Short answer: ConfigServer closed on 31 August 2025, so csf/lfd (ConfigServer Security & Firewall) is no longer developed by its authors; installed copies keep running and community forks exist. The maintained replacements are MegaWit Firewall (csf-style firewall and lfd-style brute-force bans with a full panel, imports your csf configuration in one command, cPanel, Plesk and DirectAdmin), Imunify360 (firewall inside cPanel's recommended all-in-one suite), BitNinja (panel-independent security suite), community csf forks (free, same config files), and free building blocks — cPHulk on cPanel, fail2ban and firewalld.
Way to the Web Ltd., the company behind ConfigServer, closed on 31 August 2025. csf and lfd were free scripts, so they did not stop working, but:
Sources: cPanel support, Centmin Mod, linuxblog.io.
What a csf replacement needs to cover: a default-deny port firewall, allow/deny lists, temporary and permanent bans, lfd-style brute-force detection across SSH, mail, FTP and the control panel, and country blocking.
| Option | Type | Port firewall & IP lists | Brute-force bans (lfd-style) | Panels | Pricing model |
|---|---|---|---|---|---|
| MegaWit Firewall | Commercial firewall + brute-force agent | Yes (iptables/ipset, like csf), country/ASN blocking | Yes: SSH, mail, Exim, FTP, cPanel, DirectAdmin; port-scan detection | cPanel/WHM, Plesk, DirectAdmin | Flat per server, unlimited accounts; 15-day free trial |
| Imunify360 | Commercial all-in-one suite (firewall, WAF, malware scanner) | Yes | Yes | cPanel, Plesk, DirectAdmin and others | Per server, tiered by number of accounts |
| BitNinja | Commercial server-security suite | Yes, with shared IP reputation | Yes | Panel-independent | Per server subscription |
| Community csf forks | Free, open source (GPL) | Yes (same csf) | Yes (same lfd) | Same as csf | Free; maintenance depends on volunteers |
| cPHulk + Host Access Control | Built into cPanel/WHM | Basic host access rules only | cPanel services only | cPanel only | Included with cPanel |
| fail2ban + firewalld | Free, open source | firewalld zones; no panel UI | Yes, via per-service jails you configure | Panel-independent, command line | Free |
Competitor details are summarised from each vendor's public documentation as of October 2026; check the vendor for current features and prices.
MegaWit Firewall (MWF) is our product, built as a csf/lfd replacement. It uses the same proven ipset + iptables approach as csf, with allow/deny/ignore lists, temporary bans, allowed-port policy, country (GeoIP), ASN and public-blocklist blocking, and SYN/port-flood protection. Brute-force detection covers SSH, mail, Exim, FTP, cPanel and DirectAdmin logins, and port scans are detected and banned by default. It adds what csf never had: a full dashboard on cPanel/WHM, Plesk and DirectAdmin, a lockout-proof default-deny, a shared attacker network across MegaWit servers, and mwf import-csf, which imports your existing /etc/csf lists, rules, ports, country blocks and lfd limits in one command. $9.99/month per server.
Best for: hosts that liked how csf worked and want it maintained, with a panel and a painless migration.
Imunify360's firewall is one part of CloudLinux's all-in-one suite, alongside its WAF and malware scanner, and it is what cPanel recommends after the ConfigServer shutdown. It replaces much more than csf, and its price grows with the number of accounts on the server.
Best for: hosts that want one vendor for firewall, WAF and scanner.
A panel-independent security suite with a firewall, shared IP reputation and a WAF. A good fit for mixed fleets that are not all on one control panel.
csf was released under the GPL, and several community forks keep it installable. They keep your existing configuration as is, but there is no vendor behind them, and you must make sure updates come from a source you trust.
cPHulk blocks brute-force logins to cPanel's own services, and WHM's Host Access Control adds basic allow/deny rules. Useful and free, but not a port firewall and nothing for non-cPanel services.
fail2ban bans IPs from log patterns and firewalld manages the firewall. Together they can cover most of what csf/lfd did, but you configure every jail and rule yourself, and there is no panel interface.
mwf import-csf, then apply it with --apply (or "Migrate from csf" in the panel).Yes, an installed csf/lfd keeps running, but ConfigServer no longer releases updates or offers support, and its download servers are gone. Fixes for new distributions and panel versions now depend on community forks.
For a maintained commercial replacement, the main options are MegaWit Firewall (works like csf + lfd, imports an existing csf configuration in one command, flat per-server price, also on Plesk and DirectAdmin) and Imunify360 (firewall inside an all-in-one suite priced by account count). Free options are a community csf fork, or fail2ban with firewalld; cPanel's built-in cPHulk only protects cPanel's own logins.
Yes: community forks of csf (same configuration, maintained by volunteers), and fail2ban with firewalld (you write the jails and rules yourself). On cPanel, cPHulk adds free brute-force protection for cPanel services.
With MegaWit Firewall, yes: mwf import-csf reads /etc/csf — allow, deny and ignore lists, advanced rules, allowed ports, country blocks, SYN/port-flood settings and lfd limits — shows a preview, and applies it with --apply.
MegaWit Firewall installs with one command on cPanel/WHM, Plesk and DirectAdmin and adds its panel to each. Imunify360 and BitNinja also support several panels; fail2ban and firewalld are panel-independent command-line tools.
The same shutdown ended cxs, cmq and cmc. Compare cxs alternatives, cmq alternatives and cmc alternatives.