ConfigServer Firewall (CSF)

ConfigServer Firewall and its login failure daemon (LFD) are on most cPanel and DirectAdmin servers. CSF can run a script for every block, and load remote blocklists. The original project closed in 2025; these steps work the same on the community-maintained fork.

Report every block

1. Save the reporter as /usr/local/bin/isipsafe-report and make it executable (chmod 700). CSF passes the address, ports, whether the block is permanent, direction, timeout and LFD's message:

   #!/bin/sh
   # Called by CSF for every block: $1 IP, $2 ports, $3 permanent, $4 in/out, $5 timeout, $6 message
   KEY="sl_your_key_here"
   case "$6" in
     *sshd*)                     CATS="ssh,brute-force" ;;
     *ftpd*|*pure-ftpd*|*vsftpd*) CATS="ftp-brute-force" ;;
     *smtpauth*|*dovecot*|*imap*|*pop3*|*exim*) CATS="mail-server-attack,brute-force" ;;
     *cpanel*|*whm*|*webmail*|*htpasswd*|*mod_security*) CATS="web-app-attack,brute-force" ;;
     *PS_LIMIT*|*"Port Scan"*)   CATS="port-scan" ;;
     *)                          CATS="hacking" ;;
   esac
   curl -s -m 10 "https://isipsafe.com/api/v1/report?key=$KEY" \
     --data-urlencode "ip=$1" --data-urlencode "categories=$CATS" \
     --data-urlencode "comment=CSF/LFD: $6" >/dev/null 2>&1 &
   exit 0

2. Point CSF at it in /etc/csf/csf.conf:

   BLOCK_REPORT = "/usr/local/bin/isipsafe-report"

   and restart with csf -ra. Blocks of your own allowlisted addresses never reach the script.

Block listed addresses

Add one line to /etc/csf/csf.blocklists (name, refresh in seconds, maximum entries with 0 for no limit, URL):

ISIPSAFE|3600|0|https://isipsafe.com/api/v1/blocklist?key=sl_your_key_here&format=txt&confidenceMinimum=90

Set LF_IPSET = "1" in csf.conf so a large list goes into an ipset instead of thousands of iptables rules, then csf -ra.

Need a hand?

If something here does not work with your version of ConfigServer Firewall (CSF), or you have improved it, tell us. We update these pages with what people send.

ConfigServer Firewall (CSF) and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.