CSF (ConfigServer Security & Firewall) and its companion LFD (Login Failure Daemon) have been the most popular firewall on cPanel servers for many years. The company that made them closed in August 2025, and cPanel now maintains its own version of CSF. This guide explains what that means for your server, how to check what you're running, and what your options are.

It's for customers who run cPanel on a self-managed Cloud VPS or a dedicated server. If you have a Managed cPanel VPS, talk to us before you change anything about your firewall: open a support ticket.

What happened

  • Way to the Web Ltd, the company behind ConfigServer, closed permanently on 31 August 2025. It no longer develops, supports or distributes CSF, LFD or its other cPanel add-ons, and its old download and update links can't be relied on.
  • From 25 February 2026, cPanel began publishing and maintaining a public version (a "fork") of CSF for cPanel & WHM servers, called cpanel-csf. cPanel says it focuses on critical security and stability fixes rather than new features, and CSF is still outside cPanel's technical support.
  • cPanel automatically switched eligible servers to its own update mirrors: servers running CSF 14.00 to 15.00 with AUTO_UPDATES turned on. Your rules and settings stay as they were.
  • Servers with AUTO_UPDATES turned off, an older CSF (13.x or earlier), or a different fork weren't switched automatically.

For the details, see cPanel's guide How to install CSF and the CSF release notes.

Does CSF still work?

Yes. CSF and LFD run entirely on your server, so an existing install keeps filtering traffic and blocking attackers as it did before. If your server was switched to cPanel's version, it keeps getting fixes. If it wasn't, the risk grows over time:

  • A copy that isn't being updated won't get security fixes.
  • It won't be updated for new versions of cPanel or your operating system, so a future update could stop it working properly.
  • If you rebuild your server, you can't reinstall it from ConfigServer's old download links.

There's no need to panic, but you should check which version you have.

Check your CSF version and status

Connect to your server over SSH as root, then run:

csf -v
cat /etc/csf/version.txt

This shows which version of CSF is installed. To see whether it came from cPanel's maintained package, run rpm -q cpanel-csf on AlmaLinux or CloudLinux, or dpkg -l cpanel-csf on Ubuntu. Next, check the firewall and LFD are running:

systemctl status csf
systemctl status lfd

Both should show active. Press q to exit. Also check CSF isn't still in testing mode, where it regularly clears its own rules:

grep '^TESTING ' /etc/csf/csf.conf

This should show TESTING = "0". You can also see CSF's status in WHM, under Plugins → ConfigServer Security & Firewall.

Your options

Option 1: Keep CSF, using cPanel's maintained version (recommended for most cPanel servers)

This is the simplest option. Back up your CSF settings first:

tar -czf /root/csf-backup.tar.gz /etc/csf

If your server wasn't switched automatically, cPanel's documentation says you can install its package manually:

AlmaLinux or CloudLinux

yum install cpanel-csf

Ubuntu

apt install cpanel-csf

Then check the version again with csf -v, and make sure CSF and LFD are running. Follow cPanel's guide linked above if anything differs on your server.

Community forks of CSF also exist for servers without cPanel. CSF runs as root, so only install a fork from a source you trust, and read its own upgrade instructions first.

Option 2: Use cPanel's built-in protection with your system firewall

cPanel includes cPHulk Brute Force Protection, which blocks repeated failed logins to services such as cPanel, WHM, webmail, email, FTP and SSH. Turn it on in WHM under Security Center → cPHulk Brute Force Protection. Pair it with your operating system's firewall, such as firewalld on AlmaLinux and Rocky Linux, and make sure the ports cPanel needs are open. cPHulk only protects logins. Unlike LFD, it doesn't watch for port scans or floods of connections.

Option 3: Imunify360

Imunify360, from CloudLinux, is a paid security suite for cPanel servers. It includes a firewall, brute-force protection, a web application firewall and malware scanning. It needs its own licence. Read Imunify360's documentation on how it works with an existing CSF install before you add it.

Option 4: firewalld and Fail2ban

This is a common combination on Linux servers. firewalld controls which ports are open, and Fail2ban watches log files and blocks IP addresses after repeated failed logins. Fail2ban doesn't know about cPanel's services out of the box, so it takes more work to protect them all. It's best suited to experienced administrators.

Changing your firewall safely

  • Run only one firewall tool at a time. Two tools managing the same firewall rules will conflict.
  • Make sure you can get back in. Check you can log in with Open Console on your VPS's management page. It works even if the firewall blocks SSH. See Use the web console to access your VPS.
  • Open the right ports first. Make sure the new firewall allows SSH and the ports cPanel needs before you remove CSF.
  • Remove CSF with its own uninstall script, rather than deleting files: 
    cd /etc/csf
sh uninstall.sh
  • Have a backup. No Cloud VPS plan includes backups by default, but you can add VPS backups with Upgrade/Downgrade on your VPS's management page.

Blocked by CSF?

If CSF has blocked your own IP address, connect from a different connection, such as your phone's hotspot, or use Open Console. Then run these as root, replacing YOUR_IP_ADDRESS with the blocked address:

csf -g YOUR_IP_ADDRESS     # show whether, and why, the IP address is blocked
csf -dr YOUR_IP_ADDRESS    # remove a permanent block
csf -tr YOUR_IP_ADDRESS    # remove a temporary block
csf -a YOUR_IP_ADDRESS     # always allow this IP address

Only always-allow IP addresses you control, such as your office's fixed IP address.

If you're blocked from one of our shared hosting servers or from a Managed cPanel VPS, see Why is my IP address blocked from cPanel, WHM or my website?

Managed cPanel VPS customers

Please don't install, remove or reconfigure the firewall on a Managed cPanel VPS yourself. Open a support ticket and talk to us first.

Related guides

Need help?

Our Cloud VPS plans are self-managed, so you're responsible for installing, securing and maintaining the software on your server, including cPanel and its firewall. If something on our side isn't working, such as the network, or your VPS won't boot, open a support ticket. If you have a Managed cPanel VPS, open a ticket before you change your firewall.

Was this answer helpful? 0 Users Found This Useful (0 Votes)