Stable release

CSF 2.1.5 Stable

The current stable release of CSF - cPanel Shield Firewall. It installs the native nftables engine, LFD 2.0, cPanel integration, Threat Intelligence, the Cloudflare edge allowlist, WAF escalation, and the WHM interface - and cleanly migrates and uninstalls legacy CSF v15. Free and open source under the GNU GPL v3. Verify the SHA-256 checksum before installing.

packagecsf-2.1.5.tar.gz

version2.1.5 (stable channel)

size266,287 bytes

released2026-08-26

upgrades fromCSF 15.00 · CSF 2.0.x

sha256951e15e296c0347e9ed9c88ac6379d12c49e708a6db4065f712368c843a93ef8

signaturenot yet published — verify sha256

licenseGPL-3.0-or-later

Download tarball SHA-256 latest.json

Install

Verify, then install as root

# download + verify the checksum
curl -fSLO https://shield.underhost.com/firewall/download/csf-2.1.5.tar.gz
curl -fSLO https://shield.underhost.com/firewall/download/csf-2.1.5.tar.gz.sha256
sha256sum -c csf-2.1.5.tar.gz.sha256

# extract + install (uninstalls legacy CSF v15, migrates config, auto-detects ports)
tar xzf csf-2.1.5.tar.gz
cd csf2 && ./install.sh

# check status, then enable enforcement
csf --cpanel-check
csf -l
# review /etc/csf/csf.conf, set TESTING="0", then:
systemctl enable --now csf.service lfd.service
csf --safe-reload      # auto-reverts unless you run: csf --confirm

Already running CSF 2.x? Update in place from the WHM Update tab, or run csf --self-update on the server. The updater downloads from the stable channel (releases/latest.json), verifies the SHA-256, and reinstalls while preserving your configuration, deny/allow lists and Threat Intel sets.