CSF and LFD on cPanel: Install, Remove, Migrate (2026)

Last updated: 30 October 2026

CSF (ConfigServer Security & Firewall) with its login failure daemon, LFD, was the most common firewall on cPanel/WHM servers. This guide keeps the installation and removal steps for servers that still run it, and explains what to do now that it is unsupported.

In this guide

• Current status
• Install steps (legacy)
• Remove CSF and LFD
• Plan the migration
• FAQ
• Sources

Current status

cPanel states that as of 31 August 2025 the ConfigServer tools, including CSF, CXS and MailScanner, are officially discontinued. Free scripts remain under GPLv3, but there are no patches, updates or support. A firewall that is no longer maintained will not receive fixes for new bugs or for changes in cPanel, so treat it as a temporary measure.

Install steps (legacy)

These are the original steps for a server that must still be built the old way. Run them as root over SSH.

1. Go to the source directory:

   cd /usr/src

2. Remove any previous download:

   rm -fv csf.tgz

3. Download the archive from the ConfigServer download host (check that the host still serves it):

   wget https://download.configserver.com/csf.tgz

4. Extract and install:

   tar -xzf csf.tgz
   cd csf
   sh install.sh

5. Test that your server meets CSF requirements, then log in to WHM. The CSF plugin appears under Plugins.

Always add your own IP address to the allow list before you enable the firewall, or you can lock yourself out.

Remove CSF and LFD

cd /etc/csf
sh uninstall.sh

Check afterwards that the server still has a working firewall (for example firewalld or the replacement product), and that SSH and cPanel ports are reachable.

Plan the migration

1. List your CSF settings: open ports, allow and deny lists, rate limits and port knocking.
2. Choose a replacement. cPanel points to Imunify360. Other options are firewalld with fail2ban, or a hosting-provider firewall in front of the server.
3. Recreate the rules, test from a second connection, then remove CSF.
4. Keep a note of the change in your server documentation.

FAQ

Is CSF still safe to run?

It still works, but it will not receive updates. Reduce exposure by limiting who can reach the firewall UI and plan a migration.

Will cPanel remove CSF?

cPanel announced the end of ConfigServer and recommends Imunify360. Check cPanel release notes for changes that affect plugins.

What is LFD?

The login failure daemon, a CSF component that blocks IP addresses after repeated failed logins.

Sources

• cPanel: The end of ConfigServer

More on this site: Security guides · All IT guides