Managing server security is crucial, and one of the most essential tools used for this purpose in cPanel is the Login Failure Daemon (LFD). LFD in cpanel is a process that works as part of ConfigServer Security & Firewall (CSF), which is a popular firewall application used on cPanel servers. Its primary function is to detect and prevent unauthorized login attempts by monitoring various logs for suspicious activity.
In this blog post, we will guide you through the process of starting, stopping, and restarting LFD in cPanel. Understanding how to manage LFD ensures that your server remains secure and that it functions correctly. We’ll also cover the importance of LFD in maintaining security and how to troubleshoot common issues related to LFD management.
Table of Contents
Why Managing LFD is Important

LFD plays a vital role in securing your server. Here’s why:
- Prevents brute-force attacks: LFD continuously monitors login attempts and bans IP addresses that show multiple failed attempts.
- Server load protection: It can automatically detect and stop processes that overload the server.
- Real-time alerts: You receive real-time email alerts when there is any suspicious activity, helping you react quickly.
If LFD is not working correctly, your server might be vulnerable to attacks. Therefore, knowing how to start, stop, and restart LFD is crucial for ensuring the smooth and secure operation of your server.
Prerequisites
Before we dive into the steps for starting, stopping, or restarting LFD, ensure you have:
- Root access: You’ll need root access to the server to control the LFD service.
- Installed CSF and LFD: CSF and LFD should already be installed on your server.
Managing LFD in cPanel/WHM Interface
In addition to managing LFD via SSH, you can control it through the Web Host Manager interface. This method is more user-friendly, especially if you’re not comfortable using SSH.
Step 1: Log into WHM
Use your root credentials to log into WHM. The typical URL for WHM is:

https://your-server-ip:2087
Step 2: Navigate to the CSF/LFD Plugin
In the WHM sidebar, search for “ConfigServer Security & Firewall” and click on it. This will open the CSF/LFD configuration page.

Step 3: Start, Stop, or Restart LFD
At the top of the CSF/LFD interface, you’ll see options to start, stop, or restart LFD.
- To start LFD, click the “Firewall Enable” button.

- To stop LFD, click the “Firewall Disable” button.

- To restart LFD, click the “Firewall Restart” button.

These actions will immediately affect the LFD service.
Conclusion
LFD is a critical component for securing your cPanel server, helping to block malicious login attempts and sending you real-time alerts. By understanding how to start, stop, and restart LFD, you can ensure your server is running smoothly and securely. Managing LFD via both SSH and WHM gives you flexibility and control over your server’s security settings.
By following the steps outlined in this guide, you can effectively manage LFD, troubleshoot common issues, and keep your server safe from external threats.