The instructions in this guide apply to the CSF version maintained by cPanel. For more information, refer to the official cPanel documentation.

ConfigServer Security & Firewall, or CSF, is a free, third-party firewall plugin for cPanel & WHM servers. It allows you to manage iptables rules through WHM and includes IP blocking, login tracking, intrusion detection, and other server security features.

We recommend installing and enabling CSF to help protect your server against brute-force attempts, suspicious login activity, and unwanted connections. Keep in mind that a firewall is only one part of server security.

This guide covers CSF installation and the most common management tasks. Use the links below to go directly to the relevant section:

• Blocking IP addresses
• Whitelisting IP addresses
• Checking IP addresses
• Opening ports
• Disabling email notifications

Installation

CSF must be installed from the command line using the root user. If needed, refer to our SSH access guide for connection instructions.

Run the command that matches your server’s operating system:

• For AlmaLinux or CloudLinux: sudo yum install cpanel-csf
• For Ubuntu: sudo apt install cpanel-csf

The system downloads and installs the cpanel-csf package. A successful installation ends with the CSF installation completed successfully and Complete! messages:

Now, to activate CSF, proceed to WHM > Plugins section > ConfigServer Security & Firewall and follow the steps below.

Right after the installation, Test Mode will be enabled, which means that the firewall is not fully active yet:

1. To disable the mode, open the Firewall Configuration menu:

   
   

2. Find TESTING under Initial Settings and set it to Off:

   

3. Scroll to the bottom of the page and click Change:

   

4. After that, apply the changes by clicking Restart csf+lfd:

   

Once done, you will see the Firewall Status: Enabled and Running message on the main CSF page:

Managing CSF

CSF offers many features. We will discuss the most commonly used ones below.

Blocking IP addresses

In order to block an IP address from accessing the server, use the Quick Deny option under csf - Quick Actions:

Whitelisting IP addresses

If you want to whitelist any IP address on the server to prevent it from being blocked, use the Quick Allow option from the csf - Quick Actions section:

Checking IP addresses

If you suspect that an IP address is blocked by the firewall, enter it in the Search for IP field under csf - ConfigServer Firewall:

Any allow or block rules associated with the IP address will be displayed. For example, the block added earlier will appear as follows:

To unblock the IP address from this page, click Remove [IP address] block.

Opening ports

To open a TCP or UDP port on your server, go to Firewall Configuration > the IPv4 Port Settings section, and locate the TCP_IN, TCP_OUT, UDP_IN, and UDP_OUT settings. 

Add the port number to the corresponding comma-separated list. For example, to open port 3306 for incoming connections to your MySQL database, add 3306 to the TCP_IN field:

Remember to click Change at the bottom of the page and restart CSF by clicking Restart csf+lfd to apply the changes.

Disabling email notifications

To disable specific email notifications via WHM, go to Firewall Configuration and turn off the relevant options, depending on which notifications you no longer want to receive:

• LF_SSH_EMAIL_ALERT;
• LF_SU_EMAIL_ALERT;
• LF_WEBMIN_EMAIL_ALERT;
• LF_CONSOLE_EMAIL_ALERT;
• LF_CPANEL_ALERT.

Remember to click Change at the bottom of the page and restart CSF by clicking Restart csf+lfd to apply the changes.

Managing CSF through SSH

As an alternative to WHM, CSF can be managed through SSH while logged in as root. The following commands can be used for common actions:

For more information about CSF settings and features, refer to the readme.txt file.

That's it!