ConfigServer has confirmed that CSF (ConfigServer Security & Firewall) — the firewall and login-failure detection tool that has protected a huge share of cPanel and WHM servers for close to two decades — will stop receiving updates, downloads, and support after August 31, 2025. ConfigServer has said they may release CSF as open source under GPLv3 before shutting down, but for a piece of security software sitting on the edge of your server, "maybe open source, no more updates" isn't a maintenance plan.
What this actually means for you
- No more security patches. Any vulnerability found in CSF or its LFD daemon from this point forward goes unfixed.
- No more compatibility updates. CSF wraps iptables — as distributions keep moving to nftables-first defaults and kernels evolve, that gap only widens.
- No support. If something breaks — a false-positive lockout, a rule conflict after a distro upgrade — you're troubleshooting alone.
The direct replacement: Grenzer
Grenzer was built as what a CSF replacement should look like in 2026: nftables-native (not a wrapper around iptables), written in Go (not Perl), and actively maintained. It does the same core job CSF did — firewall management and Login Failure Detection — free, forever, no license required.
An optional Pro tier adds what CSF never had: AI-augmented detection that reviews ambiguous activity asynchronously, an MCP server so AI assistants like Claude can work with your server's security data directly, multi-tenant-aware encrypted backup, and a cPanel/WHM plugin for hosting companies managing client servers.
See the full comparison against other CSF alternatives if you're evaluating more than one option.
Migrating from CSF to Grenzer
- Note your current CSF configuration. Your allow/deny lists and key settings are worth keeping:
cat /etc/csf/csf.allow /etc/csf/csf.deny - Uninstall CSF:
sh /etc/csf/uninstall.sh - Install Grenzer:
curl -fsSL https://raw.githubusercontent.com/Dpro-at/grenzer-releases/main/scripts/install.sh | bash - Re-add your trusted IPs:
grenzer allow <ip>(or edit/etc/grenzer/grenzer.allowdirectly) - Re-add any country blocks:
grenzer country block <ISO codes> - Verify it's running:
grenzer status
Grenzer's config supports a testing mode with auto-recovery for the first run — worth enabling while you confirm your rules didn't lock out anything unexpected, the same way CSF's testing = 1 worked.
Frequently asked questions
Is Grenzer really free?
Yes. The firewall and Login Failure Detection core — the daily-driver protection every server needs — is free forever, with no license or credit card required. An optional Pro tier adds AI detection, MCP integration, multi-tenant backup, and cPanel/WHM integration.
Do I need to migrate off CSF immediately?
CSF isn't disabled yet, but ConfigServer has confirmed no further updates, downloads, or support after August 31, 2025. The earlier you migrate, the less time your server spends running unmaintained security software.
What operating systems does Grenzer support?
Ubuntu, Debian, CentOS, RHEL, AlmaLinux, and Rocky Linux — the same range of distributions CSF supported.
Can I run Grenzer and CSF at the same time?
No. Grenzer manages nftables rules directly, which conflicts with CSF's iptables-based rules. Uninstall CSF before installing Grenzer.