{"id":18418,"date":"2026-09-29T23:51:12","date_gmt":"2026-09-29T20:51:12","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/csf-firewall-whm\/"},"modified":"2026-09-29T23:51:12","modified_gmt":"2026-09-29T20:51:12","password":"","slug":"csf-firewall-whm","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/csf-firewall-whm\/","title":{"rendered":"CSF Firewall for cPanel\/WHM: Features and Updates"},"content":{"rendered":"<div class=\"hy-tldr\" style=\"background:#f6f7fb;border-left:4px solid #d83954;border-radius:10px;padding:14px 18px;margin:0 0 20px;line-height:1.8\"><strong>In short:<\/strong> CSF (ConfigServer Security &amp; Firewall) is a free firewall for cPanel\/WHM servers. It automatically blocks IP addresses that repeat failed logins, watches processes and ports and sends alerts, and supports allow and deny lists. Its original developer closed in August 2025, and cPanel now maintains it with security updates.<\/div>\n<p><img decoding=\"async\" src=\"https:\/\/www.hyyat.com\/zasogooh\/2019\/03\/csf_large.png\" alt=\"CSF firewall\" \/><\/p>\n<p>Every Linux server needs a firewall that blocks suspicious activity and lets you block any IP address easily. For servers running cPanel\/WHM, the most popular choice is <strong>ConfigServer Security &amp; Firewall (CSF)<\/strong>. It is designed to block IP addresses that try to log in with wrong details again and again.<\/p>\n<h2>Main features<\/h2>\n<ul>\n<li><strong>Login failure daemon (lfd):<\/strong> watches failed logins (SSH, FTP, email, cPanel) and blocks any IP that goes over the allowed number of attempts.<\/li>\n<li><strong>Process tracking:<\/strong> watches for suspicious processes and newly opened ports, and alerts you or blocks them.<\/li>\n<li><strong>Directory watching:<\/strong> watches sensitive folders for new or changed scripts, to catch malicious files early.<\/li>\n<li><strong>Alerts:<\/strong> emails you reports, such as new blocks or new open ports.<\/li>\n<li><strong>Port flood protection:<\/strong> limits the number of connections from one IP in a period, which helps against flood attacks.<\/li>\n<li><strong>Port knocking:<\/strong> keeps ports hidden until a secret sequence of connection attempts opens them.<\/li>\n<li><strong>Connection limits:<\/strong> limits connections per port or per IP.<\/li>\n<li><strong>WHM integration:<\/strong> manage CSF from a graphical page in WHM.<\/li>\n<li><strong>Allow and deny lists:<\/strong> allow-listed IPs skip the filters; deny-listed IPs are always blocked. CSF can also download block lists from several sources.<\/li>\n<\/ul>\n<h2>Installation and updates<\/h2>\n<p>ConfigServer, the company that developed CSF, closed on 31 August 2025, and the old download link (download.configserver.com) no longer works. cPanel now provides and maintains CSF with security updates for cPanel &amp; WHM servers.<\/p>\n<p>To check your version, connect over SSH (see <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/how-to-connect-to-a-server-via-ssh\/\">how to connect to your server over SSH<\/a>) and run <code>csf -v<\/code>. If you see (cPanel) next to the version number, your copy comes from cPanel (the cpanel-csf package) and is updated with your system updates.<\/p>\n<p>For useful commands, see <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/important-csf-firewall-commands-via-ssh\/\">important CSF commands over SSH<\/a>. To install CSF on a new server or tune its settings, open a support ticket and our server management team will handle it.<\/p>\n<p class=\"hy-svc-link\" style=\"background:#fff5f7;border-left:4px solid #d83954;border-radius:10px;padding:14px 18px;margin:20px 0;line-height:1.8\"><strong>Related service:<\/strong> <a href=\"https:\/\/www.hyyat.com\/en\/server-management\/\">Hyyat Host server management<\/a> installs, configures and monitors your server firewall, with 24\/7 support.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In short: CSF (ConfigServer Security &amp; Firewall) is a free firewall for cPanel\/WHM servers. It automatically blocks IP addresses that repeat failed logins, watches processes and ports and sends alerts, and supports allow and deny lists. Its original developer closed in August 2025, and cPanel now maintains it with security updates. Every Linux server needs [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"inline_featured_image":false,"_templately_pack_id":"","_templately_imported_at":"","_templately_source":"","_templately_import_session_id":"","footnotes":""},"doc_category":[2734],"doc_tag":[],"class_list":["post-18418","docs","type-docs","status-publish","hentry","doc_category-whm-cpanel-control-panels"],"year_month":"2026-10","word_count":371,"total_views":"2","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"ahmed fathy","author_nicename":"ahmed-fathy","author_url":"https:\/\/www.hyyat.com\/en\/author\/ahmed-fathy\/"},"doc_category_info":[{"term_name":"whm\/cpanel control panels","term_url":"https:\/\/www.hyyat.com\/en\/kb\/whm-cpanel-control-panels\/"}],"doc_tag_info":[],"knowledge_base_info":[],"knowledge_base_slug":[],"_links":{"self":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/18418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/comments?post=18418"}],"version-history":[{"count":0,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/18418\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/media?parent=18418"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_category?post=18418"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_tag?post=18418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}