[{"data":1,"prerenderedAt":212},["ShallowReactive",2],{"seo-verification":3,"blog-imunify360-server-security-explained-ma-en":6,"promo-bar-likely":211},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-imunify360-server-security-explained-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":150,"ctaBody":151,"ctaButton":152,"ctaUrl":153,"relatedPosts":154},125,"imunify360-server-security-explained",{"fr":12,"en":10,"ar":13,"es":14},"imunify360-securite-serveur-expliquee","imunify360-شرح-أمان-الخادم","imunify360-seguridad-servidor-explicada","Imunify360: server security explained","How Imunify360 works: WAF, real-time antivirus, PHP Proactive Defense, KernelCare, network firewall and patch management for cPanel\u002FWHM servers.",11,1,false,"2026-02-19T00:00:00+00:00","2026-11-08T01:13:15+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fimunify360-securite-serveur-expliquee-poster.svg","A cPanel server exposed in production is a permanent target: SQL injections, obfuscated PHP shells, brute-force scanners, unpatched CMS vulnerabilities. Imunify360, developed by CloudLinux, combines into a single suite six layers of defense that work together continuously, without manual intervention. Here is what each component actually does, how they chain together, and how to diagnose common problems.",[35,39,49,52,55,58,61,83,86,89,92,113,116,148],{"type":36,"title":37,"body":38},"h2","Six defense layers, one product","Imunify360 is not just an antivirus. It stacks six complementary protection levels that reinforce each other: network firewall, WebShield (bot protection), application WAF, antivirus scanner with cleanup, Proactive Defense (PHP runtime), and intrusion detection (IDS\u002FIPS). The strength of this architecture is that a threat that bypasses the WAF can still be stopped by Proactive Defense, and a threat that gets past the PHP runtime will be detected during the next antivirus scan. Each layer is independent but feeds into the next.",{"type":40,"title":41,"items":42},"ul","The six layers in detail",[43,44,45,46,47,48],"**Network firewall with threat intelligence**: blocks known malicious IPs from a database fed by the global Imunify network, which covers several tens of millions of domains according to the vendor. When an IP attacks one server in the network, it is blocked across all others within minutes.","**WebShield and bot protection**: filters incoming HTTP traffic before it reaches the application — adaptive CAPTCHA, Graylist, layer 7 DDoS protection.","**Application WAF (ModSecurity + Imunify rules)**: inspects every HTTP request and blocks known exploits (injections, file inclusions, XSS). Rules are updated automatically from CloudLinux servers.","**Antivirus and malware scanner**: real-time scanning of newly written files, schedulable background scan, automatic cleanup — Imunify attempts to eliminate malicious code while preserving the rest of the file.","**Proactive Defense**: a PHP module that analyzes script behavior at runtime (not just static content). Blocks obfuscated webshells, reverse shells and data exfiltration even if the file passes the antivirus scan.","**IDS\u002FIPS and patch management**: detection of abnormal system-level behavior, coupled with KernelCare to apply Linux kernel patches without a reboot.",{"type":36,"title":50,"body":51},"Proactive Defense: stopping obfuscated malware","Proactive Defense is the hardest layer to bypass. It does not scan files on disk — it intercepts PHP execution in real time and examines behavior patterns: attempts to write files outside the webroot, calls to `exec()`, `shell_exec()`, `system()`, `eval()` on unsanitized data, SQL injections from a script that should only be reading from the database. The module is available for Apache and LiteSpeed. Its main value is against **obfuscated malware**: a webshell that gets through static scanning tools because its code is base64-encoded and decoded at runtime will be stopped by Proactive Defense the moment it tries a dangerous action. It requires CloudLinux's Hardened PHP (alt-php) to operate.",{"type":36,"title":53,"body":54},"KernelCare and reboot-free patch management","Imunify360's patch management relies on KernelCare (also developed by CloudLinux). KernelCare applies Linux kernel security patches **in live memory**, without stopping the server or the hosted sites. On a shared cPanel server hosting 200 clients, a reboot imposed for a kernel patch creates an uncomfortable maintenance window. KernelCare eliminates this constraint: the kernel runs on the patched version within seconds, with no downtime. The integration documented by Imunify360 covers the kernel; system libraries (`glibc`, `openssl`) follow the usual system updates. Automatic updates matter for Imunify360 itself too: the flaw in the AI-Bolit component (shared by Imunify360, ImunifyAV and ImunifyAV+), which allowed arbitrary code execution, up to root privileges, when scanning a crafted file, was fixed in October 2025 by version 32.7.4-1. The fix was pushed automatically to the vast majority of servers before the security advisory published in November 2025.",{"type":36,"title":56,"body":57},"RapidScan and CloudAV: scan performance at scale","On a server hosting hundreds of gigabytes of client files, a full daily antivirus scan is CPU-intensive. Imunify360 addresses this with two mechanisms. **RapidScan** speeds up repeated scans by up to 20 times compared to the first full scan: it maintains local metadata and cloud hashes to re-scan only files that have been created or modified since the last pass. **CloudAV** offloads deep analysis to Imunify Security's cloud infrastructure, without consuming local CPU for suspicious files that warrant a closer look. A third lever, **Low Resource Usage**, reduces CPU and RAM consumption (WebShield disabled, minimized WAF ruleset) — useful on VPS instances with limited resources where Imunify360 shares the server with MySQL, PHP-FPM and the rest of the cPanel stack.",{"type":36,"title":59,"body":60},"Deployment: installing Imunify360 on cPanel\u002FWHM","The official installation is done from the SSH command line as root. There is no `yum` repository to add manually: a deployment script downloads and configures everything automatically.",{"type":62,"title":63,"steps":64},"steps","Step-by-step installation",[65,68,71,74,77,80],{"title":66,"body":67},"Download the installation script","From a root session: `wget https:\u002F\u002Frepo.imunify360.cloudlinux.com\u002Fdefence360\u002Fi360deploy.sh -O i360deploy.sh`",{"title":69,"body":70},"Run the deployment with your license key","Execute `bash i360deploy.sh --key YOUR_LICENSE_KEY`. The key is obtained from your CloudLinux Network (CLN) account after purchase. For a 14-day trial, the trial key received by email is used the same way; with an IP-based license, run the script without arguments: `bash i360deploy.sh`.",{"title":72,"body":73},"Verify WHM registration","Log in to WHM as root, then navigate to **Plugins → Imunify360**. Accept the license agreement on first access. The interface immediately displays the firewall status, active scans, and recent incidents.",{"title":75,"body":76},"Enable Proactive Defense","In WHM Imunify360, open the **Proactive Defense** tab and switch to `Kill Mode` (blocks and stops the malicious script) rather than `Log Only` (logging only, the default mode). In `Kill Mode`, a suspected PHP execution is stopped instantly. Stay in `Log Only` for a few days if you have complex business applications, to identify false positives before switching.",{"title":78,"body":79},"Configure the scheduled scan","In **Settings → Malware Scanner**, set the frequency (daily recommended) and directory exclusions (caches, large backups). The first full scan can take several hours depending on the size of hosted data.",{"title":81,"body":82},"Register the license in CLN","The Imunify360 license, key-based or IP-based, is managed in the **CloudLinux Network (CLN)** — exactly like a CloudLinux OS license. When migrating, remove the old server (or old IP) from the license in CLN, register the new one (`imunify360-agent register YOUR_KEY`, or `imunify360-agent register IPL` for an IP-based license), then check with `imunify360-agent rstatus`.",{"type":84,"body":85},"tip","Imunify360 supports **AlmaLinux, Rocky Linux, RHEL, CloudLinux OS, Ubuntu 22\u002F24 and Debian**, and integrates with cPanel, Plesk, DirectAdmin or standalone. Since November 2024, Ubuntu 24 is officially supported. On a server with SELinux enabled, the `i360deploy.sh` script applies the Imunify360 SELinux policy module itself; only if you install the RPM packages directly do you need to compile and load it by hand (`checkmodule`, `semodule_package`, `semodule -i`), then restart `imunify360` and `imunify360-webshield`.",{"type":36,"title":87,"body":88},"WAF rules management and OWASP conflicts","Imunify360's WAF relies on ModSecurity with a ruleset maintained by CloudLinux. If your server previously used the OWASP ruleset (common on manually configured cPanel setups), **disable OWASP before installing Imunify360**: the two rulesets create conflicts, cascading legitimate blocks and massive false positives. Imunify360 manages its own rules autonomously — it is not designed to coexist with OWASP. In case of conflict after installation, the official documentation recommends switching to `Off`, in the WHM **ModSecurity Vendors** section, every third-party vendor except the Imunify360 ruleset, then, if that ruleset is missing, reinstalling it with `imunify360-agent install-vendors`.",{"type":36,"title":90,"body":91},"Troubleshooting: common error messages","The most common problems after installing or updating Imunify360 have precise causes and documented solutions.",{"type":62,"title":93,"steps":94},"Resolving common errors",[95,98,101,104,107,110],{"title":96,"body":97},"\"Imunify agent is not running\"","Most common cause: the `imunify360` service did not start after a reboot or update. Check with `systemctl status imunify360` then `journalctl -u imunify360 -n 50`. If the service is active but the dashboard still shows this message right after installation, give it time: the agent's SQLite database is syncing with the interface, and the official documentation advises waiting up to 60 minutes. If the problem persists, restart manually: `systemctl restart imunify360`.",{"title":99,"body":100},"\"Connection refused\" on an internal agent socket","This type of error (`Errno 111`) means that no process is listening on the internal communication socket between Imunify360 components. The usual cause is a stopped agent, or a daemon (such as `imunify360-wafd`) that did not restart after an update. Check `systemctl status imunify360` and the log (`journalctl -u imunify360 -n 50`), then restart the service: `systemctl restart imunify360`. If the problem recurs, force the update to the latest stable version with the official `imunify-force-update.sh` script (`wget -O imunify-force-update.sh https:\u002F\u002Frepo.imunify360.cloudlinux.com\u002Fdefence360\u002Fimunify-force-update.sh && bash imunify-force-update.sh`).",{"title":102,"body":103},"\"You must install the following extensions before you can edit their values: imunify360\" (WHM)","This WHM message appears when editing a cPanel package on a server where Imunify360 is installed but feature management is not enabled. Resolution command: `imunify360-agent feature-management native enable`. The operation is immediate and does not require a restart.",{"title":105,"body":106},"\"Malware detected\" notifications not received","Imunify360 can detect malware without sending the configured e-mail alerts. First check that the notification service is active in **Settings → Notifications** and that the configured email address is reachable from the server (test with `sendmail` or `mail`). If the configuration is correct, check that the server can reach the central server `imunify360.cloudlinux.com` outbound on port 443, a check given by the official documentation. Ports 52223 and 52224, for their part, are local WebShield ports, not outbound ports.",{"title":108,"body":109},"Lost connectivity to `files.imunify360.com` or `imunify360.cloudlinux.com`","Automatic updates of WAF rules and antivirus signature databases go through these two domains. If the server cannot reach them (restrictive outbound firewall, proxy, internal DNS), rules and signatures stop updating. Check with `curl -v https:\u002F\u002Ffiles.imunify360.com` and add an outbound exception if necessary.",{"title":111,"body":112},"Imunify360 plugin missing from WHM interface","If the Imunify360 menu entry does not appear in WHM\u002FcPanel despite an apparently successful installation, first check that the license is registered: `imunify360-agent rstatus` must return `OK`; otherwise register the agent (`imunify360-agent register YOUR_KEY`) and refresh WHM. Also verify that the `imunify360` service is `active (running)` before diagnosing the interface.",{"type":36,"title":114,"body":115},"Licenses: how it works","The Imunify360 license is activated **by key or by the server's IP** and billed by the number of users (cPanel, Plesk accounts, etc. on the server). Tiers are chosen by the total number of hosted accounts; current prices are published on the vendor's pricing page. A standalone offer (without a control panel) is also available for pure Nginx or Apache servers. Registration is done in the **CloudLinux Network (CLN)**, the same portal as for CloudLinux OS licenses. In case of migration to a new IP, the license transfer is handled directly from the CLN portal — no need to repurchase. Reseller licenses (5+ servers) benefit from volume pricing. With ServOrbit, Imunify360 licenses are available directly from the client area, bound to the IP of your dedicated server or cloud VPS.",{"type":117,"title":118,"headers":119,"rows":123},"comparison","Imunify360 vs. separate tools: what you avoid",[120,121,122],"Need","Without Imunify360","With Imunify360",[124,128,132,136,140,144],[125,126,127],"Network firewall + threat intelligence","CSF + LFD (manual config, no global network)","Integrated, auto-updated from the global Imunify network",[129,130,131],"Application WAF","ModSecurity + OWASP (rules to maintain manually)","Imunify ruleset maintained and pushed automatically",[133,134,135],"Malware antivirus","ClamAV (scan only, no automatic cleanup)","Scan + automatic cleanup + CloudAV",[137,138,139],"PHP runtime protection","No integrated equivalent, to be assembled yourself","Integrated Proactive Defense",[141,142,143],"Kernel patching without reboot","Manual update + maintenance window","Integrated KernelCare",[145,146,147],"Centralized WHM management","Disparate tools, no unified interface","Native WHM plugin, unified incident view",{"type":84,"body":149},"If your server runs **CloudLinux OS** (common on shared cPanel servers), Imunify360 benefits from enhanced integration with per-user PHP cages (CageFS). Each cPanel account sees an isolated PHP environment: malware executing in one client's site context cannot read other clients' files. This environment combines PHP isolation (CloudLinux), runtime protection (Imunify360 Proactive Defense) and antivirus scanning in a single coherent deployment.","Secure your server with Imunify360","Firewall, antivirus and continuous proactive detection for your hosted sites. Imunify360 license bound to your server's IP.","View server licenses","\u002Flicences-cpanel",[155,176,196],{"id":156,"slug":157,"slugs":158,"title":162,"excerpt":163,"readTime":164,"views":18,"isPinned":19,"noindex":19,"publishedAt":165,"updatedAt":166,"category":167,"categories":173,"featuredImage":30,"bgImage":31,"posterImage":175,"relatedSolution":30},124,"what-is-cloudlinux-os",{"fr":159,"en":157,"ar":160,"es":161},"quest-ce-que-cloudlinux-os","ما-هو-cloudlinux-os","que-es-cloudlinux-os","What is CloudLinux OS?","CloudLinux OS explained: LVE isolation, hosting server stability, cPanel\u002FPlesk compatibility and the difference with AlmaLinux or CentOS.",2,"2026-02-20T00:00:00+00:00","2026-11-08T01:13:14+00:00",{"id":168,"name":169,"slug":170,"color":171,"icon":172},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[174],{"id":168,"name":169,"slug":170,"color":171,"icon":172},"\u002Fblog\u002Fcovers\u002Fquest-ce-que-cloudlinux-os-poster.svg",{"id":177,"slug":178,"slugs":179,"title":183,"excerpt":184,"readTime":164,"views":185,"isPinned":19,"noindex":19,"publishedAt":186,"updatedAt":187,"category":188,"categories":193,"featuredImage":30,"bgImage":31,"posterImage":195,"relatedSolution":30},123,"what-is-a-cpanelwhm-license",{"fr":180,"en":178,"ar":181,"es":182},"quest-ce-quune-licence-cpanel-whm","ما-هي-رخصة-cpanelwhm","que-es-una-licencia-cpanel-whm","What is a cPanel\u002FWHM license?","cPanel and WHM explained: what the license is for, how it is priced (Admin, Pro, Premier) and how to activate it on your VPS or dedicated server.",0,"2026-02-21T00:00:00+00:00","2026-10-20T23:18:07+00:00",{"id":189,"name":190,"slug":191,"color":192,"icon":191},5,"Comparison","comparatif","bg-info\u002F10 text-info",[194],{"id":189,"name":190,"slug":191,"color":192,"icon":191},"\u002Fblog\u002Fcovers\u002Fquest-ce-quune-licence-cpanel-whm-poster.svg",{"id":197,"slug":198,"slugs":199,"title":203,"excerpt":204,"readTime":205,"views":18,"isPinned":19,"noindex":19,"publishedAt":206,"updatedAt":187,"category":207,"categories":208,"featuredImage":30,"bgImage":31,"posterImage":210,"relatedSolution":30},126,"server-backups-jetbackup-explained",{"fr":200,"en":198,"ar":201,"es":202},"sauvegardes-serveur-jetbackup","نسخ-الخوادم-الاحتياطية-شرح-jetbackup","copias-seguridad-servidor-jetbackup","JetBackup on cPanel\u002FWHM: installation and restore","How to install JetBackup on WHM, set up S3 or SFTP destinations, schedule backups and restore an account, a database or an email independently.",9,"2026-02-18T00:00:00+00:00",{"id":168,"name":169,"slug":170,"color":171,"icon":172},[209],{"id":168,"name":169,"slug":170,"color":171,"icon":172},"\u002Fblog\u002Fcovers\u002Fsauvegardes-serveur-jetbackup-poster.svg",true,1794270433511]