Server-Side Malware Protection with Imunify360: What It Does and How to Use It

Imunify360 is a security suite from CloudLinux for Linux web servers, commonly used on cPanel servers, that combines several layers in one product: a firewall with IP reputation, a web application firewall (WAF) built on ModSecurity rules, a malware scanner that can clean infected files, Proactive Defense that watches PHP scripts as they run, website reputation monitoring and rebootless kernel patching with KernelCare. Installing it is the easy part; the value comes from choosing the right modes and reviewing what it finds. This guide explains each component in plain terms, based on CloudLinux's documentation, and gives a routine you can follow every week.

What Imunify360 includes

CloudLinux's documentation describes these main components:

Component	What it does
Firewall and IP lists	Blocks attacks such as brute force and denial of service, using cloud heuristics, plus Black, White and Gray lists you can manage
Intrusion detection and WAF	A collection of "deny" rules (ModSecurity-based) that block known web attacks such as exploit attempts and CMS brute force
Malware Scanner	Scans files for malware, including real-time scanning of modified files, and cleans infected files
Proactive Defense	A PHP module that can stop malicious behavior from PHP scripts as it happens
WebShield	Includes an "Under Attack Mode" that puts a domain behind a JavaScript challenge during an attack
Reputation Management	Checks whether your websites or IPs appear on blocklists and notifies you
KernelCare	Applies Linux kernel security patches without a reboot

Not every license tier or server includes every feature, so check what your installation shows under the Imunify360 menu in WHM.

How blocking works: Gray List, Black List and the Anti-bot challenge

When an IP address breaks Imunify360's rules, for example by repeatedly entering wrong passwords, Imunify360 adds it to the Gray List. A grayed visitor who opens your website sees an Anti-bot challenge; if they pass it, they are removed from the Gray List. Repeat offenders return to the Gray List automatically.

This design matters for a business: a customer who mistypes a password a few times is not locked out permanently, but automated attacks are slowed down. You can also:

• Add your office's static IP to the White List so staff are never challenged.
• Add known-bad addresses to the Black List to block them completely.

Use the White List sparingly. An address on it bypasses protections, so do not whitelist entire ranges or networks you do not control.

The Malware Scanner

Real-time and on-demand scanning

The setting "Automatically scan all modified files" enables real-time scanning of files that change in users' DocumentRoot directories. The documentation notes that real-time scanning can add load, and offers an option to optimize it on supported file systems. Scheduled background scans and on-demand scans of any folder cover the rest.

Reviewing and cleaning

In Imunify360 > Malware Scanner, the Users tab lists each account with its scan status and actions:

• Scan starts a scan for that user.
• View Report opens the Malicious tab with the latest results.
• Cleanup attempts to clean infected files.
• Restore original restores a file to its state before cleanup, when a backup is available.

The History tab shows the automatic actions taken on infected files, and the Ignore List holds files you have marked as false positives.

Important: CloudLinux's documentation states that starting with ImunifyAV(+) version 6.2, the Quarantine and Delete actions were removed from the interface and command line. Older guides that tell you to "quarantine" a file are out of date; work with cleanup, restore and your own backups instead.

Cleanup is not the whole job

The scanner removes malicious code it recognizes, but it does not tell you how the attacker got in. After any infection, update or remove the vulnerable plugin, theme or script, change the account's passwords, and check for added admin users or scheduled tasks.

Proactive Defense

Proactive Defense runs as a PHP module for Apache and LiteSpeed and analyzes what scripts actually do, looking for patterns such as obfuscated command injection, malicious code planting, sending spam and SQL injection. It requires CloudLinux's Hardened PHP (alt-php) to work.

It has three modes:

1. Disabled: no protection from this feature.
2. Log Only: suspicious activity is logged but not stopped. This is the default.
3. Kill Mode: the script is terminated as soon as malicious activity is detected.

A sensible rollout:

• Leave it in Log Only for a period and review the detected events. Look for legitimate scripts that trigger alerts, such as custom plugins or import tools.
• For genuine false positives, use the event's "Move file to Ignore List" action, or fix the code that triggers the alert.
• Move to Kill Mode once the log is clean, then keep reviewing events after major site changes.

Keep in mind that Proactive Defense only covers sites running on Hardened PHP. Sites on other PHP builds will not benefit from it.

Using Imunify360 day to day

Daily (a few minutes)

• Check the Dashboard and Incidents for spikes in WAF alerts, brute-force attempts or new detections.
• Review new entries in the Malware Scanner's Malicious tab and clean or investigate them.
• Look at the Proactive Defense events if it is in Log Only mode.

Weekly

• Read the Reputation Management results. A blocklisted domain or IP usually means something on the server is compromised or sending spam.
• Review the White List and remove entries nobody can explain.
• Confirm that malware scans completed for all users and that notifications reach a real person.

After every incident

• Find the entry point (outdated plugin, stolen password, abused form) and fix it.
• Rotate the affected account's passwords.
• Rescan the account to confirm nothing was left behind.
• Keep a short note of what happened. Patterns across incidents point to the real weak spots.

What Imunify360 does not replace

Imunify360 is a strong layer, but it is one layer:

• Backups are still essential. Cleanup can fail, and some attacks, such as ransomware or database tampering, need a clean restore.
• Updates for WordPress, plugins, PHP and the operating system still need to be applied. The WAF can block known exploit attempts, but patching removes the weakness.
• Account security (strong passwords, multi-factor authentication for control panels, SSH keys) prevents attackers from simply logging in.

Get help running Imunify360

Core Florida IT manages cPanel servers with Imunify360 for businesses across Miami-Dade and South Florida, with remote support nationwide. We are not affiliated with CloudLinux; we simply use and configure the product for our clients. If you have Imunify360 but nobody reviews its alerts, or you want to know whether it fits your server, request a free IT assessment.

Sources

• Imunify360 Documentation: Introduction
• Imunify360 Documentation: Admin interface (Malware Scanner, Proactive Defense, Firewall)
• CloudLinux: Imunify360 documentation home