# Scanning for malware with Imunify360 and Monarx

> Use the Imunify360 and Monarx security tools in cPanel to find and clean malware on your website, and what Ruachost support can help with.

Source: https://helpcenter.ruachost.com/ssl-security/website-security/scanning-for-malware-with-imunify360-and-monarx/

Every Ruachost hosting account includes two security tools in cPanel, at no extra cost:

| Tool | What it does |
| --- | --- |
| **Imunify360** | Scans your files for malware, blocks attacks with a firewall, and can clean infected files |
| **Monarx Security** | Watches PHP files in real time and blocks malicious code as it runs |

Both run automatically in the background. You can also use them yourself to check and clean your site.

## Scan and clean with Imunify360

1. Log in to cPanel and open **Imunify360** under **Security**.
2. The **Files** tab lists infected files that have been found, with the reason and the action taken.
3. To scan now, click **Scan**. Larger sites take a while.
4. For each infected file, choose **Cleanup** if available. Imunify360 removes the malicious code and keeps a backup of the original. If a file can't be cleaned, delete it or replace it with a clean copy.

If a file is wrongly flagged, for example a security plugin's test file, you can add it to the **Ignore List**. Only do this if you're sure the file is safe. See [Using Imunify360](https://helpcenter.ruachost.com/cpanel/security/using-imunify360/).

## Check Monarx Security

1. In cPanel, open **Monarx Security** under **Security**.
2. Review any detected threats and the files involved.

Monarx blocks malicious code automatically, so a file listed here may already be blocked. You still need to clean or replace it.

## After cleaning

Scanners remove malware, but not the way in. To stop it coming back:

1. **Update everything:** WordPress, plugins and themes. Delete plugins and themes you don't use. Old, unused plugins are the most common way in.
2. **Change all passwords:** cPanel, WordPress admin users, FTP accounts and database users.
3. **Check WordPress users:** delete any admin users you don't recognise.
4. **Replace WordPress core files** with clean copies. See [Restoring WordPress core files](https://helpcenter.ruachost.com/wordpress/guides/restoring-wordpress-core-files/).
5. **Ask Google to review your site** if it was flagged. See [Website flagged as unsafe by Google or Facebook](https://helpcenter.ruachost.com/ssl-security/website-security/website-flagged-as-unsafe/).

If cleaning is too complex, restoring a backup from before the infection is often faster. Then update everything and change passwords. See [Restoring files, email and databases using JetBackup](https://helpcenter.ruachost.com/cpanel/files/restoring-files-email-and-databases-using-jetbackup/).

## What Ruachost support can help with

You're responsible for cleaning your own website files, using the tools above. Our support team can:

- explain what a scan found and what it means
- help you find the infected files and how the attacker got in
- help you restore a clean backup
- unblock your account or IP address once the site is clean

[Open a support ticket](https://dashboard.ruachost.com/submitticket.php) if you need help.

## Related articles

- [Repairing and securing a hacked site](https://helpcenter.ruachost.com/ssl-security/website-security/repairing-and-securing-a-hacked-site/)
- [Cleaning up an SEO spam hack](https://helpcenter.ruachost.com/ssl-security/website-security/cleaning-up-an-seo-spam-hack/)
- [WordPress security](https://helpcenter.ruachost.com/ssl-security/website-security/wordpress-security/)