Install CrowdSec on Ubuntu Server (LiteSpeed, Apache or Nginx)

For CyberPanel:

#Generated acquisition file - custom (service: CyberPanel) / files : /home/*/logs/*.log, *.error_log, *.access_log
filenames:
  - /home/*/logs/*.log
  - /home/*/logs/*.error_log
  - /home/*/logs/*.access_log
labels:
  type: litespeed
---

Once the changes have been saved, reload CrowdSec so that it picks up the new files:

sudo systemctl reload crowdsec

You can check that the logs are being processed with:

sudo cscli metrics

In the “Parser Metrics” section, you should see the crowdsecurity/litespeed-logs or child-crowdsecurity/litespeed-logs parser.

Install the CrowdSec firewall bouncer

The firewall bouncer is the component that applies CrowdSec decisions directly at network level. It blocks IP addresses deemed malicious in real time.

Depending on your Linux kernel version, Ubuntu may use:

• iptables: traditional system, still common on Ubuntu 20.04/22.04.
• nftables: a more modern system, native to recent kernels.

To check which one you are using:

sudo iptables -V

If the version displays nf_tables, you are using nftables.

Next, install the matching bouncer for iptables:

sudo apt install crowdsec-firewall-bouncer-iptables -y

For nftables:

sudo apt install crowdsec-firewall-bouncer-nftables -y

Once the bouncer is installed, enable its service:

sudo systemctl enable --now crowdsec-firewall-bouncer

Generate the bouncer API key

CrowdSec uses API keys to secure communication between the detection engine and its bouncers. Create a key dedicated to the firewall bouncer:

sudo cscli bouncers add crowdsec-firewall

The system will provide a unique key (copy it carefully). It will be stored in:
/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml

Enable the recommended scenarios for WordPress

To protect sensitive areas such as wp-login.php or xmlrpc.php, CrowdSec provides dedicated scenarios:

sudo cscli collections install crowdsecurity/wordpress
sudo cscli scenarios install crowdsecurity/http-bf-wordpress_bf
sudo cscli scenarios install crowdsecurity/http-bf-wordpress_bf_xmlrpc

You should also install the modsecurity scenario if you use a ModSecurity WAF with OpenLiteSpeed:

cscli scenarios install crowdsecurity/modsecurity

Here is a selection of scenarios for blocking common attacks (brute force, scans, malicious crawlers, injections and more):

sudo cscli scenarios install crowdsecurity/ssh-bf
sudo cscli scenarios install crowdsecurity/http-probing
sudo cscli scenarios install crowdsecurity/http-sqli-probing
sudo cscli scenarios install crowdsecurity/http-xss-probing
sudo cscli scenarios install crowdsecurity/http-path-traversal-probing
sudo cscli scenarios install crowdsecurity/http-bad-user-agent
sudo cscli scenarios install crowdsecurity/http-sensitive-files
sudo cscli scenarios install crowdsecurity/http-crawl-non_statics

After each scenario addition or change, restart CrowdSec cleanly:

sudo systemctl reload crowdsec

You can then check that they are enabled with:

sudo cscli scenarios list

Connect to CrowdSec Central (online portal)

Once your server is protected by CrowdSec, you can centralise security-incident monitoring through the CrowdSec Console web portal. This online dashboard lets you view detected attacks, decisions made by your bouncers and the health of your agents in real time.

Start by creating an account at https://app.crowdsec.net

Once registered, sign in to the dashboard to generate an enrolment key.

Link the local agent to your account

On the Ubuntu server where CrowdSec is installed, run the following command and replace <provided-key> with the generated enrolment key:

A confirmation will appear in the terminal. Then return to app.crowdsec.net to approve the new agent pairing. This links the local CrowdSec agent to your personal dashboard.

Once the link is complete, your server will appear in the Console interface. You will then have access to:

• A detailed history of detected attacks
• The decisions applied (bans, alerts…)
• Statistics on banned IPs or IPs shared in the community database

CrowdSec Console becomes a true network security control centre, even when you manage several machines.

Check that the bouncer is connected to CrowdSec

Once your bouncer is installed (firewall, proxy and so on), check that the connection between the CrowdSec engine and the bouncer works correctly. This ensures that decisions (bans, challenges and so on) are transmitted and applied properly.

Run the following command:

sudo cscli bouncers list

Expected output:

NAME                 IP          VALID  LAST API PULL
crowdsec-firewall    127.0.0.1   ✔️     2s ago

With a properly connected bouncer, your server applies CrowdSec security decisions in real time, whether they come from the local system or the community network.

Best practices and additional security

For lasting and responsive protection, a CrowdSec installation should not be left unchanged. Here are some long-term best practices to secure your WordPress server and keep your defence system working properly.

Keep the CrowdSec hub up to date

Detection scenarios evolve regularly to follow new threats. To stay up to date, run the following command periodically:

sudo cscli hub update && \
sudo cscli scenarios upgrade --all && \
sudo cscli parsers upgrade --all && \
sudo cscli postoverflows upgrade --all && \
sudo cscli collections upgrade --all && \
sudo systemctl reload crowdsec

This retrieves the latest definitions for scenarios, parsers, enrichments and collections, then reloads CrowdSec cleanly.

Add trusted IPs to the whitelist

If some IP addresses must be completely exempt from blocking (internal servers, load balancers, a personal static IP and so on), add them manually to:

nano /etc/crowdsec/whitelists.yaml

This file can filter by address, subnet or User-Agent and prevents false positives for trusted sources.

Do not modify the original .yaml files

CrowdSec updates its files automatically during upgrades. To preserve your customisations, never modify files such as crowdsec-firewall-bouncer.yaml directly. Use .local variants instead, for example:

/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml.local

This lets you override selected options without breaking future updates.

Monitor logs regularly

Remember to check:

/var/log/crowdsec.log
/var/log/crowdsec-firewall-bouncer.log

And the output of:

sudo cscli metrics

This will help you quickly spot parsing errors or ineffective scenarios.