How to use Imunify360 to check and protect your website.

Open Imunify360

Find Imunify360 in cPanel.

Log in to cPanel and use the cPanel search box to search for Imunify360, then open it.

The options shown can vary slightly depending on the security features enabled for your hosting package. The most important customer area is the malware file list, where detections for your account are displayed.

Malware Results

Check the infected or malicious files list.

Imunify360 shows files that have been detected as malicious or infected. For each detection, you can normally see the file path, when it was detected, the detection reason and its current status.

• Infected — malware or suspicious malicious code has been detected in the file.
• Cleaned — Imunify360 has cleaned the detected malicious content.
• Content removed — malicious content was removed during cleanup.
• Cleanup queued — the file is waiting for the cleanup process to run.

The file path is especially useful because it tells you which website, plugin, theme or application is affected when multiple sites are hosted in the same cPanel account.

Automatic Scanning

Hostmate handles malware scanning automatically.

You do not need to start malware scans yourself. Hostmate runs server-side malware scanning automatically, including background scanning and real-time protection for website files.

Real-time scanning can inspect newly uploaded files and files inside website document roots when they are modified. Use Imunify360 in cPanel to review detections rather than to start a scan.

Cleanup

Clean an infected file carefully.

If a Cleanup action is available, Imunify360 can attempt to remove the malicious code from an infected file. After cleanup, check the website to make sure it still loads and behaves normally.

If the affected file is part of WordPress core, a plugin or a theme, replacing it with a clean copy from the original trusted source is often preferable to keeping a file whose integrity is uncertain.

Ignore List

Use the Ignore List only for confirmed false positives.

Imunify360 can provide an Ignore List for files or directories that should not be scanned. This feature may not be available on every hosting account.

Do not add a file simply because you want a warning to disappear. Once a file is ignored, Imunify360 will no longer scan it, which can hide a genuine infection.

After Malware

Fix the cause, not only the infected file.

Cleaning malware removes the detected code, but it is also important to close the security problem that allowed the infection to happen.

• Update WordPress, plugins and themes — install current trusted versions and remove software you no longer use.
• Remove nulled or untrusted software — pirated themes and plugins are a common source of malicious code.
• Change passwords — especially WordPress administrators, cPanel, FTP and any credentials that may have been exposed.
• Check administrator users — remove any WordPress or application accounts you do not recognise.
• Review other detections — one infected file can be a symptom of a larger compromise.
• Check the site again — confirm pages, forms, redirects and admin access behave normally after cleanup.