ConfigServer (Way to the Web Ltd), the company that made the CSF firewall, closed on 31 August 2025. Before closing, it released CSF as free, open-source software under the GPLv3 licence. CSF still works, and two maintained versions now carry it forward. This guide shows which one to use and how to install it.
Quick answer
- cPanel server: run
yum install cpanel-csf(AlmaLinux, CloudLinux) orapt install cpanel-csf(Ubuntu). This installs cPanel's own maintained CSF, and also upgrades an old ConfigServer CSF in place. - Any other Linux server: install the community fork from Aetherinox, which also supports Webmin, DirectAdmin, CyberPanel and others.
- Do not download CSF from the old
configserver.comaddresses any more.
Why the old CSF needs replacing
CSF keeps running after the shutdown, with your rules unchanged. But the original version will never get another security fix, and its update checker still points at the closed company's download servers. CSF runs as root, so if anyone ever took over those addresses, an automatic update could install whatever they wanted. Moving to a maintained version fixes both problems.
The free CSF copy that ConfigServer placed on GitHub before closing (waytotheweb/scripts) has since been removed, so older guides that link to it no longer work.
Check which CSF you have now
Log in to the server as root over SSH, then run:
cat /etc/csf/version.txt
A version of 15.00 or lower that you installed from configserver.com is the original, unmaintained CSF. If you get No such file or directory, CSF is not installed.
Option 1: cPanel servers — cPanel CSF
Since February 2026, cPanel publishes its own version of CSF, focused on security and stability fixes. cPanel announcement It installs as a normal system package, so it updates along with the rest of the server.
If you already have the old CSF, cPanel may have switched it for you. From 25 February 2026, it automatically moved servers running CSF 14.x or 15.00 with AUTO_UPDATES turned on. If AUTO_UPDATES was off, or your version is older, switch manually with the same command as a new install, below. Your existing rules and settings are kept.
CSF does not work alongside firewalld, so stop and disable firewalld first if it is running:
systemctl disable --now firewalld
Install, or upgrade to, cPanel CSF.
On AlmaLinux or CloudLinux:
yum install cpanel-csf
On Ubuntu:
apt install cpanel-csf
Then open WHM » Plugins » ConfigServer Security & Firewall, check that the ports your server needs are open, and turn off testing mode:
- Click Firewall Configuration.
- In Initial Settings, set TESTING to Off, then click Change.
- Click Restart csf+lfd.
Until testing mode is off, CSF clears its rules every few minutes and the login failure daemon (lfd) does not run. cPanel install guide
cPanel maintains this version but does not offer support for configuring or troubleshooting CSF itself.
Option 2: other servers — the Aetherinox fork
For servers without cPanel, such as plain AlmaLinux, Debian or Ubuntu, or servers running Webmin, DirectAdmin or CyberPanel, use the community fork maintained by Aetherinox. It continues CSF development with new releases (15.10 in February 2026). Aetherinox releases
Stop any firewall that is already running. On Debian or Ubuntu that is usually ufw:
systemctl disable --now ufw
On AlmaLinux or Rocky Linux it is usually firewalld:
systemctl disable --now firewalld
Download and unpack CSF:
cd /tmp
wget https://download.configserver.dev/csf.tgz
tar -xzf csf.tgz
configserver.dev is the Aetherinox project's own download server, not the closed ConfigServer company. The same files are also published on the project's GitHub releases page with checksums.
Run the installer. It detects your Linux distribution and any control panel automatically:
sh /tmp/csf/install.sh
Check that CSF is installed and running:
csf -v
systemctl status csf
CSF starts in testing mode. Once you have checked that the open ports in /etc/csf/csf.conf include everything your server needs, especially your SSH port, set TESTING = "0" in that file and restart:
csf -ra
For Webmin, DirectAdmin and other panels, see the Aetherinox install guide for the extra step that adds CSF to the panel's menu.
Check that CSF is working
csf -v
csf -l | head -20
csf -v shows the version and that CSF is running. csf -l lists the active firewall rules. If the list is empty or you see csf and lfd have been disabled, run csf -e to enable them.
Before you close your SSH session, open a second one to make sure you can still log in. If a wrong port setting locks you out, you will need your host's console to fix it.