Securing a CyberPanel server

Last updated: November 7, 2026

CyberPanel runs your sites on OpenLiteSpeed or LiteSpeed Enterprise, with its own firewall screen and an optional CSF. This page covers how its firewall works, what to watch for since CSF's original vendor closed, and what the InfraFence agent does on a CyberPanel server.

The CyberPanel facts come from its source code on GitHub, as of November 2026.

CyberPanel's firewall: firewalld, or CSF

firewalld is what CyberPanel's own Firewall screen drives: each rule you add there becomes a firewalld rich rule in the public zone, followed by firewall-cmd --reload (source).
CSF can be installed from CyberPanel's Security menu instead. Its installer still downloads CSF from download.configserver.com (source), ConfigServer's own server, which went offline when the company closed on 31 August 2025. Don't run it on a new server. If CSF is already installed, it keeps working, but updates no longer come from ConfigServer.

Whichever you use, limit who can reach CyberPanel's admin port (8090 by default) to your own addresses where you can, and keep SSH on keys.

What the agent does on a CyberPanel server

It recognises CyberPanel from /usr/local/CyberCP and shows it in the dashboard, and it detects OpenLiteSpeed or LiteSpeed Enterprise even though they live outside the usual paths.
It leaves LiteSpeed's configuration alone. The agent does not edit LiteSpeed's configuration and installs no ModSecurity rules there. Bots set to Block are banned at the firewall instead (Bots).
It reads every site's traffic: OpenLiteSpeed's virtual host logs and CyberPanel's per-domain /home/*/logs/*.access_log files, with the same web attack rules as on any server (Web firewall).
It scans the sites for malware, from the document root of each OpenLiteSpeed virtual host (Malware).
It stops SSH brute force at the firewall, can close database ports open to the internet when you ask from the dashboard, and watches outbound traffic, DNS and file integrity, like on any Linux server.

Next to firewalld, CSF and Imunify360

Tool	What InfraFence does
firewalld	firewalld keeps its own rules; InfraFence's chain is independent. When CyberPanel reloads firewalld, the agent puts its chain back within a minute.
CSF and lfd	Keeps its own chain and never edits CSF's files. After `csf -r` it restores only its own chains, jumps and sets. lfd and InfraFence each block on their own.
Imunify360	Leaves Imunify360's firewall, ipsets and WAF alone and keeps to its own chain; both block independently.

Its rules live in its own INFRAFENCE chains and it never edits another tool's rules. If a tool rewrites the firewall over and over, the agent reports it as a firewall conflict, with where to look (Coexistence).

Install the agent on CyberPanel

Run the read-only check first: the installer's --dry-run reports what would get in the way and changes nothing.
In the dashboard, Servers › Add server creates an install token, valid for one hour.
Run the install command as root over SSH. Nothing in CyberPanel needs to change.

curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --dry-run

The agent is tested on 15 distributions before every release, Ubuntu and AlmaLinux among them (Supported distributions).

Try it free on 1 server

Starter gives one server full protection, free and with no credit card.

01
Create a free account, then open Servers › Add server to get your install token. It is valid for one hour.
Create the token

Then run this as root on the server:

curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --token <TOKEN>

Create a free account Read the docs