What do you need before you install CSF?
CSF only belongs on a server where you have root. A shared hosting account cannot install it, because that user is not allowed to change the host firewall. You need a VPS with root, or a dedicated server you administer yourself. Keep a second SSH session open, or the provider console, before you load any new rules.
Stop any other packet filter first. CSF will not run beside firewalld, and it fights another iptables script such as APF. On cPanel, the package setup disables firewalld when it finds it. On a plain Linux server, disable and remove firewalld yourself, then install CSF. Linux already has a kernel firewall. CSF is the tool that writes the rules.
- Root SSH, not a cPanel-only login
- No firewalld or APF left running
- Your current public IP written down
- The VPS console ready if SSH drops
How do you install CSF on cPanel?
On a current cPanel VPS, do not fetch the old ConfigServer tarball. Way to the Web stopped maintaining CSF on 31 August 2025, and download.configserver.com no longer serves the file. WebPros ships CSF for cPanel and WHM as the package cpanel-csf. That package will not install when cPanel is missing.
Log in as root. On AlmaLinux, CloudLinux, or Rocky Linux, run yum install cpanel-csf. On Ubuntu with cPanel, run apt install cpanel-csf. When it finishes, csf -v prints a version. WHM lists ConfigServer Security and Firewall under Home, then Plugins. Updates for this package come from the system package manager. The old AUTO_UPDATES switch is not how this build is patched.
A new cpanel-csf install starts in testing mode. From a second SSH session, confirm the site still loads on ports 80 and 443 and that SSH still accepts your key or password. Only then turn testing off and restart both csf and lfd.
How do you install CSF on Linux without a panel?
The cpanel-csf package is the wrong file on a server with no panel. Download a GPLv3 copy of the last public csf.tgz. One archive in current use is the centminmod configserver-scripts copy on GitHub. Read the license file in the tarball before you run the installer. This is the path for a Linux VPS with no cPanel.
If firewalld is active, disable it and remove the package before you unpack CSF. The two filters cannot enforce rules at the same time.
- Open a shell as root and change to /usr/src.
- Download https://github.com/centminmod/configserver-scripts/raw/refs/heads/main/csf.tgz into that directory and unpack it with tar -xzf csf.tgz.
- Change into the csf directory and run sh install.sh.
- Run perl /usr/local/csf/bin/csftest.pl. Stop if any line says FATAL.
- If the test asks for Perl modules, install the packages named in the installer notes, then run the test again.
- In /etc/csf/csf.conf set AUTO_UPDATES to 0, then run csf -r.
The installer tries to allow the IP you connected from, and it records a non-standard SSH port when it sees one. It does not replace a careful read of /etc/csf/csf.conf. If csftest.pl reports a FATAL line, fix that module before you open the firewall to the world.
Which ports should CSF leave open?
Edit TCP_IN and TCP_OUT in /etc/csf/csf.conf. Leave the SSH port you actually use, plus 80 and 443 when the server hosts a site. Add mail ports only if this machine sends or receives mail. Close everything else.
| Service | Port | Leave it open when |
|---|---|---|
| SSH | The port you use, often 22 | Always, or you lose the shell |
| HTTP | 80 | The server hosts a website |
| HTTPS | 443 | The server hosts a website |
| cPanel and WHM | 2083 and 2087 | cPanel is installed |
| 25, 465, 587, 993, 995 | This machine handles mail |
cPanel also needs 2083 and 2087 if you log in to the panel and to WHM. DirectAdmin uses 2222. Do not add those ports on a server that does not run that panel.
Testing mode is TESTING set to 1 in csf.conf. CSF loads the rules, then drops them after a few minutes, so a bad port list does not lock you out for good. From the second session, load the site and reconnect SSH. Then set TESTING to 0, run csf -r, and check that both sessions still work. That restart is when the firewall stays up.
How do you allow or block an IP?
Allow your own address before you tighten SSH. Run csf -a, then the IP, then a short comment. That writes csf.allow. To block an address, run csf -d and the IP. To remove a block, run csf -dr and the IP. The same lists live in /etc/csf/csf.allow and /etc/csf/csf.deny. In WHM the plugin has the same buttons.
If the SSH window dies and will not reconnect, do not reboot in a loop. Open the VPS console, set TESTING back to 1, and run csf -r. Email support@webji.services if you cannot reach the console. The average first reply is under 60 minutes, in Hindi and English. The office phone is not a support line.
How do you stop LFD alert mail?
LFD reads logs for failed SSH, mail, FTP, and panel logins, then blocks the source. One alert is useful. A full inbox usually means the alert address is wrong, or a limit is so low that normal users trip it.
Set LF_ALERT_TO in csf.conf to one mailbox you actually read. Do not turn LFD off just to stop the mail, or the blocks stop too. After the change, run csf -r and read /var/log/lfd.log. You are finished when new failures show in that log and the mailbox only gets the alerts you asked for.
WebJi® does not install CSF on shared hosting. On an unmanaged VPS you run these steps yourself. A root server is quoted by email at support@webji.services before you pay. Migration onto that server is subject to terms and approval.
Frequently Asked Questions
How do I install CSF on cPanel?
As root, install the cpanel-csf package with yum on AlmaLinux, CloudLinux, or Rocky Linux, or with apt on Ubuntu. csf -v should print a version, and WHM should list ConfigServer Security and Firewall under Plugins. The old download.configserver.com tarball is not the install path on cPanel anymore.
How do I install CSF without cPanel?
Download a GPLv3 csf.tgz, unpack it, and run sh install.sh. Then run perl /usr/local/csf/bin/csftest.pl and stop if it reports a FATAL error. Set AUTO_UPDATES to 0 in /etc/csf/csf.conf so the older tree stops calling a vendor that closed on 31 August 2025.
Where is the CSF download?
cPanel and WHM get CSF from the cpanel-csf package, not from a file you fetch by hand. Other Linux servers need a GPLv3 archive of the last public release, because download.configserver.com no longer serves csf.tgz.
What is TESTING mode in CSF?
TESTING set to 1 in /etc/csf/csf.conf loads the rules and then removes them on a timer, so a mistake does not lock you out for good. After SSH and the website still work from a second session, set it to 0 and run csf -r.
How do I open or close a port in CSF?
Edit TCP_IN and TCP_OUT in /etc/csf/csf.conf, keep testing mode on, and restart with csf -r. Open the SSH port you use, plus 80 and 443 for a website. Remove a port only after you know nothing you need is listening on it.
How do I unblock an IP in CSF?
Run csf -dr and the IP address. That removes the block from the deny list. To stop the same IP being blocked again, add it with csf -a. If you are already locked out, use the VPS console rather than the SSH session that died.
How do I stop CSF alert emails?
Set LF_ALERT_TO in /etc/csf/csf.conf to one mailbox, then run csf -r. Leave LFD running. Read /var/log/lfd.log to see which service is failing. Raise a noisy limit instead of turning the daemon off.