer Security & Firewall

The CSF interface provides access to firewall rules, IP management, configuration options, and firewall status.

Step 5 – Review Firewall Configuration

The main CSF configuration file is:

/etc/csf/csf.conf

Before making changes, create a backup:

cp /etc/csf/csf.conf /etc/csf/csf.conf.backup

You can edit the configuration using:

vi /etc/csf/csf.conf

or:

nano /etc/csf/csf.conf

Step 6 – Review Required Ports

Before enabling restrictive firewall rules, verify that the ports required by your server are permitted.

Common cPanel/WHM ports include:

Note: The exact ports required depend on the services enabled on your server. Do not blindly open ports that are not required.

Step 7 – Allow Your Administrative IP

If you have a fixed administrative IP address, it is recommended to allow it explicitly.

From the command line:

csf -a YOUR-IP

For example:

csf -a 203.0.113.10

Replace the example IP with your actual trusted IP address.

To remove an IP from the allow list:

csf -ar YOUR-IP

Step 8 – Block an IP Address

To manually block an IP address:

csf -d IP-ADDRESS

For example:

csf -d 203.0.113.20

To remove an IP from the deny list:

csf -dr IP-ADDRESS

Step 9 – Test the Firewall Configuration

Before applying changes permanently, review the configuration carefully.

You can check the CSF configuration with:

csf -c

If you are making changes remotely, keep an active SSH session open until you have confirmed that the new firewall rules are working correctly.

This is especially important when modifying SSH or WHM access rules.

Step 10 – Restart CSF

After making configuration changes, restart the firewall:

csf -r

You can also restart CSF from WHM:

WHM → Plugins → ConfigServer Security & Firewall → Firewall Restart

cPanel documents csf -r as the command to restart the CSF firewall rules. (cPanel Support)

Common CSF Commands

The following commands can be useful when managing CSF from SSH.

Check CSF version

csf --version

Restart CSF

csf -r

Allow an IP

csf -a IP-ADDRESS

Block an IP

csf -d IP-ADDRESS

Remove an IP from allow list

csf -ar IP-ADDRESS

Remove an IP from deny list

csf -dr IP-ADDRESS

View the current firewall rules

csf -l

Stop CSF

csf -x

Start CSF

csf -e

Important: CSF Configuration and cPanel Support

CSF is maintained by cPanel for security and stability updates, but cPanel does not provide configuration or troubleshooting assistance for CSF. CSF remains outside the normal scope of cPanel technical support for firewall configuration. (cPanel Support)

For Softsys-managed servers, firewall configuration should be performed carefully because incorrect rules can affect:

• SSH access

• WHM/cPanel access

• Website availability

• DNS

• Email delivery

• FTP/SFTP

• Third-party integrations

• Backup systems

• Monitoring systems

Existing CSF Installations

If your server already has an older CSF installation, first check the installed version:

cat /etc/csf/version.txt

Older CSF installations may still reference the original ConfigServer/W2W update infrastructure. cPanel began transitioning eligible installations to its maintained CSF fork in February 2026. (cPanel Support)

If the server is still using an older installation, we recommend reviewing the current cPanel CSF package and migration procedure before manually removing or replacing the existing installation.

Do not remove the existing firewall without first confirming that an alternative firewall is active and that remote access will remain available.

Troubleshooting

CSF command is not found

If you receive:

-bash: csf: command not found

verify that the package is installed:

rpm -qa | grep cpanel-csf

If it is not installed, install it using:

dnf install cpanel-csf -y

Unable to access SSH after firewall changes

If SSH access stops working after changing CSF rules:

1. Use the server console/KVM if available.

2. Check /etc/csf/csf.conf.

3. Verify that the SSH port is present in the appropriate TCP inbound configuration.

4. Confirm that your administrative IP has not been blocked.

5. Restart CSF after correcting the configuration.

If you do not have console access, contact your server administrator or hosting provider for assistance.

Websites stop loading after CSF installation

Check that HTTP and HTTPS ports are permitted:

80
443

Then restart CSF:

csf -r

Also verify that another firewall or security application is not conflicting with CSF.

Email stops working

If email services are affected, review the ports required by your mail configuration, such as:

25
465
587
110
995
143
993

Only allow the ports required by the services running on your server.

Best Practices

For production cPanel servers, Softsys recommends the following:

• Keep cPanel & WHM updated.

• Keep CSF updated through the cPanel package management system.

• Restrict administrative ports wherever practical.

• Allow trusted administrative IPs where appropriate.

• Do not expose unnecessary services to the Internet.

• Keep a backup of /etc/csf/csf.conf before making major changes.

• Maintain console/KVM access when changing firewall rules.

• Test firewall changes before closing your existing SSH session.

• Monitor CSF/LFD alerts for repeated login failures.

• Review firewall rules periodically.