CSF 2.3.1 - Core Shield Firewall

CSF 2.3.1 - Core Shield Firewall (stable)

Release date: 2026-11-06
Headline: Never lock out the administrator

A safety update for 2.3.0: CSF never locks out its own administrator.

• The installer allows your SSH address. Like legacy ConfigServer CSF, the IP of the
  SSH session running install.sh is added to the allow list (comment "Administrator
  (SSH session used to install CSF)"), also when the installer runs under sudo.
  Updates run from cron or the web interface have no SSH session and skip this step.
• The malware scanner never blocks a trusted uploader. An uploader on the allow list,
  in csf.ignore, or an administrator who signed in to the CSF web interface is never
  blocked; the file is still quarantined. On servers without a control panel the web
  interface shares the web server log with the websites, so an administrator signing in
  at the moment a malicious file was uploaded could be taken for its uploader and blocked.
• csf --scan-setup runs the first scan right away (files changed in the last hour)
  instead of waiting for the 5-minute schedule, so csf --selftest is green straight away.

Upgrade from the interface (Update tab) or with csf --self-update. Configuration and
lists are kept. Everything in 2.3.0 is included - see the changelog.