A firewall for cPanel & WHM, CloudPanel and servers with no control panel, built on native nftables, IPv4 + IPv6, an event-driven LFD 2.0, and live Threat Intelligence - part of UnderShield. Version 2.3.2 stable is available now, free and open source.
2.3.2 is the current stable release for cPanel, CloudPanel and servers with no control panel - tested on clean installs of 10 Linux distributions, with a reboot and a real SSH brute-force attack on each. GPL-3.0.
# csf -d 185.203.44.19 SSH brute force csf: 185.203.44.19 added to csf_deny4 (nft set - no rebuild) # csf inspect 185.203.44.19 state ...... BLOCKED set .... csf_deny4 # csf health nft table ok · sets ok · ruleset validated build: 2.3.2 (stable)
cPanel & WHMCloudPanelNo panelnftables · inetIPv4 + IPv6Stable · 2.3.2CSF 2.3 brings the same nftables engine, LFD 2.0 and Threat Intelligence to CloudPanel and to Linux servers with no control panel, with its own secure web interface instead of WHM.
The installer detects CloudPanel and opens exactly what it needs: SSH, HTTP, HTTPS (with HTTP/3) and the CloudPanel admin port 8443, which the lockout guard will never close. Optionally it publishes the web interface on your own HTTPS domain.
StableOn a server with no control panel, CSF opens only SSH, HTTP and HTTPS, and reads your SSH configuration (including sshd_config.d) so a custom SSH port is never locked out.
StableThe same firewall interface as in WHM, served by its own small service on 127.0.0.1 only. Sign-in with hashed passwords, two-factor authentication, CSRF protection and per-IP lockout, and failed logins are watched by LFD.
Stable# csf --platform platform ... CloudPanel (ports 22, 80, 443, 8443) # csf --ui-user add admin password + authenticator code set for admin # systemctl status csf2-ui active - listening on 127.0.0.1:6789, login + 2FA
Every capability below ships in the 2.3.2 stable release, backed by a 590+ assertion automated test suite and tested on 10 Linux distributions and live cPanel servers.
A single table inet csf with dynamic, timeout-capable sets - IPv4 and IPv6 in one model. Blocking one IP updates a set element, never a rebuild.
StableAn event-driven detection layer with modular collectors, incremental log tailing, temporary blocks with native set timeouts, and a clear reason behind every action.
StableService and version detection, cPHulk and ModSecurity awareness, automatic SSH/cPanel port presets on install, and a WHM interface registered through AppConfig.
StableReputable IP/CIDR feeds (Spamhaus DROP, Feodo C2, CINS, IPsum, Blocklist.de) load into dedicated nftables sets with per-feed toggles and category policies - inbound, outbound, or both.
StableAtomic rule changes, a lockout guard that checks your live SSH session, and a --safe-reload watchdog that auto-reverts if you can't confirm.
StableThe WHM interface checks the release channel, then downloads, SHA-256 verifies, and installs new versions in place with a live progress bar - your config and lists preserved.
StableWebsite files that changed are scanned every 5 minutes with ClamAV, the rfxn (Linux Malware Detect) signatures and YARA. Malware goes to quarantine and the uploader is blocked for 24 hours. Restore or delete with one click.
New in 2.3The path a request takes through CSF 2.1 - traceable steps, explainable decisions, no opaque automation.
Suspicious activity reaches a protected service.
A log line records an actionable signal.
Collectors normalise it into a structured event.
The risk engine scores the source and checks thresholds.
The IP is added to a set with a timeout.
Traffic is dropped in-kernel before it reaches the service.
Modular collectors watch the parts of a cPanel server that matter most and feed a single correlation engine, so a distributed attacker is recognised as one hostile actor and enforced progressively.
service sshd event authentication_failure source 185.203.44.19 score 72 / short block action add to csf_temp4 (timeout 300s) reason LFD: sshd auth_failure (score 72)
# csf -a 203.0.113.7 # allow # csf -td 198.51.100.9 3600 # temporary deny # csf -g 198.51.100.9 # inspect # csf --safe-reload # apply, auto-revert # csf --self-update # update in place The familiar commands you know, on a native nftables engine. Legacy csf.conf is migrated.
Your operational muscle memory carries over. The familiar commands and configuration files drive a native nftables engine underneath.
The same tabbed interface runs inside WHM on cPanel servers and as a standalone, two-factor protected web UI on CloudPanel and plain Linux. Screenshots from CSF 2.3.2 on Ubuntu 26.04 with no control panel; addresses shown are documentation examples.
CSF 2.3 runs on cPanel & WHM, CloudPanel and servers without a control panel, on native nftables. Every release is tested on clean installs, with a reboot and a real SSH brute-force attack on each system marked Tested.
2.3.2 is the current stable release, free and open source under the GNU GPL v3. It installs the native nftables engine, LFD 2.0, cPanel integration or its own web interface, Threat Intelligence, malicious upload scanning, the Cloudflare edge allowlist, WAF escalation, and the WHM interface - and cleanly migrates and uninstalls both legacy ConfigServer CSF v15 and the cPanel-maintained CSF fork. Available for cPanel, CloudPanel and plain Linux servers, and rolled out across UnderHost infrastructure as part of UnderShield.
Running 2.1 or 2.2? Update now: 2.3.2 fixes the firewall not starting after a reboot. Use the Update tab or csf --self-update - your configuration and lists are kept.
Protection and monitoring, built into UnderHost infrastructure.The full source code, every release with its SHA-256 checksum, the changelog and the issue tracker live in the public UnderHost/csf repository. Read the code before you install it, report a bug, suggest a feature or send a pull request - CSF is free software under the GNU GPL v3.
git clone https://github.com/UnderHost/csf.git
cd csf
sh run-tests.sh # 600+ automated tests
sh install.sh # as rootEverything administrators ask before switching their cPanel firewall.