Is CSF Firewall Blocking Your Site Traffic? Fix CT_LIMIT and More (2026)
Is your CSF firewall blocking real visitors? Are they suddenly unable to reach your website, while your server looks fine? If your host runs the CSF firewall (ConfigServer Security & Firewall) with its Login Failure Daemon (LFD), the firewall may be blocking genuine visitors, including you. We learned this the hard way on our own server years ago. Here’s how CSF can choke your site traffic, which settings to check, and what’s changed since ConfigServer shut down in 2025.
Quick answer: In WHM go to Plugins → ConfigServer Security & Firewall → Firewall Configuration and check CT_LIMIT (connection tracking). A low value blocks busy visitors, search engine bots and people behind shared networks. Set it to 0 (off) or around 300, check the blocked IP list, and whitelist IPs you trust. ConfigServer closed on August 31, 2025, so move to a maintained CSF fork for security updates.
Table of Contents
What are CSF and LFD?
CSF is a free firewall and security suite for Linux servers that became the standard on cPanel/WHM hosting. Its Login Failure Daemon (LFD) watches log files for repeated failed logins and blocks the offending IP addresses, a powerful defence against brute-force attacks. The catch: aggressive settings can also block legitimate visitors, and unless you read the alert emails, you might never know.
How CSF can block your site traffic
Connection tracking (CT_LIMIT)
CT_LIMIT blocks any IP address with more open connections than the limit. The default is 0 (disabled), but some hosts set it low, such as 50. Modern browsers open many connections at once, and visitors behind office, mobile or university networks can share one IP, so a low limit quickly blocks real people. CSF’s own documentation warns of false positives and suggests that “a reasonable setting for this option might be around 300”.
Other settings that cause false blocks
- LF_TRIGGER and login failure limits: users who mistype passwords for email, FTP or WordPress can be blocked.
- PORTFLOOD and SYNFLOOD: flood protection that’s too strict can block normal traffic spikes.
- Country blocking (CC_DENY): blocking whole countries can also block genuine readers and crawlers.
- LF_DISTATTACK and distributed attack rules can catch users behind large shared IPs.
How to check and fix CSF firewall blocks
- Log in to WHM and open Plugins → ConfigServer Security & Firewall.
- Click Firewall Configuration and review CT_LIMIT and the login failure settings. Save and restart CSF and LFD after changes.
- Use Search for IP to check if a visitor’s IP is blocked, and Quick Unblock to remove it.
- Add trusted IPs, such as your own office or monitoring services, with Quick Allow.
- Read LFD alert emails (subjects like “Blocked due to connection tracking”) so you notice false positives early.
From the command line, csf -g IP searches for an IP, csf -dr IP removes a block and csf -a IP allows an IP.
ConfigServer shutdown: what happens to CSF now?
ConfigServer’s developer, Way to the Web Ltd, closed on August 31, 2025, ending official development and support for CSF. The code was released under the GPLv3 licence, so CSF continues through community forks:
- cPanel‘s own CSF edition for cPanel & WHM servers, with security and compatibility fixes, delivered through cPanel’s package system.
- Aetherinox’s CSF fork, an actively developed, cross-platform continuation for Debian and RHEL-based systems.
- Other forks and alternatives such as Sentinel Firewall, or tools like Imunify360, CrowdSec, BitNinja and Fail2ban.
If your server still runs the original CSF, ask your host which fork or alternative they’re moving to, as it will no longer receive updates.
Our experience
After our site was hacked in 2010, we tightened our server security and started using CSF on our hosting (see our list of essential server security software). Later we noticed visitors occasionally couldn’t load the site, and the cause turned out to be a low CT_LIMIT blocking IPs with lots of simultaneous connections. Raising the limit fixed it immediately, while LFD kept blocking real brute-force attempts. Before changing firewall settings, keep regular backups on your hosting server in case something goes wrong.
Frequently asked questions
What is a good CT_LIMIT value in CSF?
CSF’s documentation suggests around 300 if you enable it. Many busy sites leave it at 0 (disabled) and rely on other protections like a CDN or web application firewall.
Can CSF block Googlebot?
Yes, if limits are too strict. Watch for crawl errors in Google Search Console and whitelist only verified crawler IPs if needed.
Is CSF still safe to use after the shutdown?
The original version no longer gets updates. Use a maintained fork, such as cPanel’s edition, or move to another security tool.
Get our free weekly email: new tech guides and tools, no spam.
New and updated tech guides, a free tool worth bookmarking and one useful pick, once a week. No spam, unsubscribe anytime.
One email a week. Unsubscribe anytime. See our privacy policy.
An experienced word of caution as an admin who has used CSF for a couple of years on multiple arrays… simply turn off Connection Tracking scans. Don’t use it. It’s a process hog and scans every IP connection. No just httpd connections. All email connections. Everything. Basically, connection tracking is such a bottleneck that you should avoid it at all costs unless you don’t mind killing your throughput.
If your prone to DOS attacks there are other far less resource demanding ways to resolve.
Heed Will’s solid advice and save yourself from a throttled chock point. As a five year CSF and server admin do not use connection tracking. It’s an anchor on throughput and server response times. The unintended consequences of using it are far reaching and will touch every single thing your server does to the point that you’ll spend tons (perhaps years) of time trying to improve the affects of what connection tracking will truly do to you.
Yep! Seems to work – although the Firewall had to be restarted before the changes took effect.
Thanks !
Just experienced the same problem – clients phoning/complaining about lost business because customers could not access their website.
Set to 300 now. here’s hoping !!!!!
Great Post!, I had mine set to 50 and I was getting too many blocked alerts. The worst part happened today when I saw the firewall blocking msn bots! (bing). After reading this post I raised it to 300. A great tip , thanks.
WHM ran a automatic update 2 weeks ago. We have around 150 sites on our cloud server & people started getting blocked. We had no clue of how to fix the problem. Changed the CT_LIMIT & everything is working great. Thanks for this valuable information.
I had no idea that such thing was active on the WHM settings.
I already seted mine to 300 aswell to make a test and see how my sites are affected. Hope to see some increase in traffic. Actually, any increase would be nice ^^
Thank you very much sharing this valuable information.I have knownhost VPS and I was wondering for receiving these email for a long time. After reading this article, I found that it was set to 40. at the moment, I have increased it to 300 to check the result.