Install Mod evasive module on cPanel(Easy Apache 4 )

Introduction

This guide covers how to install mod_evasive on cPanel with EasyApache 4. mod_evasive is an Apache module that helps mitigate HTTP-level DoS and brute-force attacks by tracking request rates per IP and temporarily blocking addresses that exceed configured thresholds.

Current cPanel versions use EasyApache 4, and mod_evasive isn’t included by default — it’s available through cPanel’s cl-ea4-experimental repository instead.

---

Implementation

I. Prerequisites

Before you install mod_evasive on cPanel, make sure you have:

• A cPanel/WHM server running EasyApache 4
• SSH access with root privileges
• WHM access, for verifying the change afterward

II. How mod_evasive Works

mod_evasive sits at the Apache request-handling level, counting how many requests each IP makes within a configured time window. If an IP exceeds the thresholds you set (requests to the same page, requests to the site overall, or too many concurrent requests), Apache temporarily blocks that IP by returning a 403 response instead of processing further requests — without needing a separate firewall rule.

III. Install mod_evasive

Log in to the server via SSH, then install the module using the experimental EA4 repository:

yum install --enablerepo=cl-ea4-experimental ea-apache24-mod_evasive.x86_64

Press Y when prompted to confirm.

Note: --enablerepo only enables the experimental repository for this single command, rather than permanently — which is the safer approach, since permanently enabling an experimental repository could pull in other unintended experimental package updates on future yum operations.

IV. Configure mod_evasive

Create the configuration file:

vi /usr/local/apache/conf/includes/mod_evasive.conf

Add the following:

<IfModule mod_evasive20.c>
    DOSHashTableSize    3097
    DOSPageCount        2
    DOSSiteCount        50
    DOSPageInterval     1
    DOSSiteInterval     1
    DOSBlockingPeriod   3600
    DOSLogDir           "/var/log/mod_evasive"
    DOSWhitelist        127.0.0.1
</IfModule>

V. Create the Log Directory

This is where the original setup instructions get it wrong: DOSLogDir needs to be a directory, not a file. mod_evasive writes a separate lock file per blocked IP into this location — if it’s created as a plain file (for example, with touch), the module has nowhere to write those per-IP lock files and will fail silently rather than actually blocking anything.

mkdir -p /var/log/mod_evasive
chown nobody:nobody /var/log/mod_evasive
chmod 700 /var/log/mod_evasive

Note: Adjust the ownership user (nobody above) to match whichever user your Apache worker processes actually run as — this can vary depending on your specific cPanel/EasyApache configuration. If Apache can’t write to this directory, mod_evasive won’t be able to track or block anything, even though the module itself loads correctly.

VI. Restart Apache

systemctl restart httpd

VII. Verify the Module Loaded

httpd -M | grep eva

Expected output:

evasive24_module (shared)

VIII. Test That It’s Actually Blocking

Confirming the module loaded isn’t the same as confirming it’s actually blocking traffic. From a machine other than the server itself, send a burst of rapid requests exceeding DOSPageCount:

for i in {1..10}; do curl -s -o /dev/null -w "%{http_code}\n" http://your-domain.com/; done

You should see the response codes shift to 403 partway through the loop once the threshold is exceeded, confirming the block is active.

IX. Tuning the Thresholds

The default values in Step IV are a reasonable starting point, but worth adjusting based on your actual traffic:

• DOSPageCount — lower this for stricter protection against rapid repeated requests to the same page; raise it if legitimate users (or something like a single-page app polling an endpoint) are getting blocked unexpectedly
• DOSSiteCount — the overall request threshold across the whole site; tune based on your site’s normal peak traffic patterns
• DOSWhitelist — add any IPs that should never be blocked, such as your own monitoring tools or a load balancer’s IP, in addition to 127.0.0.1

X. Conclusion

Installing mod_evasive on cPanel with EasyApache 4 comes down to enabling the experimental repository for the install, configuring the thresholds in mod_evasive.conf, and — critically — creating DOSLogDir as an actual directory with the correct ownership, not a file. Without that last detail, the module loads successfully but never actually blocks anything, since it has nowhere to write its per-IP tracking data.

---

Frequently Asked Questions

Why did the module load but never block any traffic? The most common cause is exactly the bug covered in Step V — DOSLogDir created as a file instead of a directory, or created as a directory but without write permissions for the user Apache actually runs as.

Will mod_evasive block legitimate traffic spikes, like a sudden surge of real visitors? It can, if thresholds are set too aggressively for your site’s normal traffic. Monitor your logs after enabling it and adjust DOSPageCount and DOSSiteCount upward if you see legitimate visitors getting blocked.

Is mod_evasive a replacement for a proper firewall or WAF? No — it’s a useful, lightweight layer specifically for HTTP-level request-rate abuse, but it doesn’t replace broader protections like a firewall (for network-level attacks) or a WAF (for application-layer exploit attempts).

---

Talk to Our Technology Experts

Looking to harden your cPanel server against abuse and attacks? Our team can help with server security, Apache configuration, and ongoing infrastructure support.

Connect with our technology experts.

Related Articles

• Block WordPress Login Attacks on CSF