Alternatives

A CSF firewall alternative for teams with many servers

Last updated: October 23, 2026

In short

ConfigServer stopped developing CSF and lfd on 31 August 2025. CSF still works: cPanel maintains its own fork for cPanel & WHM servers, and community forks carry it on elsewhere. If you need a firewall on one server and you like its config files, keep it. If you run many servers, InfraFence adds what CSF never had: one live dashboard for all of them, detection of what leaves the server (DNS queries tied to the program that made them), and fixes that are checked and undone if they break SSH or a site. You can run both on the same server.

CSF and InfraFence side by side

Where you manage it: CSF and lfd: On each server: csf.conf, csf.allow and csf.deny, or the WHM plugin; InfraFence: One live dashboard for every server; changes reach the server in about a second
Login brute force: CSF and lfd: lfd reads the logs of SSH, FTP, mail and panel logins and blocks in csf.deny; InfraFence: 15 SSH patterns plus Postfix, Dovecot, MySQL, PostgreSQL, MongoDB and FTP; bans of 24 h, 7 days, 30 days, then permanent
Blocks across servers: CSF and lfd: Optional cluster settings that send blocks to the other members; InfraFence: Optional: an address banned on one server is banned on all of them
Outbound traffic: CSF and lfd: Allowed outgoing ports (TCP_OUT) and alerts on suspicious processes; InfraFence: Every DNS query tied to its program; DNS tunnels, random-domain malware and connections to known malicious addresses
Web attacks and bots: CSF and lfd: Not a web firewall: ModSecurity is configured separately; InfraFence: Scoring web firewall from the web logs, about 1,500 bots recognized, optional ModSecurity rules
Malware and file integrity: CSF and lfd: Directory watching for suspicious files; InfraFence: Malware scanner (signatures and YARA) with quarantine, and a hash baseline of critical system files
Fixing what let the attack in: CSF and lfd: You change the configuration by hand; InfraFence: 40–50 hardening checks, depending on the server; fixes are checked after the change and rolled back if SSH or a site stops answering
Incident reports: CSF and lfd: Email alerts; InfraFence: Email on every plan; Slack, Discord, Telegram and webhooks from Basic; NIS2 and GDPR report drafts from Pro
Without an internet connection: CSF and lfd: Works fully offline; InfraFence: Needs to reach the InfraFence dashboard
Who maintains it: CSF and lfd: cPanel's fork (cPanel & WHM servers only) and community forks; InfraFence: The InfraFence team; the agent's source is public under BSL 1.1
Price: CSF and lfd: Free (GPLv3); InfraFence: Free for 1 server; from $8.90 per server per month

	CSF and lfd	InfraFence
Where you manage it	On each server: csf.conf, csf.allow and csf.deny, or the WHM plugin	One live dashboard for every server; changes reach the server in about a second
Login brute force	lfd reads the logs of SSH, FTP, mail and panel logins and blocks in csf.deny	15 SSH patterns plus Postfix, Dovecot, MySQL, PostgreSQL, MongoDB and FTP; bans of 24 h, 7 days, 30 days, then permanent
Blocks across servers	Optional cluster settings that send blocks to the other members	Optional: an address banned on one server is banned on all of them
Outbound traffic	Allowed outgoing ports (TCP_OUT) and alerts on suspicious processes	Every DNS query tied to its program; DNS tunnels, random-domain malware and connections to known malicious addresses
Web attacks and bots	Not a web firewall: ModSecurity is configured separately	Scoring web firewall from the web logs, about 1,500 bots recognized, optional ModSecurity rules
Malware and file integrity	Directory watching for suspicious files	Malware scanner (signatures and YARA) with quarantine, and a hash baseline of critical system files
Fixing what let the attack in	You change the configuration by hand	40–50 hardening checks, depending on the server; fixes are checked after the change and rolled back if SSH or a site stops answering
Incident reports	Email alerts	Email on every plan; Slack, Discord, Telegram and webhooks from Basic; NIS2 and GDPR report drafts from Pro
Without an internet connection	Works fully offline	Needs to reach the InfraFence dashboard
Who maintains it	cPanel's fork (cPanel & WHM servers only) and community forks	The InfraFence team; the agent's source is public under BSL 1.1
Price	Free (GPLv3)	Free for 1 server; from $8.90 per server per month

CSF facts as of October 2026, from the cPanel fork and the CSF documentation. CSF is free software under the GPLv3; InfraFence is a paid service with a free plan for one server.

What happened to CSF

Way to the Web, the company behind ConfigServer, closed on 31 August 2025. Before closing it published the CSF code under the GPLv3, and its own download and update servers went offline.

CSF did not stop working. cPanel forked it and maintains it for cPanel & WHM servers: the fork is on GitHub, focuses on security and stability fixes, and reaches servers through cPanel's own update mirrors. Its package installs only where cPanel is present. Outside cPanel, community forks continue the project, with their own release pace.

So the question is not whether CSF still runs. It is whether a per-server firewall, configured by hand on each machine, is still the right tool when you look after ten, fifty or two hundred servers.

What CSF does well

CSF is a solid stateful firewall with a readable configuration. A single file says which ports are open, lfd blocks repeated login failures, and the WHM plugin puts it all in the panel. It costs nothing, needs no account and works without any outside service. Many hosting teams know it by heart, and that is worth something.

What InfraFence adds

CSF gave you rules on one server. InfraFence gives you a view of all of them, and acts on what it sees.

One dashboard for every server: bans, attacks, findings and the security score, live, with team members and two-factor authentication.
Detection in both directions. A server that is already compromised calls home; InfraFence ties every DNS query to the program, process ID and user that made it, and flags DNS tunnels, random-domain malware and connections to known malicious addresses.
More than login failures: a scoring web firewall, bot management, a malware scanner and file-integrity monitoring of system files, cron, systemd units and SSH keys.
Fixes that cannot take production down. After every change the agent checks that SSH still accepts connections and that your monitored sites still answer, and rolls the change back by itself if they do not. This is on every plan.
With AutoMode, safe fixes are applied for you from a fixed catalogue, and anything risky waits for your one-tap approval.
NIS2 and GDPR report drafts built from the events, for you to review (Pro and AutoMode).

Running CSF and InfraFence together

You do not have to choose on day one. The agent is designed to run next to CSF and is tested against it. It keeps all its rules in its own INFRAFENCE chains and its own address sets, and never edits csf.conf, csf.allow or csf.deny. A csf -r rebuilds the whole firewall; the agent puts its own chain back within a minute and records that it did.

lfd and InfraFence read the same logs and block on their own: lfd's blocks stay in CSF, InfraFence's bans stay in its own set. A sensible split:

Keep in CSF: the open ports (TCP_IN and TCP_OUT), your allow and deny lists, and the panel integration your team already uses.
Let InfraFence add: the dashboard across servers, ban escalation and sharing between servers, the web firewall, bots, malware, outbound and DNS detection, hardening checks and reports.
Each tool keeps its own allow list: put the addresses you trust in InfraFence's allow list too.

When to stay with CSF

InfraFence is not the better choice for everyone. Keep CSF on its own if:

you need a firewall on a single server and have no use for a dashboard;
you are happy managing config files, and your team already knows CSF;
the server is offline or air-gapped: InfraFence needs to reach its dashboard;
you want free software only, with no account and no outside service.

Add InfraFence to a server that runs CSF

Nothing in CSF has to change. A read-only check runs before anything is installed.

01
Create the install token
In the dashboard, open Servers › Add server. The token works once and expires after one hour.
02
Install the agent as root
The installer checks the server first without changing anything. It reports CSF and lfd as detected and explains what the agent will do next to them.
```
curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --token <TOKEN>
```
03
Start in monitor mode if you prefer
Monitor mode detects everything and blocks nothing. Compare what InfraFence sees with what lfd blocks, then turn protection on.
04
Copy your trusted addresses
Add the offices, VPNs and monitoring addresses from csf.allow to InfraFence's allow list, so neither tool blocks them.
05
Check a CSF restart
Run csf -r. Within a minute the agent restores its chain, and the event appears in the dashboard.
```
csf -r
```

Questions about CSF and InfraFence

Is CSF still maintained?

Yes, by others. ConfigServer stopped on 31 August 2025 and released the code under the GPLv3. cPanel maintains a fork for cPanel & WHM servers, delivered through its updates and focused on security and stability fixes, and community forks continue it outside cPanel.

Can I run CSF and InfraFence on the same server?

Yes. InfraFence keeps to its own chains and address sets, never edits CSF's files, and restores its chain within a minute after csf -r. Both block independently.

Does InfraFence replace lfd?

For SSH, mail, database and FTP logins it covers the same ground, with escalating bans and sharing between servers. Many teams keep lfd at first and compare in monitor mode before deciding.

Will InfraFence open or close ports in CSF?

No. It does not edit csf.conf. Ports it closes on its own (Pro and AutoMode, for exposed databases under attack) go in its own chain and can be undone.

Does it work on cPanel servers?

Yes. The agent recognises cPanel & WHM and never edits a configuration the panel manages. The InfraFence plugin for WHM is included in Basic, Pro and AutoMode, installed from your dashboard.

What does it cost?

One server is free, with full protection. Paid plans are $8.90, $18.90 or $28.90 per server per month, 20% less billed yearly.

Try it free on 1 server

Starter gives one server full protection, free and with no credit card.

01
Create a free account, then open Servers › Add server to get your install token. It is valid for one hour.
Create the token

Then run this as root on the server:

curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --token <TOKEN>

Create a free account Read the docs

Sources, checked in October 2026

ConfigServer, CSF, cPanel and WHM are trademarks of their respective owners. InfraFence is not affiliated with or endorsed by them.