Panellicense

Install ConfigServer CSF on cPanel and tune the defaults

Install ConfigServer Security & Firewall on cPanel/WHM in under 10 minutes — including the csf.conf defaults every host should change before leaving TESTING mode.

8 min readUpdated 2026-05-18csf · firewall · lfd · security
schema: HowToschema: Articleschema: FAQPage

ConfigServer Security & Firewall (CSF) is still the default packet-filter on most cPanel servers — free, scriptable, and integrated into WHM as a plugin. The install is five commands; the part that matters is the dozen csf.conf defaults that ship wrong for any production shared host.

This guide takes a fresh cPanel/AlmaLinux 9 box from iptables -F to a tuned, running CSF + LFD in about ten minutes. It assumes you already have WHM open and root SSH.

Before you install

CSF replaces firewalld and any direct iptables/nftables rules — they conflict. Stop and disable firewalld first:

systemctl stop firewalld
systemctl disable firewalld
systemctl mask firewalld

CSF will detect and remove conflicting kernel modules at install. If you already run cPHulk, leave it on — CSF's LFD (Login Failure Daemon) and cPHulk watch different log streams and don't fight unless you forward the same auth source to both.

Confirm the kernel has the modules CSF needs:

lsmod | grep -E 'ip_tables|nf_conntrack'

If those are absent on a minimal VPS image (rare on AlmaLinux 9, common on stripped LXC containers), check with your provider before going further — CSF can't filter what the kernel won't load.

Install CSF

cd /usr/src
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

The installer writes the cPanel plugin into /usr/local/cpanel/whostmgr/docroot/cgi/configserver/ and registers itself with chkservd so a crashed LFD restarts automatically. When it finishes, run the compatibility check:

perl /usr/local/csf/bin/csftest.pl

You want to see RESULT: csf should function on this server. Any FATAL line means a missing iptables module — fix that before continuing.

CSF starts in TESTING mode by default. LFD does not run, and iptables rules are flushed every five minutes by a cron job so a bad config can't lock you out. Don't disable TESTING until the rest of this guide is done.

Open the right ports

Edit /etc/csf/csf.conf and find the port lists. The cPanel defaults are too permissive — they include ports for services most hosts don't run (Webmail SSL on 2096 only matters if you actually use the cPanel webmail, daily-process-log ports, etc.). A sane shared-hosting baseline:

TCP_IN  = "20,21,22,25,53,80,110,143,443,465,587,993,995,2078,2083,2087,2096"
TCP_OUT = "20,21,22,25,53,80,110,113,443,465,587,873,993,995,2087,2089,2703"
UDP_IN  = "53,80,443"
UDP_OUT = "20,21,53,113,123,873,6277,24441"

Notes:

  • 22 stays in TCP_IN. If you've moved SSH to a non-standard port, replace it — don't just add the new one.
  • 80, 443 UDP are required for HTTP/3. Leave them in if you've enabled HTTP/3 on LiteSpeed or have any plans to.
  • 2083 / 2087 / 2096 are the cPanel and WHM SSL ports. The non-SSL twins (2082 / 2086 / 2095) are intentionally absent — there is no reason to expose unencrypted cPanel in 2026.
  • 53 stays in both TCP_IN and UDP_IN only if this host is a DNS server (a real authoritative name server or a member of a DNS-only cluster). Remove it on pure-web boxes.

The csf.conf settings that matter

Search inside csf.conf for each key and change it.

Stop ICMP floods

ICMP_IN_RATE = "1/s"
ICMP_IN_LIMIT = "1"

Permit ping for monitoring, but rate-limit so a single host can't ping-flood you. Set ICMP_IN = "1" if you want to allow ICMP at all; 0 blocks it entirely and breaks PMTU discovery.

Connection-tracking limits

CT_LIMIT = "300"
CT_INTERVAL = "30"
CT_BLOCK_TIME = "1800"
CT_PORTS = "80,443"

Bans an IP that holds more than 300 concurrent connections to ports 80/443 — catches both bad scrapers and broken WordPress plugins that open connections without closing them. Tune CT_LIMIT up if you serve genuinely high-fan-in traffic (large API responses, video streaming).

LFD thresholds

LF_TRIGGER = "5"
LF_TRIGGER_PERM = "3600"
LF_SSHD = "5"
LF_SSHD_PERM = "1"
LF_FTPD = "10"
LF_SMTPAUTH = "5"
LF_POP3D = "10"
LF_IMAPD = "10"
LF_CPANEL = "5"
LF_WEBMIN = "0"

The shape: five SSH auth failures → permanent ban; ten POP/IMAP failures (mail clients retry aggressively after a password change) → one-hour ban. LF_WEBMIN = "0" because Webmin isn't installed on cPanel — leaving it active wastes a log tail.

If you also run Imunify360, turn off the overlapping LFD counters per the CSF + Imunify360 coexistence guide before this step actively double-bans IPs.

SYN flood protection

SYNFLOOD = "0"
SYNFLOOD_RATE = "100/s"
SYNFLOOD_BURST = "150"

Leave SYNFLOOD off unless you're actively being attacked. The rule adds a per-packet check to every new connection and measurably hurts throughput at scale — turning it on by default is one of the most common reasons a "tuned" CSF box runs slower than an untuned one.

Country blocks (optional)

CC_DENY = "CN,RU,KP,IR"
CC_DENY_PORTS = "22,2083,2087"

Country blocks belong on management ports, not on public web ports. Blocking China and Russia on port 22 cuts SSH brute-force log volume by 80%+ on most hosts; blocking them on port 80 just stops their customers from reaching your customers' sites.

CSF downloads MaxMind GeoLite2 data — set CC_SRC = "1" and provide a free MaxMind license key in MM_LICENSE_KEY or country lookups will silently stop working when the old hardcoded list goes stale.

Switch off TESTING and start LFD

After the config is sane, set the safety switch off:

TESTING = "0"

Then restart both daemons:

csf -r
systemctl restart lfd
systemctl enable lfd

csf -r rebuilds and reloads the iptables ruleset; the lfd restart picks up the new thresholds. Verify both are alive:

csf -l | head
systemctl status lfd --no-pager

You should see the INPUT chain populated and lfd running with no errors in /var/log/lfd.log.

Day-to-day operations

The commands you'll use weekly:

csf -d 1.2.3.4 "scraping wp-login"     # permanent deny with comment
csf -dr 1.2.3.4                        # remove a deny
csf -tf 1.2.3.4                        # remove from temp ban (the common one)
csf -a 1.2.3.4 "office IP"             # permanent allow
csf -g 1.2.3.4                         # show every rule and log line for this IP
csf -t                                 # list temporary bans with time remaining

csf -g is the one to remember during support tickets — it returns every reason CSF has logged about an IP, which usually answers "why was my customer blocked?" in one command.

When CSF is behind Cloudflare

If your sites front through Cloudflare or another reverse proxy, CSF sees the proxy IP for every request — LFD will ban the proxy after a single attacker hits your wp-login enough times. The fix is the same as for Imunify360 behind Cloudflare: install mod_remoteip and restore the real client IP at the Apache layer before LFD reads the logs.

For pure-CSF setups, also add Cloudflare's published IP ranges to /etc/csf/csf.allow so even an accidental ban can't take your sites offline.

FAQ

Is ConfigServer CSF free?+
Yes. CSF and LFD are free and GPL-licensed. ConfigServer sells a paid configuration service (cmc) and the cxs malware scanner, but the firewall itself has no licensing cost.
Does CSF work on AlmaLinux 9 and Ubuntu 24.04?+
Yes. CSF supports any system with a working iptables or nftables backend — AlmaLinux 8/9, Rocky 8/9, Ubuntu 22.04/24.04, and Debian 11/12 all work. The cPanel plugin obviously requires a cPanel install underneath.
Can I run CSF and firewalld at the same time?+
No. Both manage the kernel firewall and will fight each other. Stop, disable, and mask firewalld before installing CSF — the install script will warn but not force you, and a half-removed firewalld will silently flush CSF's rules at random.
How do I stop CSF locking me out during the first boot?+
Leave TESTING = 1 until you have verified you can SSH in from a second session, and add your office IP to /etc/csf/csf.allow before flipping TESTING off. CSF's own cron flushes rules every 5 minutes while TESTING is on, so a misconfiguration can only lock you out for that long.
Should I disable cPHulk if I install CSF?+
No. cPHulk watches cPanel/WHM auth events at the application layer; CSF/LFD watch tailed log files. They cover different surfaces. Leave both on, and tune the cPHulk side per the cPHulk tuning guide.
Does CSF replace Imunify360?+
No. CSF is a packet-level firewall and log-based brute-force detector. Imunify360 adds a WAF, malware scanner, reputation feed, and proactive PHP defense. Most production hosts run both — see the coexistence guide to avoid double-bans.

Next steps

If you're standing CSF up on a new box, the cPanel VPS install guide covers the prerequisites that make all of the above behave predictably — and the cPanel license page handles same-day activation if you haven't sorted the WHM licence yet.

Related articles

All tutorials & how-tos →
how to
Set up JetBackup 5 deduplication backups to cut storage cost
JetBackup 5.4 added a deduplication backup structure that fingerprints data in chunks and stores each unique chunk once — here's how it works, where it pays off, and how to turn it on.
6 min read
how to
Plesk 360 setup guide for centralized licenses and monitoring
Plesk 360 is the SaaS control plane for everyone running more than one Plesk box — license management, uptime monitoring, and SSO into every panel from one dashboard.
7 min read
how to
Use the Plesk REST API with reseller and customer accounts
Plesk Obsidian 18.0.79 opens the REST API to reseller and customer accounts and adds file, log, and impersonation endpoints — how to authenticate and use them.
7 min read
Switch in an afternoon

Switch from your current reseller — free.

We migrate active cPanel, Plesk, LiteSpeed and CloudLinux licenses from any reseller. We prorate the first month so you never pay twice, and your customers see zero downtime during the swap.