Security with Imunify360

Summary: This article explains what Imunify360, which comes preinstalled on every Liberation reseller VPS, does and how to handle malware alerts, blocked IP addresses, and false positives.

What Imunify360 does

• Firewall: Blocks known-bad IP addresses and brute-force attacks, and sends suspicious visitors through a CAPTCHA check.
• Web application firewall (WAF): Filters common attacks against WordPress and other web apps before they reach the site.
• Malware Scanner: Scans files as they change and on a schedule, and can clean or quarantine infected files.
• Proactive Defense: Watches PHP scripts as they run and can stop malicious behavior in real time.
• Client scanning in cPanel: Imunify360 also appears in each client's cPanel, where clients can see scan results for their own account.

Your license tier matches your plan. Launch and Studio use the "up to 30 users" tier, and Agency, Agency Plus, and Scale use the "up to 250 users" tier. Both tiers cover every account your plan allows.

Where to find it

In WHM, go to Plugins » Imunify360. The main tabs are Dashboard, Incidents, Firewall, Malware Scanner, Proactive Defense, and Settings.

Running a malware scan

1. Go to Plugins » Imunify360 » Malware Scanner.
2. Open the Users list.
3. Find the account you want to check and click Scan. To scan every account, use the option to scan all users.
4. When the scan finishes, open the account's results to see any detected files.

Run a scan on every newly migrated account and on any site that is acting strangely, for example redirecting visitors, showing unknown content, or sending spam.

Handling a malware alert

1. Review the detections. In Malware Scanner, open the account and look at the listed files and why each was flagged.
2. Clean or quarantine. Use the Clean action where it's available. If a file can't be cleaned safely, restore a known-good copy from backup. (On Studio and higher, open a ticket to request a restore.)
3. Close the entry point. Most infections come from outdated plugins, themes, or CMS core files, or from reused passwords. Update everything, and remove plugins the site doesn't use.
4. Reset passwords. Change the cPanel, CMS admin, FTP, and database passwords for the affected account.
5. Rescan to confirm the account is clean.
6. Tell your client what happened and what you fixed.

If we detect a security threat on your server, we contact you, not your client, as described in our Reseller Client Protection Policy.

Unblocking an IP address

If you, your team, or a client suddenly can't reach a site, cPanel, or WHM, the firewall may have blocked their IP address. Common causes are too many failed logins or a flagged network.

1. Ask the affected person for their public IP address. They can search "what is my IP" to find it.
2. Go to Plugins » Imunify360 » Firewall.
3. Search for the IP in the Black List and Gray List, and remove it.
4. If it's a trusted address, such as your office, add it to the White List with a comment explaining who it belongs to.

You can also allow an IP from the command line (as root over SSH):

imunify360-agent ip-list local add --purpose white 203.0.113.10 --comment "Office"

If the IP isn't in any Imunify360 list, cPHulk may have blocked it. Check WHM » Security Center » cPHulk Brute Force Protection. See Can't Log In to WHM or cPanel.

Dealing with false positives

• A clean file flagged as malware: Compare the file with a fresh copy from the plugin or theme vendor. If it's genuinely clean, add it to the ignore list in Malware Scanner so it isn't flagged again.
• A legitimate action blocked by the WAF: Check the Incidents tab for the time of the problem. Note the IP address, the domain, and the rule description.
• Not sure? Open a ticket before you ignore anything. It's better to double-check than to leave real malware in place.

For more detail, see the Imunify360 documentation.

Still stuck? Open a ticket

Our U.S.-based support team is available 24/7. Open a support ticket from the Liberation Client Area and include the affected domain or IP address and the time you saw the alert or block. Tickets are private, so they are the safe place to share server details. Never post passwords in public forums or chats.