Open cPanel one morning and there's a shield icon in the sidebar you've never really clicked on — ImunifyAV, or on some plans, Imunify360. Most people ignore it until a support ticket, a Google Safe Browsing warning, or a "malware found" email forces the issue. If you've never actually used the scanner, here's what it does, how to read its results without panicking, and how to keep it quiet by keeping your site clean.
Symptom: Why You're Suddenly Paying Attention to It
Usually one of these happens first:
- You get an automated email: "Malicious code detected in your account" with a list of file paths you don't recognize.
- The ImunifyAV badge in cPanel shows a red or orange status instead of green.
- Your host's abuse team suspends outbound mail or the whole account pending a scan.
- A plugin update or theme install suddenly gets deleted, and you assume it's a bug — it's actually the scanner acting on a signature match.
None of that means your site is destroyed. ImunifyAV/Imunify360 is designed to catch this stuff early, before Google or your visitors do.
Cause: What's Actually Running Behind That Icon
ImunifyAV is a free malware scanner bundled with most cPanel accounts. It signature-matches files against a database of known web malware (shells, backdoors, spam injectors, defacement scripts) and flags anything suspicious. Imunify360 is the paid upgrade — same scanning engine plus a real-time web application firewall, proactive defense that blocks malicious PHP execution before it runs, and automatic cleanup instead of just detection.
A few things trigger a flag even on a healthy site:
- Genuinely infected files — usually from an outdated plugin, a nulled theme, or a compromised FTP/cPanel password.
- False positives — some page builders, caching plugins, and custom scripts use eval() or base64-encoded strings for legitimate reasons, which look identical to obfuscated malware to a signature scanner.
- Leftover files from an old infection — you cleaned the visible hack months ago but a dormant backdoor file never got deleted.
Fix: Running a Scan and Reading the Results
In cPanel, open ImunifyAV (search "malware" in the top search box if you can't find the icon). You'll land on a dashboard showing your domain's current status: Clean, Suspicious, or Infected.
1. Start a manual scan
Click Scan Now. A full scan of a typical WordPress account takes anywhere from a few minutes to over an hour depending on file count — don't close the tab, but you can navigate away and come back.
2. Review flagged files by severity
Results are grouped: Malware (high confidence, usually a real infection), Suspicious (needs a human look), and Ignored (files you've previously whitelisted). Click any file path to see the exact matched pattern — this is usually enough to tell if it's a shell script dropped in wp-content/uploads/ (almost always malicious, since that folder should never contain executable PHP) or something inside your theme's legitimate code.
3. Clean or quarantine
For confirmed malware, use Clean to let Imunify attempt an automatic removal, or Quarantine to move the file out of the live site without deleting it — safer if you're not 100% sure and want to restore it later. Avoid clicking Clean on files inside core WordPress or plugin directories without checking first; sometimes the safer move is reinstalling that plugin fresh from wp-admin instead of trusting an automated patch.
4. Whitelist real false positives
If you've confirmed a flagged file is legitimate (a common one: minified JS bundles or license-check code in premium themes), select it and choose Ignore so it stops showing up on every future scan. Don't mass-ignore things you haven't actually checked — that defeats the point.
5. If you're on Imunify360, check Proactive Defense logs
Under Proactive Defense, you'll see PHP execution attempts that were blocked in real time — often the first sign of an attacker probing your site before they succeed. A spike here with no matching successful infection is actually the system working correctly.
When the Scanner Alone Isn't Enough
ImunifyAV is a scanner, not a full incident response tool. If you're dealing with an active hack — defaced homepage, mass spam redirects, unfamiliar admin users in WordPress — clean the malware here first, then go through password resets (cPanel, FTP, WordPress admin, database), update every plugin and theme, and check wp-content/uploads/ and wp-includes/ for PHP files that shouldn't exist. A scanner tells you what's infected; it doesn't close the hole the attacker got in through.
| Situation | Recommended Action |
|---|---|
| Single confirmed malware file, known origin | Clean or delete, then patch the vulnerable plugin |
| Unsure if a file is malicious | Quarantine, don't delete — review before permanent removal |
| Repeated false positive on the same legitimate file | Whitelist it via Ignore |
| Whole-site defacement or spam redirect | Scan + full password reset + plugin/theme audit, not scan alone |
Prevention: Keeping the Badge Green
- Turn on automatic updates for WordPress core and reputable plugins — most infections start with a known, already-patched vulnerability.
- Never use nulled/pirated premium plugins or themes; they're a common source of pre-installed backdoors.
- Use unique, strong passwords for cPanel, FTP, and WordPress admin — credential stuffing is still one of the top infection vectors.
- Schedule a weekly scan instead of only running one reactively (ImunifyAV usually runs on a schedule automatically, but it's worth confirming under Settings).
- If you're on Imunify360, leave Proactive Defense enabled — it stops a lot of attacks before they ever produce a file for the scanner to find.
- Keep offsite backups regardless. A scanner reduces risk, it doesn't eliminate the need for a clean restore point.
Frequently Asked Questions
Is ImunifyAV free, or do I need Imunify360?
ImunifyAV (detection only) is included free with most cPanel hosting. Imunify360 adds real-time firewall protection, automatic cleanup, and proactive defense — it's a paid upgrade, and worth it for any site handling logins, payments, or customer data.
The scanner deleted a file my site needed. What now?
Check the Quarantine section first — files moved there aren't gone, they're just relocated out of the live path, and you can restore them. If it was already deleted outright, restore that specific file from your most recent backup rather than the whole account.
Why does it keep flagging the same plugin every scan?
That's almost always a false positive from obfuscated-but-legitimate code (common in licensing checks or minified bundles). Verify the plugin is from a trusted source and up to date, then whitelist the specific file so it stops re-flagging.
Can I run a scan without waiting for the scheduled one?
Yes — click Scan Now on the ImunifyAV dashboard any time. It's safe to run on a live site; it only reads files, it doesn't take your site offline.
My scan came back clean, but Google still shows a warning. Why?
Google's index can lag behind your cleanup by a few days. Once you've confirmed a clean scan, request a review through Google Search Console's Security Issues report to speed up the warning being lifted.
