How To Install and Configure CSF on CentOS 7?

Updated: 28 September 2026 · Applies to: cPanel & WHM 138 on AlmaLinux 9 (cpanel-csf)

ConfigServer Security & Firewall (CSF) is a firewall with login-failure detection (lfd), popular on cPanel servers. Its original developer closed on 31 August 2025 and released the code under the GPLv3 licence. cPanel now maintains a CSF package for cPanel & WHM servers.

cPanel & WHM servers (AlmaLinux / Rocky)

1. Install cPanel's package: dnf install cpanel-csf.
2. If firewalld is running, disable it (CSF replaces it): systemctl disable --now firewalld.
3. Open WHM › Plugins › ConfigServer Security & Firewall, or edit /etc/csf/csf.conf.
4. Check the open ports in TCP_IN and TCP_OUT (add your SSH port if you changed it), then set TESTING = "0". In testing mode the rules are removed every few minutes, so a mistake cannot lock you out for long.
5. Restart CSF and lfd: csf -ra.

Everyday commands

csf -a 203.0.113.10      # always allow an IP
csf -d 198.51.100.7      # block an IP
csf -dr 198.51.100.7     # remove the block
csf -g 198.51.100.7      # search the rules for an IP
csf -t                   # list temporary blocks (lfd)
csf -r                   # reload the rules

Servers without cPanel

cPanel's package works only on cPanel servers. On other servers, use the standard firewall (firewalld or UFW) together with Fail2Ban for login-failure blocking; both are maintained by the distributions. Community forks of CSF exist, but check that the one you choose is actively maintained before relying on it.

Note: Before enabling any firewall remotely, make sure your SSH port is allowed, and keep a console open (on a Ucartz VPS: VNC in the VPS dashboard).