CSF 2.3.2 Stable
The current stable release of CSF - Core Shield Firewall, for cPanel & WHM, CloudPanel and Linux servers with no control panel. It installs the native nftables engine, LFD 2.0, Threat Intelligence, malicious upload scanning, the Cloudflare edge allowlist and WAF escalation, with the WHM plugin on cPanel or its own secure web interface elsewhere. 2.3.x fixes the firewall not starting after a reboot, and 2.3.2 makes sure CSF never locks out its own administrator - update every 2.x server. Free and open source under the GNU GPL v3. Verify the SHA-256 checksum before installing.
Download tarball SHA-256 What's new GitHub releases latest.json
Verify, then install as root
# download + verify the checksum curl -fSLO https://shield.underhost.com/firewall/download/csf-2.3.2.tar.gz curl -fSLO https://shield.underhost.com/firewall/download/csf-2.3.2.tar.gz.sha256 sha256sum -c csf-2.3.2.tar.gz.sha256 # extract + install: detects cPanel, CloudPanel or no panel and sets the ports; # on cPanel it migrates and removes legacy CSF v15 tar xzf csf-2.3.2.tar.gz cd csf2 && sh install.sh # review /etc/csf/csf.conf, set TESTING="0", then enforce with auto-revert: csf --safe-reload # auto-reverts unless you run: csf --confirm systemctl enable --now csf.service lfd.service csf --selftest # is CSF (and LFD) really protecting the server?
CloudPanel or no control panel: create a login for the web interface (password + authenticator code), then reach it through an SSH tunnel or your own HTTPS domain. On CloudPanel the installer can publish it for you.
csf --ui-user add admin
# CloudPanel: publish the web UI on your own HTTPS domain (Let's Encrypt included)
CSF_UI_DOMAIN=fw.example.com sh install.sh
Malware scanning: csf --scan-setup installs ClamAV and YARA and turns on scanning of changed website files.
Already running CSF 2.x? Update in place from the Update tab, or run csf --self-update on the server. The updater downloads from the stable channel (releases/latest.json), verifies the SHA-256, and reinstalls while preserving your configuration, deny/allow lists and Threat Intel sets. Guides: no panel · CloudPanel.
Previous releases
Kept for reference: csf-2.3.1.tar.gz (SHA-256), csf-2.3.0.tar.gz (SHA-256) and csf-2.1.6.tar.gz (SHA-256). 2.3.x replaces 2.1.6 and the 2.2.0 release candidates.