An Imunify360 hit means the scanner matched a file against a malware signature. Some matches are real webshells or backdoors. Others are false positives on minified or unusual code. Read the full path before you restore anything, and treat PHP inside uploads as hostile until proven clean.
Imunify360 runs on our shared cPanel servers and quarantines files that look dangerous. Quarantine is a safety step, not a full cleanup by itself. A hit is a clue. You still need to check how the file got there and whether anything else changed.
How to read the path
Start with where the file lives. WordPress and most apps do not store executable PHP under the uploads folder. A hit on something like uploads or a random temporary directory is usually real malware. A hit inside a known plugin or theme file can sometimes be a signature match on compressed or obfuscated code, but that is not automatic proof of safety.
Paste the quarantined path into your ticket if you are unsure. We would rather help you decide than watch a restore reopen the same hole. Do not restore blindly because the site “needed” that file to load a page.
When a hit is likely real
Real compromises often leave more than one file. After a serious hit, look for new WordPress admin users, unexpected cron jobs that call a URL, and .htaccess rules you did not add. Overnight redirects are often persistence, not the first infected file.
If the incident was real, rotate cPanel, FTP, WordPress, database, and registrar passwords. Assume the attacker had broad access until you prove otherwise. Cleaning one quarantined path and stopping there is not a full recovery.
- Prefer restoring clean copies from a known good backup when you have one.
- Work from a snapshot or copy when possible instead of editing only the live tree.
- Do not hand a third party live FTP as their first step without a backup plan.
When it might be a false positive
Some theme and plugin files use patterns that look like eval-style malware to a generic rule. A hit on a file that matches the vendor’s current release can be a false positive, but only after you verify the file hash or contents against a trusted source. “It came with the theme” is not enough if the theme was nulled or heavily modified.
Imunify360 is a layer of protection on shared hosting. It does not replace updates, strong passwords, or removing abandoned plugins. Keeping software current still matters even when the WAF and malware scanner are on.
A scanner hit is the start of the checklist, not the end. Confirm the path, check for other changes, and only restore when you know why the file belongs there.
Tagged
Was this article helpful?
Be the first to rate this article.
