This guide covers how to install mod_evasive on cPanel with EasyApache 4<\/strong>. Current cPanel versions use EasyApache 4, and Before you install mod_evasive on cPanel, make sure you have:<\/p>\n\n\n\n Log in to the server via SSH, then install the module using the experimental EA4 repository:<\/p>\n\n\n\n Press Note:<\/strong> Create the configuration file:<\/p>\n\n\n\n Add the following:<\/p>\n\n\n\n This is where the original setup instructions get it wrong: Note:<\/strong> Adjust the ownership user ( Expected output:<\/p>\n\n\n\n Confirming the module loaded isn’t the same as confirming it’s actually blocking traffic. From a machine other than the server itself, send a burst of rapid requests exceeding You should see the response codes shift to The default values in Step IV are a reasonable starting point, but worth adjusting based on your actual traffic:<\/p>\n\n\n\n Installing mod_evasive on cPanel with EasyApache 4 comes down to enabling the experimental repository for the install, configuring the thresholds in Why did the module load but never block any traffic?<\/strong> The most common cause is exactly the bug covered in Step V \u2014 Will mod_evasive block legitimate traffic spikes, like a sudden surge of real visitors?<\/strong> It can, if thresholds are set too aggressively for your site’s normal traffic. Monitor your logs after enabling it and adjust Is mod_evasive a replacement for a proper firewall or WAF?<\/strong> No \u2014 it’s a useful, lightweight layer specifically for HTTP-level request-rate abuse, but it doesn’t replace broader protections like a firewall (for network-level attacks) or a WAF (for application-layer exploit attempts).<\/p>\n\n\n\n Looking to harden your cPanel server against abuse and attacks? Our team can help with server security, Apache configuration, and ongoing infrastructure support.<\/p>\n\n\n\n Connect with our technology experts.<\/a><\/p>\n\n\n\nmod_evasive<\/code> is an Apache module that helps mitigate HTTP-level DoS and brute-force attacks by tracking request rates per IP and temporarily blocking addresses that exceed configured thresholds.<\/p>\n\n\n\nmod_evasive<\/code> isn’t included by default \u2014 it’s available through cPanel’s cl-ea4-experimental<\/code> repository instead.<\/p>\n\n\n\n
\n\n\n\nImplementation<\/h2>\n\n\n\n
I. Prerequisites<\/h3>\n\n\n\n
\n
II. How mod_evasive Works<\/h3>\n\n\n\n
mod_evasive<\/code> sits at the Apache request-handling level, counting how many requests each IP makes within a configured time window. If an IP exceeds the thresholds you set (requests to the same page, requests to the site overall, or too many concurrent requests), Apache temporarily blocks that IP by returning a 403 response instead of processing further requests \u2014 without needing a separate firewall rule.<\/p>\n\n\n\nIII. Install mod_evasive<\/h3>\n\n\n\n
yum install --enablerepo=cl-ea4-experimental ea-apache24-mod_evasive.x86_64\n<\/pre>\n\n\n\n
Y<\/code> when prompted to confirm.<\/p>\n\n\n\n\n
--enablerepo<\/code> only enables the experimental repository for this single command, rather than permanently \u2014 which is the safer approach, since permanently enabling an experimental repository could pull in other unintended experimental package updates on future yum<\/code> operations.<\/p>\n<\/blockquote>\n\n\n\nIV. Configure mod_evasive<\/h3>\n\n\n\n
vi \/usr\/local\/apache\/conf\/includes\/mod_evasive.conf\n<\/pre>\n\n\n\n
<IfModule mod_evasive20.c>\n DOSHashTableSize 3097\n DOSPageCount 2\n DOSSiteCount 50\n DOSPageInterval 1\n DOSSiteInterval 1\n DOSBlockingPeriod 3600\n DOSLogDir \"\/var\/log\/mod_evasive\"\n DOSWhitelist 127.0.0.1\n<\/IfModule>\n<\/pre>\n\n\n\n
V. Create the Log Directory<\/h3>\n\n\n\n
DOSLogDir<\/code> needs to be a directory<\/strong>, not a file. mod_evasive<\/code> writes a separate lock file per blocked IP into this location \u2014 if it’s created as a plain file (for example, with touch<\/code>), the module has nowhere to write those per-IP lock files and will fail silently rather than actually blocking anything.<\/p>\n\n\n\nmkdir -p \/var\/log\/mod_evasive\nchown nobody:nobody \/var\/log\/mod_evasive\nchmod 700 \/var\/log\/mod_evasive\n<\/pre>\n\n\n\n
\n
nobody<\/code> above) to match whichever user your Apache worker processes actually run as \u2014 this can vary depending on your specific cPanel\/EasyApache configuration. If Apache can’t write to this directory, mod_evasive<\/code> won’t be able to track or block anything, even though the module itself loads correctly.<\/p>\n<\/blockquote>\n\n\n\nVI. Restart Apache<\/h3>\n\n\n\n
systemctl restart httpd\n<\/pre>\n\n\n\n
VII. Verify the Module Loaded<\/h3>\n\n\n\n
httpd -M | grep eva\n<\/pre>\n\n\n\n
evasive24_module (shared)\n<\/pre>\n\n\n\n
VIII. Test That It’s Actually Blocking<\/h3>\n\n\n\n
DOSPageCount<\/code>:<\/p>\n\n\n\nfor i in {1..10}; do curl -s -o \/dev\/null -w \"%{http_code}\\n\" http:\/\/your-domain.com\/; done\n<\/pre>\n\n\n\n403<\/code> partway through the loop once the threshold is exceeded, confirming the block is active.<\/p>\n\n\n\nIX. Tuning the Thresholds<\/h3>\n\n\n\n
\n
DOSPageCount<\/code><\/strong> \u2014 lower this for stricter protection against rapid repeated requests to the same page; raise it if legitimate users (or something like a single-page app polling an endpoint) are getting blocked unexpectedly<\/li>\n\n\n\nDOSSiteCount<\/code><\/strong> \u2014 the overall request threshold across the whole site; tune based on your site’s normal peak traffic patterns<\/li>\n\n\n\nDOSWhitelist<\/code><\/strong> \u2014 add any IPs that should never be blocked, such as your own monitoring tools or a load balancer’s IP, in addition to 127.0.0.1<\/code><\/li>\n<\/ul>\n\n\n\nX. Conclusion<\/h3>\n\n\n\n
mod_evasive.conf<\/code>, and \u2014 critically \u2014 creating DOSLogDir<\/code> as an actual directory with the correct ownership, not a file. Without that last detail, the module loads successfully but never actually blocks anything, since it has nowhere to write its per-IP tracking data.<\/p>\n\n\n\n
\n\n\n\nFrequently Asked Questions<\/h2>\n\n\n\n
DOSLogDir<\/code> created as a file instead of a directory, or created as a directory but without write permissions for the user Apache actually runs as.<\/p>\n\n\n\nDOSPageCount<\/code> and DOSSiteCount<\/code> upward if you see legitimate visitors getting blocked.<\/p>\n\n\n\n
\n\n\n\nTalk to Our Technology Experts<\/h2>\n\n\n\n
Related Articles<\/h2>\n\n\n\n