CrowdSec vs Imunify360 vs BitNinja: choosing a post-CSF security stack for shared hosting

CSF did one thing well: it turned log lines into firewall rules. The products that replace it on shared hosting all do that, and then diverge sharply on what else they take on. CrowdSec is a community-driven behaviour engine, Imunify360 is a full endpoint suite tied closely to CloudLinux and cPanel, and BitNinja is a managed service that sits somewhere between. This guide compares them on the questions that matter to a hosting provider, not on feature counts.

Short answer: Choose Imunify360 for cPanel servers hosting customer WordPress sites you do not control, because its maintained WAF and malware cleanup remove the most work. Choose CrowdSec when the team is comfortable with nftables and YAML and the servers run applications you patch yourself; it is free but you own the parsers and pair it with a separate scanner. BitNinja fits a mixed cPanel, DirectAdmin and bare-Linux fleet that wants one console. Whatever you pick, never run two firewall engines at once.

What each product actually is

CrowdSec is open source. An agent parses logs (SSH, web server, mail, panel) against scenario files, decides when a source is misbehaving, and hands the decision to a “bouncer” that enforces it, typically a firewall bouncer that writes nftables sets. Decisions are shared with a central network, so an address attacking other members can be pre-blocked on yours. The agent and bouncers are free; paid tiers add a console, longer retention and premium blocklists.

Imunify360 is CloudLinux’s commercial suite: a firewall with reputation-based blocking, a ModSecurity-based WAF with vendor rules, proactive PHP defence, a malware scanner and cleaner (the ImunifyAV component), and, since 2026, WAF-for-WordPress enabled by default, a Layer 7 rate limiter and an Under Attack Mode for web shielding. It is priced per server by account count and integrates directly into WHM, DirectAdmin and Plesk. CloudLinux published a ConfigServer-to-Imunify360 migration tool in September 2025 precisely to catch CSF users.

BitNinja is a per-server subscription with a central dashboard. It combines a reputation-driven firewall, honeypots, a WAF, malware detection and outbound spam checks, and leans on its own IP-reputation network. It supports cPanel, DirectAdmin, Plesk and bare Linux and is pitched at providers who want one console across a mixed fleet.

Brute-force and reputation blocking

All three replace LFD here. CrowdSec’s edge is the shared decision network and the flexibility of writing your own scenarios; a scenario for a custom login form is a short YAML file. Imunify360’s edge is that its reputation data comes from a very large installed base of shared-hosting servers, so the blocklist is tuned to exactly the traffic you see. BitNinja’s honeypots give it early signal on scanners that have not yet touched a real service.

Where CrowdSec needs care is coverage. Out of the box it ships collections for sshd, nginx, Apache, Postfix, Dovecot and others, but cPanel login, Exim and DirectAdmin need community or self-written parsers. Budget an afternoon per panel to get parity with what LFD covered.

Web application protection

This is where the products stop being comparable. CrowdSec has an AppSec component and can run OWASP CRS-style rules, but it is young and you are assembling it yourself. Imunify360’s WAF is the reason most cPanel providers buy it: the rules are maintained daily, the July 2026 emergency rules for the WordPress wp2shell RCE reached servers before most admins had read the advisory, and the WordPress-specific WAF is now on by default. BitNinja’s WAF is capable and centrally managed, but rule tuning is less granular than Imunify360’s per-domain controls.

If your servers host customer WordPress sites you do not control, weight this heavily. If your servers host applications your own team writes and patches, CrowdSec plus a maintained CRS deployment is enough.

Malware scanning and cleanup

Imunify360 includes scanning and automated cleanup, with the lighter ImunifyAV+ tier available separately since August 2026 for servers that only need the scanner. BitNinja scans and quarantines. CrowdSec does not scan files at all; you pair it with maldet, ClamAV or ImunifyAV as described in our malware scanning guide.

Operational load and cost

CrowdSec is cheapest and demands the most engineering: you own the parsers, the bouncer placement and the upgrade cadence, but nothing in it is a black box. Imunify360 costs the most per server at the full tier and asks the least of your team; it also assumes you are comfortable with an agent that pushes rules and PHP hooks onto a production box on its own schedule. BitNinja sits in the middle on both axes.

A useful way to decide: count the hours your team spent on CSF tuning and malware cleanup last quarter. If that number is high and the servers are cPanel, Imunify360 pays for itself. If it is low and the team already runs nftables and YAML comfortably, CrowdSec keeps the money.

Mixing products

Do not run two firewall engines. Imunify360 and BitNinja both expect to own the firewall and will conflict with CrowdSec’s bouncer and with each other. CrowdSec is happy to feed decisions into firewalld, as set up in our firewalld and fail2ban tutorial, which is the cleanest home for it on a panel-free server.

Quick sanity checks after deployment

Whichever you choose, prove it blocks. For CrowdSec:

cscli metrics
cscli decisions list
cscli bouncers list

For Imunify360:

imunify360-agent rstatus
imunify360-agent list blocked-ports
imunify360-agent config show | grep -A3 FIREWALL

For BitNinja, bitninjacli --status reports which modules are active. In every case, trigger a handful of failed SSH logins from a test address and confirm the address appears in the product’s decision list and that the connection is refused afterwards.

A common pitfall after leaving CSF is leaving csf.allow behind in a drawer. Every product above has an allow list; migrate your monitoring, backup and office addresses into it on day one, before the first false positive locks out your own backup job. Our server security audit script reports which firewall engine is active so a mixed fleet stays visible.

CrowdSec vs Imunify360 at a glance

Official documentation: Imunify360 documentation, cPanel & WHM documentation, AlmaLinux wiki.

Related guides: CSF after ConfigServer: which fork should you run in 2026 (cPanel, DirectAdmin, Aetherinox, Sentinel)? · CVE-2026-65638, 65639 and 67402 explained: patching the CSF Messenger and URLGET remote-code flaws · KernelCare on cPanel and DirectAdmin servers: setup, verification and rollback.

Frequently asked questions