How to Install CSF Firewall on cPanel and WHM

Updated: 18 October 2026 · Applies to: cPanel & WHM 138 on AlmaLinux 8 to 10, CloudLinux, Rocky Linux 8 and 9 or Ubuntu 24.04 · CSF package cpanel-csf maintained by cPanel

To install CSF on a cPanel server today, log in as root and install cPanel's own package: yum install cpanel-csf on AlmaLinux, CloudLinux or Rocky Linux, or apt install cpanel-csf on Ubuntu, according to cPanel. The old method, downloading csf.tgz from download.configserver.com and running install.sh, no longer works: the original developers stopped maintaining CSF on 31 August 2025 and their download server no longer answers.

What changed

• According to cPanel, the original developers of CSF (ConfigServer Security and Firewall) no longer maintain or support it since 31 August 2025, and released it under the GPLv3 licence.
• On supported cPanel & WHM versions, WebPros International, LLC, the company that develops cPanel, maintains its own version of CSF for security and stability updates only. cPanel does not help with CSF configuration or troubleshooting.
• The code is in cPanel's GitHub repository cpanel/cpanel-csf. Its README says the cpanel-csf package is intended for cPanel & WHM systems only and fails to install when cPanel is not detected.
• The package changelog in that repository lists two changes worth knowing: the built-in auto-update was removed (updates now come through the package manager), and support for other control panels and plain Linux servers was removed.

Before you start

• You need root access over SSH, or WHM's Terminal interface.
• Know your own public IP address so you can allow it. In an SSH session, echo "$SSH_CLIENT" prints three values; the first is the address you are connecting from (lab output below, from a local test, so it shows 127.0.0.1):

  127.0.0.1 57540 2222

• Keep a second SSH session open, or have your provider's console ready, in case you lock yourself out.
• CSF does not work with firewalld, according to cPanel. Check it with systemctl is-active firewalld.

Install CSF on cPanel and WHM

1. Log in to the server as root.
2. If firewalld is active, stop it and remove it, as cPanel's guide asks (AlmaLinux, CloudLinux, Rocky Linux):

   systemctl disable --now firewalld
   yum remove firewalld

   The package's own setup script also disables, stops and masks firewalld if it finds it.
3. Install CSF. On AlmaLinux, CloudLinux or Rocky Linux:

   yum install cpanel-csf

   On Ubuntu 24.04:

   apt install cpanel-csf

4. The package enables the csf and lfd services, starts the firewall and adds ConfigServer Security & Firewall to WHM under Home » Plugins. A new installation starts in testing mode, in which lfd does not run.
5. Check the installed version:

   csf -v

Already running the original ConfigServer CSF (version 14.x or 15.00)? According to cPanel, servers with CSF's automatic updates turned on are upgraded to cPanel's version automatically. Otherwise, run the same install command to upgrade.

First steps after installing

These steps come from the CSF documentation (/etc/csf/readme.txt, man csf and the comments in /etc/csf/csf.conf).

1. Allow your own IP address (replace the example address). It is added to /etc/csf/csf.allow:

   csf -a 203.0.113.10 office

2. Check the open ports. TCP_IN, TCP_OUT, UDP_IN and UDP_OUT in /etc/csf/csf.conf list the ports the firewall allows. These are the defaults in the csf.conf of cPanel's repository (version 16.07):

   grep -E '^(TCP|UDP)_(IN|OUT) ' /etc/csf/csf.conf
   TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,853,993,995,2077,2078,2079,2080,2082,2083,2086,2087,2095,2096,8443"
   TCP_OUT = "20,21,22,25,37,43,53,80,110,113,443,587,853,873,993,995,2086,2087,2089,2703"
   UDP_IN = "20,21,53,80,443,853"
   UDP_OUT = "20,21,53,113,123,853,873,6277,24441"

   Add the ports of anything else you run, separated by commas; a range uses a colon (30000:35000). The setup script adds a custom SSH port that it finds as a Port line in /etc/ssh/sshd_config, but make sure your SSH port is in TCP_IN before you leave testing mode. cPanel also advises checking the ports after installation.
3. Restart the firewall after any change. csf -r restarts the firewall rules; csf -ra restarts csf and then lfd, which the manual recommends after editing the configuration files:

   csf -ra

4. Test your access. Open a new SSH session and check WHM, cPanel, webmail and FTP while the old session is still open.
5. Turn off testing mode. While TESTING = "1", a cron job clears the firewall rules within TESTING_INTERVAL minutes (5 by default) of starting it, and lfd does not start. In WHM, open Home » Plugins » ConfigServer Security & Firewall, click Firewall Configuration, set TESTING to Off under Initial Settings, click Change, then Restart csf+lfd. From the command line:

   sed -i 's/^TESTING = "1"/TESTING = "0"/' /etc/csf/csf.conf
   grep '^TESTING ' /etc/csf/csf.conf

   The grep line should print TESTING = "0". Then restart csf and lfd with csf -ra.

For the everyday commands (allow, block, unblock, temporary blocks, lfd settings), read CSF Firewall Commands and Settings on cPanel.

Update or remove CSF

• Update: cPanel's version has no built-in updater, so update it with the package manager: yum update cpanel-csf, or apt install --only-upgrade cpanel-csf on Ubuntu.
• Remove: yum remove cpanel-csf, or apt remove cpanel-csf on Ubuntu. According to cPanel, the files in /etc/csf/ and /usr/local/csf/ stay on the server; apt purge cpanel-csf removes them too. Removing CSF leaves the server without a firewall. To go back to firewalld, run systemctl unmask firewalld, reinstall it if you removed it, and enable it.

Frequently asked questions

Why does downloading csf.tgz from configserver.com fail?
The ConfigServer download server no longer answers. Install the cpanel-csf package instead.

Why do I get "Unable to find a match: cpanel-csf"?
cPanel installs this package on cPanel & WHM servers; it is not in the standard AlmaLinux or Ubuntu repositories. On a plain AlmaLinux 9.8 test server without cPanel, dnf install cpanel-csf printed Error: Unable to find a match: cpanel-csf, and on Ubuntu 24.04 apt install cpanel-csf printed E: Unable to locate package cpanel-csf.

Can I install CSF on a server without cPanel?
Not cPanel's version: it is built for cPanel & WHM only. On a server without a control panel, use the firewall that comes with the system, such as firewalld: How to Open a Port in the Firewall on RHEL, AlmaLinux and Rocky Linux.

I locked myself out. What now?
Connect from another IP address or the server console and follow How to Unblock or Whitelist an IP in ConfigServer Security and Firewall?.

Need help with your cPanel server?

• cPanel server management: hardening, migrations and monitoring by our engineers.
• Hire an Expert: an engineer for the time you need, from $8 per 15 minutes, no contract.

Official documentation: cPanel: How to Install ConfigServer Security and Firewall (CSF) and the CSF readme in cPanel's repository.