Table of Contents<\/strong><\/h2>\n\n- What is CSF (ConfigServer Security & Firewall)?<\/a><\/li>\n
- Why Block an IP Address?<\/a><\/li>\n
- How to Block an IP Address Using CSF in WHM?<\/a><\/li>\n
- How to Unblock an IP Address in CSF?<\/a><\/a><\/li>\n
- Tips & Best Practices<\/a><\/li>\n
- Conclusion<\/a><\/li>\n<\/ol>\n<\/div>\n
What is CSF (ConfigServer Security & Firewall)?<\/strong><\/h3>\nCSF is a popular, advanced firewall plugin for Linux servers. It integrates with cPanel\/WHM and provides features such as:<\/p>\n
\n- IP blocking\/allowing<\/li>\n
- Login <\/a>failure tracking via LFD<\/li>\n
- Port management<\/li>\n
- Firewall hardening<\/li>\n<\/ul>\n
Its WHM interface makes security management easy without needing command-line access.<\/p>\n
Why Block an IP Address?<\/strong><\/h3>\nBlocking an IP address is an important security measure when you notice suspicious or harmful activity on your server. You may want to block an IP in situations such as:<\/p>\n
\n- Brute-force login attempts: When an IP repeatedly fails to log in to WHM, cPanel, or SSH, it indicates a possible hacking attempt.<\/li>\n
- Malicious bot traffic: When automated scripts or bots send excessive or harmful requests to your websites.<\/li>\n
- Spam-related activity: When an IP is detected sending spam emails or abusing mail services.<\/li>\n
- DDoS-like behaviour: When an IP generates unusually high or abnormal <\/a>traffic that impacts server performance.<\/li>\n
- Unauthorised access attempts: Any activity in server logs that indicates potential intrusion attempts.<\/li>\n<\/ul>\n
How to Block an IP Address Using CSF in WHM?<\/strong><\/h3>\n\n- Log in to WHM.<\/li>\n
- Navigate to CSF:\n
\n- In the left WHM menu, search for \u201cConfigServer Security & Firewall\u201d.<\/li>\n
- Click ConfigServer Security & Firewall.
\n![\"whm\"](\"https:\/\/www.webhosting.uk.com\/kb\/wp-content\/uploads\/2025\/11\/Snag_5a2a540d.png\")
<\/a><\/li>\n<\/ol>\n<\/li>\n- Add the IP to the Deny List:\n
\n- Scroll down to the \u201cQuick Deny\u201d section.<\/li>\n
- Enter the IP address you want to block.<\/li>\n
- Add a reason (optional but recommended) \u2014 e.g., Brute-force attack.<\/em><\/li>\n
- Click Quick Deny.
\n![\"quick](\"https:\/\/www.webhosting.uk.com\/kb\/wp-content\/uploads\/2025\/11\/Snag_5a2d5111.png\")
<\/a><\/li>\n- Alternatively, you can manually add the IP under:\n
Firewall Configuration > csf.deny<\/pre>\n<\/li>\n<\/ol>\n<\/li>\n
- Restart CSF & LFD
\nAfter<\/a> blocking the IP, click Restart CSF + LFD.
\nThis ensures the new rule is applied immediately.<\/li>\n<\/ol>\nHow to Unblock an IP Address in CSF?<\/strong><\/h3>\nIf you need to remove an IP from the block list:<\/p>\n
\n- Open ConfigServer Security & Firewall in WHM.<\/li>\n
- Go to Quick Unblock.<\/li>\n
- Enter the IP address.<\/li>\n
- Click Quick Unblock.
\n![\"unblock\"](\"https:\/\/www.webhosting.uk.com\/kb\/wp-content\/uploads\/2025\/11\/Snag_5a2c166e.png\")
<\/a><\/li>\n<\/ol>\nOr manually <\/a>remove it from:<\/p>\ncsf.deny<\/pre>\nRestart CSF again to apply changes.<\/p>\n
Tips & Best Practices<\/strong><\/h3>\n\n- Avoid blocking entire IP ranges unless necessary.<\/li>\n
- Keep CSF updated to the latest version.<\/li>\n
- Enable LFD (Login Failure Daemon) to auto-block abusive IPs.<\/li>\n
- Whitelist <\/a>your own IP to prevent accidental lockouts.<\/li>\n
- Review server logs regularly for suspicious activity.<\/li>\n<\/ul>\n
Conclusion<\/strong><\/h3>\nBlocking an IP in WHM using CSF is a fast and effective method to secure your server. By using the Quick Deny feature, you can protect your server from brute-force attacks, bots, and suspicious traffic. Regular monitoring and proper firewall rules help maintain a secure hosting environment.<\/p>\n
Looking to manage your server\u2019s security more efficiently? Check out our guide on How to configure the CSF firewall in WHM<\/a><\/strong><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"This guide explains how to block an IP address using CSF Firewall in WHM, helping improve server security and reduce malicious traffic. The steps are simple and suitable for both…<\/p>\n
What is CSF (ConfigServer Security & Firewall)?<\/strong><\/h3>\nCSF is a popular, advanced firewall plugin for Linux servers. It integrates with cPanel\/WHM and provides features such as:<\/p>\n
\n- IP blocking\/allowing<\/li>\n
- Login <\/a>failure tracking via LFD<\/li>\n
- Port management<\/li>\n
- Firewall hardening<\/li>\n<\/ul>\n
Its WHM interface makes security management easy without needing command-line access.<\/p>\n
Why Block an IP Address?<\/strong><\/h3>\nBlocking an IP address is an important security measure when you notice suspicious or harmful activity on your server. You may want to block an IP in situations such as:<\/p>\n
\n- Brute-force login attempts: When an IP repeatedly fails to log in to WHM, cPanel, or SSH, it indicates a possible hacking attempt.<\/li>\n
- Malicious bot traffic: When automated scripts or bots send excessive or harmful requests to your websites.<\/li>\n
- Spam-related activity: When an IP is detected sending spam emails or abusing mail services.<\/li>\n
- DDoS-like behaviour: When an IP generates unusually high or abnormal <\/a>traffic that impacts server performance.<\/li>\n
- Unauthorised access attempts: Any activity in server logs that indicates potential intrusion attempts.<\/li>\n<\/ul>\n
How to Block an IP Address Using CSF in WHM?<\/strong><\/h3>\n\n- Log in to WHM.<\/li>\n
- Navigate to CSF:\n
\n- In the left WHM menu, search for \u201cConfigServer Security & Firewall\u201d.<\/li>\n
- Click ConfigServer Security & Firewall.
\n<\/a><\/li>\n<\/ol>\n<\/li>\n- Add the IP to the Deny List:\n
\n- Scroll down to the \u201cQuick Deny\u201d section.<\/li>\n
- Enter the IP address you want to block.<\/li>\n
- Add a reason (optional but recommended) \u2014 e.g., Brute-force attack.<\/em><\/li>\n
- Click Quick Deny.
\n<\/a><\/li>\n- Alternatively, you can manually add the IP under:\n
Firewall Configuration > csf.deny<\/pre>\n<\/li>\n<\/ol>\n<\/li>\n
- Restart CSF & LFD
\nAfter<\/a> blocking the IP, click Restart CSF + LFD.
\nThis ensures the new rule is applied immediately.<\/li>\n<\/ol>\nHow to Unblock an IP Address in CSF?<\/strong><\/h3>\nIf you need to remove an IP from the block list:<\/p>\n
\n- Open ConfigServer Security & Firewall in WHM.<\/li>\n
- Go to Quick Unblock.<\/li>\n
- Enter the IP address.<\/li>\n
- Click Quick Unblock.
\n<\/a><\/li>\n<\/ol>\nOr manually <\/a>remove it from:<\/p>\ncsf.deny<\/pre>\nRestart CSF again to apply changes.<\/p>\n
Tips & Best Practices<\/strong><\/h3>\n\n- Avoid blocking entire IP ranges unless necessary.<\/li>\n
- Keep CSF updated to the latest version.<\/li>\n
- Enable LFD (Login Failure Daemon) to auto-block abusive IPs.<\/li>\n
- Whitelist <\/a>your own IP to prevent accidental lockouts.<\/li>\n
- Review server logs regularly for suspicious activity.<\/li>\n<\/ul>\n
Conclusion<\/strong><\/h3>\nBlocking an IP in WHM using CSF is a fast and effective method to secure your server. By using the Quick Deny feature, you can protect your server from brute-force attacks, bots, and suspicious traffic. Regular monitoring and proper firewall rules help maintain a secure hosting environment.<\/p>\n
Looking to manage your server\u2019s security more efficiently? Check out our guide on How to configure the CSF firewall in WHM<\/a><\/strong><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"This guide explains how to block an IP address using CSF Firewall in WHM, helping improve server security and reduce malicious traffic. The steps are simple and suitable for both…<\/p>\n
Its WHM interface makes security management easy without needing command-line access.<\/p>\n
Why Block an IP Address?<\/strong><\/h3>\nBlocking an IP address is an important security measure when you notice suspicious or harmful activity on your server. You may want to block an IP in situations such as:<\/p>\n
\n- Brute-force login attempts: When an IP repeatedly fails to log in to WHM, cPanel, or SSH, it indicates a possible hacking attempt.<\/li>\n
- Malicious bot traffic: When automated scripts or bots send excessive or harmful requests to your websites.<\/li>\n
- Spam-related activity: When an IP is detected sending spam emails or abusing mail services.<\/li>\n
- DDoS-like behaviour: When an IP generates unusually high or abnormal <\/a>traffic that impacts server performance.<\/li>\n
- Unauthorised access attempts: Any activity in server logs that indicates potential intrusion attempts.<\/li>\n<\/ul>\n
How to Block an IP Address Using CSF in WHM?<\/strong><\/h3>\n\n- Log in to WHM.<\/li>\n
- Navigate to CSF:\n
\n- In the left WHM menu, search for \u201cConfigServer Security & Firewall\u201d.<\/li>\n
- Click ConfigServer Security & Firewall.
\n<\/a><\/li>\n<\/ol>\n<\/li>\n- Add the IP to the Deny List:\n
\n- Scroll down to the \u201cQuick Deny\u201d section.<\/li>\n
- Enter the IP address you want to block.<\/li>\n
- Add a reason (optional but recommended) \u2014 e.g., Brute-force attack.<\/em><\/li>\n
- Click Quick Deny.
\n<\/a><\/li>\n- Alternatively, you can manually add the IP under:\n
Firewall Configuration > csf.deny<\/pre>\n<\/li>\n<\/ol>\n<\/li>\n
- Restart CSF & LFD
\nAfter<\/a> blocking the IP, click Restart CSF + LFD.
\nThis ensures the new rule is applied immediately.<\/li>\n<\/ol>\nHow to Unblock an IP Address in CSF?<\/strong><\/h3>\nIf you need to remove an IP from the block list:<\/p>\n
\n- Open ConfigServer Security & Firewall in WHM.<\/li>\n
- Go to Quick Unblock.<\/li>\n
- Enter the IP address.<\/li>\n
- Click Quick Unblock.
\n<\/a><\/li>\n<\/ol>\nOr manually <\/a>remove it from:<\/p>\ncsf.deny<\/pre>\nRestart CSF again to apply changes.<\/p>\n
Tips & Best Practices<\/strong><\/h3>\n\n- Avoid blocking entire IP ranges unless necessary.<\/li>\n
- Keep CSF updated to the latest version.<\/li>\n
- Enable LFD (Login Failure Daemon) to auto-block abusive IPs.<\/li>\n
- Whitelist <\/a>your own IP to prevent accidental lockouts.<\/li>\n
- Review server logs regularly for suspicious activity.<\/li>\n<\/ul>\n
Conclusion<\/strong><\/h3>\nBlocking an IP in WHM using CSF is a fast and effective method to secure your server. By using the Quick Deny feature, you can protect your server from brute-force attacks, bots, and suspicious traffic. Regular monitoring and proper firewall rules help maintain a secure hosting environment.<\/p>\n
Looking to manage your server\u2019s security more efficiently? Check out our guide on How to configure the CSF firewall in WHM<\/a><\/strong><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"This guide explains how to block an IP address using CSF Firewall in WHM, helping improve server security and reduce malicious traffic. The steps are simple and suitable for both…<\/p>\n
How to Block an IP Address Using CSF in WHM?<\/strong><\/h3>\n\n- Log in to WHM.<\/li>\n
- Navigate to CSF:\n
\n- In the left WHM menu, search for \u201cConfigServer Security & Firewall\u201d.<\/li>\n
- Click ConfigServer Security & Firewall.
\n<\/a><\/li>\n<\/ol>\n<\/li>\n- Add the IP to the Deny List:\n
\n- Scroll down to the \u201cQuick Deny\u201d section.<\/li>\n
- Enter the IP address you want to block.<\/li>\n
- Add a reason (optional but recommended) \u2014 e.g., Brute-force attack.<\/em><\/li>\n
- Click Quick Deny.
\n<\/a><\/li>\n- Alternatively, you can manually add the IP under:\n
Firewall Configuration > csf.deny<\/pre>\n<\/li>\n<\/ol>\n<\/li>\n
- Restart CSF & LFD
\nAfter<\/a> blocking the IP, click Restart CSF + LFD.
\nThis ensures the new rule is applied immediately.<\/li>\n<\/ol>\nHow to Unblock an IP Address in CSF?<\/strong><\/h3>\nIf you need to remove an IP from the block list:<\/p>\n
\n- Open ConfigServer Security & Firewall in WHM.<\/li>\n
- Go to Quick Unblock.<\/li>\n
- Enter the IP address.<\/li>\n
- Click Quick Unblock.
\n<\/a><\/li>\n<\/ol>\nOr manually <\/a>remove it from:<\/p>\ncsf.deny<\/pre>\nRestart CSF again to apply changes.<\/p>\n
Tips & Best Practices<\/strong><\/h3>\n\n- Avoid blocking entire IP ranges unless necessary.<\/li>\n
- Keep CSF updated to the latest version.<\/li>\n
- Enable LFD (Login Failure Daemon) to auto-block abusive IPs.<\/li>\n
- Whitelist <\/a>your own IP to prevent accidental lockouts.<\/li>\n
- Review server logs regularly for suspicious activity.<\/li>\n<\/ul>\n
Conclusion<\/strong><\/h3>\nBlocking an IP in WHM using CSF is a fast and effective method to secure your server. By using the Quick Deny feature, you can protect your server from brute-force attacks, bots, and suspicious traffic. Regular monitoring and proper firewall rules help maintain a secure hosting environment.<\/p>\n
Looking to manage your server\u2019s security more efficiently? Check out our guide on How to configure the CSF firewall in WHM<\/a><\/strong><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"This guide explains how to block an IP address using CSF Firewall in WHM, helping improve server security and reduce malicious traffic. The steps are simple and suitable for both…<\/p>\n
- \n
- In the left WHM menu, search for \u201cConfigServer Security & Firewall\u201d.<\/li>\n
- Click ConfigServer Security & Firewall.
\n<\/a><\/li>\n<\/ol>\n<\/li>\n- Add the IP to the Deny List:\n
- \n
- Scroll down to the \u201cQuick Deny\u201d section.<\/li>\n
- Enter the IP address you want to block.<\/li>\n
- Add a reason (optional but recommended) \u2014 e.g., Brute-force attack.<\/em><\/li>\n
- Click Quick Deny.
\n<\/a><\/li>\n- Alternatively, you can manually add the IP under:\n
Firewall Configuration > csf.deny<\/pre>\n<\/li>\n<\/ol>\n<\/li>\n
- Restart CSF & LFD
\nAfter<\/a> blocking the IP, click Restart CSF + LFD.
\nThis ensures the new rule is applied immediately.<\/li>\n<\/ol>\nHow to Unblock an IP Address in CSF?<\/strong><\/h3>\n
If you need to remove an IP from the block list:<\/p>\n
- \n
- Open ConfigServer Security & Firewall in WHM.<\/li>\n
- Go to Quick Unblock.<\/li>\n
- Enter the IP address.<\/li>\n
- Click Quick Unblock.
\n<\/a><\/li>\n<\/ol>\nOr manually <\/a>remove it from:<\/p>\n
csf.deny<\/pre>\n
Restart CSF again to apply changes.<\/p>\n
Tips & Best Practices<\/strong><\/h3>\n
- \n
- Avoid blocking entire IP ranges unless necessary.<\/li>\n
- Keep CSF updated to the latest version.<\/li>\n
- Enable LFD (Login Failure Daemon) to auto-block abusive IPs.<\/li>\n
- Whitelist <\/a>your own IP to prevent accidental lockouts.<\/li>\n
- Review server logs regularly for suspicious activity.<\/li>\n<\/ul>\n
Conclusion<\/strong><\/h3>\n
Blocking an IP in WHM using CSF is a fast and effective method to secure your server. By using the Quick Deny feature, you can protect your server from brute-force attacks, bots, and suspicious traffic. Regular monitoring and proper firewall rules help maintain a secure hosting environment.<\/p>\n
Looking to manage your server\u2019s security more efficiently? Check out our guide on How to configure the CSF firewall in WHM<\/a><\/strong><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"
This guide explains how to block an IP address using CSF Firewall in WHM, helping improve server security and reduce malicious traffic. The steps are simple and suitable for both…<\/p>\n
- Review server logs regularly for suspicious activity.<\/li>\n<\/ul>\n
- Click Quick Deny.
- Add the IP to the Deny List:\n