WHM/cPanel Security: The Definitive Guide to Blocking Brute Force Attacks and Configuring CSF

Protection Against Brute Force Attacks in WHM/cPanel

Brute force attacks account for 43% of intrusions on web servers according to an IBM Security report. WHM/cPanel integrates native mechanisms to mitigate them:

1. Configuring Failed Login Attempts

• Access WHM → Security Center → Login Failure Daemon
• Set "Maximum login attempts" between 3-5 before blocking
• Define block duration (e.g. 3600 seconds)

2. Enable ModSecurity and CageFS

Activate ModSecurity with OWASP rules from WHM → ModSecurity™ Tools. For CloudLinux users, CageFS isolates processes per user.

Advanced Configuration of CSF (ConfigServer Firewall)

Basic Installation

1. Run in terminal: cd /usr/src && wget https://download.configserver.com/csf.tgz
2. Unzip: tar -xzf csf.tgz && cd csf && sh install.sh

Critical Port Configuration

Port	CSF Recommendation
SSH (22)	Change to a non-standard port (e.g. 4921) and restrict IPs
WHM (2087)	Restrict to administrative IPs
WebMail (2096)	Enable only with SSL

Custom Rules in csf.conf

# Bloquear países (ej. Rusia, China)
CC_DENY = "RU,CN"

# Protección Syn Flood
SYNFLOOD = "1"
SYNFLOOD_RATE = "100/s"

SSL Certificate Automation

In WHM → SSL/TLS → AutoSSL enable automatic renewal. For greater security, use EV certificates with extended validation.

Frequently Asked Questions (FAQs)

How can I see failed access attempts?

Check /var/log/secure for SSH and /usr/local/cpanel/logs/login_log for WHM.

Does CSF affect server performance?

When configured correctly, the impact is minimal. Monitor with csf -t after making changes.

Alternatives to CSF?

FirewallD and APF+BFD are options, but CSF is optimized for cPanel.