How malware scanning works on Hostmate hosting.

Automatic Protection

Scanning runs on the server automatically.

Hostmate's Imunify360 malware protection runs at server level. It checks hosting files for known malware, injected malicious code and other suspicious file content without requiring you to start a scan from cPanel.

Background scanning provides broader account checks, while real-time scanning helps inspect files when they are added or changed.

Uploaded Files

New files are scanned as they are uploaded.

Imunify360 supports real-time scanning of files uploaded to websites over HTTP or HTTPS and files uploaded by FTP. This helps detect malicious files at the time they are introduced to the hosting account rather than waiting for the next full background scan.

Edited Files

Modified website files can be scanned in real time too.

Real-time protection is not limited to newly uploaded files. Imunify360 can monitor files inside website document roots and scan them when they are modified.

For example, when a PHP file is edited and saved, the saved file is a filesystem modification. The real-time scanner can detect that change and inspect the modified file for malware.

Check Results

Review malware detections in Imunify360.

Log in to cPanel, search for Imunify360 and open it. The malware file list shows detections associated with your hosting account.

• File path — shows exactly which file and website are affected.
• Detection time — shows when the malware was identified.
• Reason — identifies the malware signature or detection type.
• Status — shows the current state of the detected file.

If the malware list is empty, Imunify360 is not currently showing any malware detections for your account.

If Malware Is Found

Check the affected website and fix the cause.

A malware detection tells you which file was affected, but removing one malicious file does not necessarily fix the original security problem. A compromised login, vulnerable plugin or outdated application can allow malware to return.

• Update website software — install current WordPress, plugin, theme and application versions.
• Remove abandoned software — delete unused plugins, themes and old website installations.
• Change exposed passwords — particularly WordPress administrator, cPanel and FTP credentials.
• Check administrator accounts — remove users you do not recognise.
• Review all detections — one malicious file may not be the only affected file.