Basic DDoS Protection for a cPanel/WHM Server Using CSF

Minh — Tue, 20 Oct 2026 06:37:10 +0000

Running a hosting server means sooner or later you will see a flood of requests. You don't need expensive hardware to survive small and medium attacks. A well-tuned firewall goes a long way. This guide covers a practical CSF (ConfigServer Security & Firewall) setup on a cPanel/WHM server.

1. Find out who is hitting you

Before changing anything, check the current connections per IP:

ss -ntu | awk 'NR>1{print $6}' | sed 's/:[0-9]*$//' | sort | uniq -c | sort -nr | head -20

If a single IP holds hundreds of connections, that's your suspect.

2. Tune CSF in `/etc/csf/csf.conf`

# Limit total connections per IP and block abusers temporarily
CT_LIMIT = "150"
CT_INTERVAL = "30"
CT_BLOCK_TIME = "1800"
CT_PORTS = "80,443"

# Limit simultaneous connections per port
CONNLIMIT = "80;50,443;50"

# Rate-limit new connections per port (port;proto;hits;seconds)
PORTFLOOD = "80;tcp;100;5,443;tcp;100;5"

# SYN flood protection
SYNFLOOD = "1"
SYNFLOOD_RATE = "100/s"
SYNFLOOD_BURST = "150"

Apply the changes:

csf -r

Start with conservative values and watch for false positives (shared NAT, offices, CDNs). Then tighten gradually.

3. Let LFD handle repeated offenders

Make sure lfd is running, because it is what enforces CT_LIMIT:

systemctl status lfd
tail -f /var/log/lfd.log

You can also permanently block an IP manually:

csf -d 203.0.113.50 "DDoS source"

4. Put a proxy in front when attacks get bigger

A firewall on the origin server can't absorb volumetric attacks that saturate your bandwidth. For that, use:

Cloudflare (free tier works well for HTTP floods). After enabling it, restrict ports 80/443 to Cloudflare IP ranges only.
An upstream anti-DDoS provider that filters traffic before it reaches your server.

5. Quick checklist

[ ] CSF + LFD running and updated
[ ] CT_LIMIT, CONNLIMIT, PORTFLOOD, SYNFLOOD configured
[ ] Origin IP hidden behind a proxy/CDN
[ ] Regular backups (an attack is not the only way to lose data)
[ ] Monitoring/alerts for abnormal connection counts

Conclusion

CSF won't stop a large volumetric attack alone, but combined with sensible limits and a CDN, it handles most everyday abuse on shared and VPS hosting.

I run DichVuCheap, a small hosting/VPS/domain service in Vietnam, and these are the settings I use day to day. Questions or improvements are welcome in the comments.

DEV Community: Minh