Scanning for malware with Imunify360 and Monarx

Every Ruachost hosting account includes two security tools in cPanel, at no extra cost:

Tool	What it does
Imunify360	Scans your files for malware, blocks attacks with a firewall, and can clean infected files
Monarx Security	Watches PHP files in real time and blocks malicious code as it runs

Both run automatically in the background. You can also use them yourself to check and clean your site.

Scan and clean with Imunify360

1. Log in to cPanel and open Imunify360 under Security.
2. The Files tab lists infected files that have been found, with the reason and the action taken.
3. To scan now, click Scan. Larger sites take a while.
4. For each infected file, choose Cleanup if available. Imunify360 removes the malicious code and keeps a backup of the original. If a file can’t be cleaned, delete it or replace it with a clean copy.

If a file is wrongly flagged, for example a security plugin’s test file, you can add it to the Ignore List. Only do this if you’re sure the file is safe. See Using Imunify360.

Check Monarx Security

1. In cPanel, open Monarx Security under Security.
2. Review any detected threats and the files involved.

Monarx blocks malicious code automatically, so a file listed here may already be blocked. You still need to clean or replace it.

After cleaning

Scanners remove malware, but not the way in. To stop it coming back:

1. Update everything: WordPress, plugins and themes. Delete plugins and themes you don’t use. Old, unused plugins are the most common way in.
2. Change all passwords: cPanel, WordPress admin users, FTP accounts and database users.
3. Check WordPress users: delete any admin users you don’t recognise.
4. Replace WordPress core files with clean copies. See Restoring WordPress core files.
5. Ask Google to review your site if it was flagged. See Website flagged as unsafe by Google or Facebook.

If cleaning is too complex, restoring a backup from before the infection is often faster. Then update everything and change passwords. See Restoring files, email and databases using JetBackup.

What Ruachost support can help with

You’re responsible for cleaning your own website files, using the tools above. Our support team can:

• explain what a scan found and what it means
• help you find the infected files and how the attacker got in
• help you restore a clean backup
• unblock your account or IP address once the site is clean

Open a support ticket if you need help.

Related articles

• Repairing and securing a hacked site
• Cleaning up an SEO spam hack
• WordPress security