{"id":18144,"date":"2011-04-13T21:00:31","date_gmt":"2011-04-13T15:30:31","guid":{"rendered":"https:\/\/www.quickonlinetips.com\/archives\/?p=18144"},"modified":"2026-10-13T13:39:33","modified_gmt":"2026-10-13T08:09:33","slug":"configserver-security-firewall-csf-lfd-choking-site-traffic","status":"publish","type":"post","link":"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/","title":{"rendered":"Is CSF Firewall Blocking Your Site Traffic? Fix CT_LIMIT and More (2026)"},"content":{"rendered":"<p>Is your CSF firewall blocking real visitors? Are they suddenly unable to reach your website, while your server looks fine? If your host runs the <strong>CSF firewall (ConfigServer Security &amp; Firewall)<\/strong> with its Login Failure Daemon (LFD), the firewall may be blocking genuine visitors, including you. We learned this the hard way on our own server years ago. Here&#8217;s how CSF can choke your site traffic, which settings to check, and what&#8217;s changed since ConfigServer shut down in 2025.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-63355\" src=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/csf-firewall-blocking-traffic.webp\" alt=\"CSF firewall blocking site traffic\" width=\"1200\" height=\"630\" srcset=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/csf-firewall-blocking-traffic.webp 1200w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/csf-firewall-blocking-traffic-300x158.webp 300w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/csf-firewall-blocking-traffic-1024x538.webp 1024w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/csf-firewall-blocking-traffic-150x79.webp 150w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/csf-firewall-blocking-traffic-768x403.webp 768w\" sizes=\"(max-width: 1200px) 100vw, 1200px\" \/><\/p>\n<p><strong>Quick answer:<\/strong> In WHM go to <strong>Plugins \u2192 ConfigServer Security &amp; Firewall \u2192 Firewall Configuration<\/strong> and check <strong>CT_LIMIT<\/strong> (connection tracking). A low value blocks busy visitors, search engine bots and people behind shared networks. Set it to 0 (off) or around 300, check the blocked IP list, and whitelist IPs you trust. ConfigServer closed on August 31, 2025, so move to a maintained CSF fork for security updates.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6ad3ed4336b91\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"ez-toc-cssicon\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #1a202c;color:#1a202c\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #1a202c;color:#1a202c\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6ad3ed4336b91\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/#What_are_CSF_and_LFD\" >What are CSF and LFD?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/#How_CSF_can_block_your_site_traffic\" >How CSF can block your site traffic<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/#Connection_tracking_CT_LIMIT\" >Connection tracking (CT_LIMIT)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/#Other_settings_that_cause_false_blocks\" >Other settings that cause false blocks<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/#How_to_check_and_fix_CSF_firewall_blocks\" >How to check and fix CSF firewall blocks<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/#ConfigServer_shutdown_what_happens_to_CSF_now\" >ConfigServer shutdown: what happens to CSF now?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/#Our_experience\" >Our experience<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/#Frequently_asked_questions\" >Frequently asked questions<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/#What_is_a_good_CT_LIMIT_value_in_CSF\" >What is a good CT_LIMIT value in CSF?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/#Can_CSF_block_Googlebot\" >Can CSF block Googlebot?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/04\/configserver-security-firewall-csf-lfd-choking-site-traffic\/#Is_CSF_still_safe_to_use_after_the_shutdown\" >Is CSF still safe to use after the shutdown?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"What_are_CSF_and_LFD\"><\/span>What are CSF and LFD?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>CSF is a free firewall and security suite for Linux servers that became the standard on cPanel\/WHM hosting. Its <strong>Login Failure Daemon (LFD)<\/strong> watches log files for repeated failed logins and blocks the offending IP addresses, a powerful defence against brute-force attacks. The catch: aggressive settings can also block legitimate visitors, and unless you read the alert emails, you might never know.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_CSF_can_block_your_site_traffic\"><\/span>How CSF can block your site traffic<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"Connection_tracking_CT_LIMIT\"><\/span>Connection tracking (CT_LIMIT)<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>CT_LIMIT blocks any IP address with more open connections than the limit. The default is 0 (disabled), but some hosts set it low, such as 50. Modern browsers open many connections at once, and visitors behind office, mobile or university networks can share one IP, so a low limit quickly blocks real people. CSF&#8217;s own documentation warns of false positives and suggests that &#8220;a reasonable setting for this option might be around 300&#8221;.<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-full wp-image-18145\" title=\"ct-limit\" src=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/ct-limit.png\" alt=\"CSF CT_LIMIT setting\" width=\"302\" height=\"48\" border=\"1\" srcset=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/ct-limit.png 302w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/ct-limit-300x47.png 300w\" sizes=\"(max-width: 302px) 100vw, 302px\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"Other_settings_that_cause_false_blocks\"><\/span>Other settings that cause false blocks<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li><strong>LF_TRIGGER and login failure limits:<\/strong> users who mistype passwords for email, FTP or WordPress can be blocked.<\/li>\n<li><strong>PORTFLOOD and SYNFLOOD:<\/strong> flood protection that&#8217;s too strict can block normal traffic spikes.<\/li>\n<li><strong>Country blocking (CC_DENY):<\/strong> blocking whole countries can also block genuine readers and crawlers.<\/li>\n<li><strong>LF_DISTATTACK and distributed attack rules<\/strong> can catch users behind large shared IPs.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"How_to_check_and_fix_CSF_firewall_blocks\"><\/span>How to check and fix CSF firewall blocks<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ol>\n<li>Log in to WHM and open <strong>Plugins \u2192 ConfigServer Security &amp; Firewall<\/strong>.<\/li>\n<li>Click <strong>Firewall Configuration<\/strong> and review CT_LIMIT and the login failure settings. Save and restart CSF and LFD after changes.<\/li>\n<li>Use <strong>Search for IP<\/strong> to check if a visitor&#8217;s IP is blocked, and <strong>Quick Unblock<\/strong> to remove it.<\/li>\n<li>Add trusted IPs, such as your own office or monitoring services, with <strong>Quick Allow<\/strong>.<\/li>\n<li>Read LFD alert emails (subjects like &#8220;Blocked due to connection tracking&#8221;) so you notice false positives early.<\/li>\n<\/ol>\n<p><img decoding=\"async\" class=\"alignnone size-full wp-image-18146\" title=\"csf-config\" src=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/csf-config.png\" alt=\"CSF firewall configuration in WHM\" width=\"486\" height=\"79\" border=\"1\" srcset=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/csf-config.png 486w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/csf-config-150x24.png 150w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/csf-config-300x48.png 300w\" sizes=\"(max-width: 486px) 100vw, 486px\" \/><\/p>\n<p>From the command line, <code>csf -g IP<\/code> searches for an IP, <code>csf -dr IP<\/code> removes a block and <code>csf -a IP<\/code> allows an IP.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"ConfigServer_shutdown_what_happens_to_CSF_now\"><\/span>ConfigServer shutdown: what happens to CSF now?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>ConfigServer&#8217;s developer, Way to the Web Ltd, closed on August 31, 2025, ending official development and support for CSF. The code was released under the GPLv3 licence, so CSF continues through community forks:<\/p>\n<ul>\n<li><strong><a href=\"https:\/\/docs.cpanel.net\/\" target=\"_blank\" rel=\"noopener\">cPanel<\/a>&#8216;s own CSF edition<\/strong> for cPanel &amp; WHM servers, with security and compatibility fixes, delivered through cPanel&#8217;s package system.<\/li>\n<li><strong><a href=\"https:\/\/github.com\/Aetherinox\/csf-firewall\" target=\"_blank\" rel=\"noopener\">Aetherinox\u2019s CSF fork<\/a><\/strong>, an actively developed, cross-platform continuation for Debian and RHEL-based systems.<\/li>\n<li><strong>Other forks and alternatives<\/strong> such as Sentinel Firewall, or tools like <a href=\"https:\/\/www.imunify360.com\/\" target=\"_blank\" rel=\"noopener\">Imunify360<\/a>, <a href=\"https:\/\/www.crowdsec.net\/\" target=\"_blank\" rel=\"noopener\">CrowdSec<\/a>, <a href=\"https:\/\/bitninja.com\/\" target=\"_blank\" rel=\"noopener\">BitNinja<\/a> and <a href=\"https:\/\/github.com\/fail2ban\/fail2ban\" target=\"_blank\" rel=\"noopener\">Fail2ban<\/a>.<\/li>\n<\/ul>\n<p>If your server still runs the original CSF, ask your host which fork or alternative they&#8217;re moving to, as it will no longer receive updates.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Our_experience\"><\/span>Our experience<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>After our site was hacked in 2010, we tightened our server security and started using CSF on our hosting (see our list of <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2015\/02\/essential-server-security-software\/\">essential server security software<\/a>). Later we noticed visitors occasionally couldn&#8217;t load the site, and the cause turned out to be a low CT_LIMIT blocking IPs with lots of simultaneous connections. Raising the limit fixed it immediately, while LFD kept blocking real brute-force attempts. Before changing firewall settings, keep regular <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2015\/02\/backup-websites-on-hosting-server\/\">backups on your hosting server<\/a> in case something goes wrong.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Frequently_asked_questions\"><\/span>Frequently asked questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"What_is_a_good_CT_LIMIT_value_in_CSF\"><\/span>What is a good CT_LIMIT value in CSF?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>CSF&#8217;s documentation suggests around 300 if you enable it. Many busy sites leave it at 0 (disabled) and rely on other protections like a CDN or web application firewall.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Can_CSF_block_Googlebot\"><\/span>Can CSF block Googlebot?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes, if limits are too strict. Watch for crawl errors in Google Search Console and whitelist only verified crawler IPs if needed.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Is_CSF_still_safe_to_use_after_the_shutdown\"><\/span>Is CSF still safe to use after the shutdown?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The original version no longer gets updates. Use a maintained fork, such as cPanel&#8217;s edition, or move to another security tool.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Is your CSF firewall blocking real visitors? Are they suddenly unable to reach your website, while your server looks fine?&#8230;<\/p>\n","protected":false},"author":4,"featured_media":63355,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"default","_kad_post_title":"default","_kad_post_layout":"default","_kad_post_sidebar_id":"","_kad_post_content_style":"default","_kad_post_vertical_padding":"default","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[25],"tags":[49],"class_list":["post-18144","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-domain-hosting","tag-tutorials"],"_links":{"self":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/18144","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/comments?post=18144"}],"version-history":[{"count":4,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/18144\/revisions"}],"predecessor-version":[{"id":65393,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/18144\/revisions\/65393"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media\/63355"}],"wp:attachment":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media?parent=18144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/categories?post=18144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/tags?post=18144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}