FAQ

Home · Start Here

At a glance

• Answers to the most common CSF/LFD operator questions.
• Covers installation, blocking, unblocking, testing mode, and recovery.
• Quick links to deeper documentation for each topic.

Is CSF only for cPanel?

No. CSF supports both panel-managed and generic Linux deployments.

See: Installation on a Generic Linux Server

Where should I start as a new admin?

Use this order:

1. Start Here
2. Install & Migrate
3. Usage: Getting Started
4. Configuration Guide

How do I check the current CSF version?

csf -v

How do I update CSF?

# Check for available update
csf -c

# Apply update
csf -u

See: Install & Migrate

Where do I check breaking changes before upgrading?

Use:

• Upgrade & Breaking Changes
• Changelog

This gives you both rollout guidance and release-change context before production updates.

How do I check if a specific IP is blocked?

csf -g 203.0.113.10

This searches all allow/deny lists, temporary blocks, and active iptables chains.

How do I unblock an IP?

# Remove from permanent deny list
csf -dr 203.0.113.10

# Remove from temporary block list
csf -tr 203.0.113.10

# Verify it is cleared
csf -g 203.0.113.10

What is TESTING mode and when should I use it?

TESTING="1" in csf.conf enables a safety net: CSF will automatically flush all firewall rules after 5 minutes. This prevents permanent lockout during initial setup or major config changes.

Keep TESTING="1" until you have verified trusted access paths work correctly, then set TESTING="0" and reload.

See: Configuration Guide

Why does the Web UI fail in browser on port 6666?

Many modern browsers treat 6666 as restricted/unsafe. Use a different high port (for example 8750) and restart services.

See:

• Integrated User Interface Feature
• Troubleshooting & Recovery

Can I automate actions when an IP is blocked?

Yes. Use block/unblock reporting hooks.

See: Block Reporting

Can CSF work with Cloudflare?

Yes, with specific behavior and trust-chain considerations.

See: CloudFlare

Why am I getting lockouts or false positives?

Typical causes are aggressive thresholds, incomplete ignore lists, or log-source assumptions.

See:

• Login Tracking
• Process Tracking
• Advanced Allow/Deny Filters
• Mitigating issues with syslog/rsyslog logs (RESTRICT_SYSLOG)

What should I run after changing config files?

For most config-file changes:

csf -ra

Then check:

tail -n 100 /var/log/lfd.log

How do I add custom iptables rules that survive CSF restarts?

Use the pre/post script mechanism:

• Place scripts in /usr/local/include/csf/pre.d/ (run before CSF rules)
• Place scripts in /usr/local/include/csf/post.d/ (run after CSF rules)

See: External Pre- and Post- Scripts

How do I completely uninstall CSF?

sh /etc/csf/uninstall.sh

This removes CSF/LFD, flushes firewall rules, and cleans up service units.

Where are the main log and config files?

File	Purpose
/etc/csf/csf.conf	Main configuration
/etc/csf/csf.allow	Permanent allow list
/etc/csf/csf.deny	Permanent deny list
/etc/csf/csf.ignore	LFD ignore list
/var/log/lfd.log	Primary operational log

Full map: Cheatsheet: Structure

I'm locked out — what do I do?

See the emergency lockout recovery section: Troubleshooting & Recovery

Last reviewed: 2026-02-25

---

← Troubleshooting & Recovery · Back to Home