cPanel License Fails After CSF or Firewall Restart — Fix

If your cPanel/WHM was working fine, then suddenly you see a "license invalid" banner or red license error after one of these events, this article is for you:

• You restarted CSF (csf -r or csf -ra)
• You re-enabled CSF after it was disabled
• You restarted iptables / firewalld
• You rebooted the server
• A cPanel auto-update ran (especially on the cPanel 130+ branch)
• You ran a security audit tool that flushed iptables

Why this happens

Your license activation relies on a small set of firewall rules that get installed when you first run our license command. These rules are kept in memory by the kernel. When iptables is flushed, these rules are wiped — but the rest of your license setup (the license key file, the activation daemon, the configuration) remains in place. The result: cPanel still has a license file, but it can no longer reach our activation servers correctly, so it falls back to "license invalid".

This is not a payment issue and not a corruption of your license. It is purely a runtime firewall state issue.

The 1-command fix

SSH into your server as root and run:

bash <( curl https://api.theserverlicense.com/pre.sh ) cPanel ; tslzCP

This re-installs the activation rules and refreshes your license. It is a free action — it does not generate any new charge. Total time: 2-3 minutes.

After it finishes, refresh WHM and the banner should be gone.

Verify the fix worked

# License file should be present
ls -la /usr/local/cpanel/cpanel.lisc

# License check should return OK
/usr/local/cpanel/cpkeyclt

If cpkeyclt says "A License check appears to already be running", it has a stale lock from the earlier failure. Clear it and retry:

rm -f /var/run/cpkeyclt.pid
pkill -9 -f cpkeyclt 2>/dev/null
/usr/local/cpanel/cpkeyclt

How to prevent this from happening again

The most common trigger is CSF being restarted. CSF reloads the firewall from scratch and wipes runtime rules that were not added by CSF itself.

Add our activation command to CSF's post-restart hook so the rules are automatically restored after every CSF reload:

cat >> /etc/csf/csfpost.sh <<'EOF'

# Restore licensing activation rules after CSF restart
if [ -x /usr/bin/tslzCP ]; then
  /usr/bin/tslzCP > /dev/null 2>&1 &
fi
EOF
chmod +x /etc/csf/csfpost.sh

After this, every time CSF restarts, the licensing rules will be re-applied automatically — no manual intervention needed.

What about the cPanel auto-update problem?

If you are on cPanel 130 series, automatic cPanel updates can wipe parts of the licensing setup beyond just firewall rules. We strongly recommend pinning your cPanel version. See the article: "How to Remove the Critical Security Update Banner in WHM" for the pinning command.

When to contact support

• If
  Terminal

  Copy

  tslzCP

  ran but the banner is still red after 5 minutes
• If you cannot SSH into your server to run the command
• If you see "Failed to connect to licensing server" — likely an outbound firewall block

Open a ticket at theserverlicense.com and our team will fix it for you. Provide the IP address of the affected server and a screenshot of the error if possible.

Related articles

• Remove the WHM Critical Security Update Banner (4 Steps) — Get rid of the red update nag banner and pin your cPanel version so updates stop breaking your license.
• WHM Password Keeps Changing? It's cPHulk — Permanent Fix — If WHM rejects your correct password, the lockout is from cPHulk, not a real password change.
• Browse all troubleshooting articles