Understanding Your Imunify360 Alerts

Imunify360 runs on every NexzaHost account, scanning for malware and blocking attacks automatically. It also emails you, and those emails can be alarming if you do not know which ones matter.

Most require no action at all. Here is how to tell.

Alerts you can ignore

"Blocked N attacks" or a periodic security summary. This is Imunify reporting that it did its job. Every site on the internet is scanned by automated bots continuously; blocked attempts are the normal background noise of being online.

"IP blocked" for an address you do not recognise. Also routine — a brute-force attempt was stopped.

If nothing on your site is broken and the email says something was *blocked*, no action is needed.

Alerts that need action

"Malware detected" with a file path. This one is real. Go to the malware section below.

Your own IP blocked — you cannot reach your site or cPanel but it loads on mobile data. Unblock yourself, below.

Repeated malware detections after cleaning. The way in is still open, not just the files. Get help.

If your own IP is blocked

Usually caused by several failed logins, an FTP client retrying with a stale password, or a security plugin misfiring.

Confirm it first: load the site on mobile data with Wi-Fi off. Loads on mobile but not on your network → your IP is blocked.

In cPanel, open Security → Imunify360 → Incidents, find your IP and choose Delete or Whitelist. Get your IP from any "what is my IP" site.

If you cannot reach cPanel at all, message us on WhatsApp with your IP address and we will clear it from our side.

Then fix the cause — usually an old password saved in an FTP client or a phone mail app retrying every few minutes.

If malware is detected

Do not panic and do not immediately delete everything.

1. Look at what was found. cPanel → Security → Imunify360 → Malware Scanner. Each detection shows the file path and the signature.

2. Judge the file path.

• wp-content/plugins/something/ — likely a compromised or nulled plugin
• wp-content/uploads/*.php — almost certainly malicious. PHP files do not belong in uploads
• wp-includes/ or wp-admin/ — a core file has been modified
• .htaccess with unexpected redirects — a common injection

3. Clean it. Imunify can clean many detections itself — use the Cleanup action. It keeps a backup of the original, so a false positive is recoverable.

4. Then close the door. Cleaning files without fixing the entry point means it comes back within days. Do all of these:

• Update WordPress core, every plugin and every theme
• Delete unused plugins and themes rather than deactivating them — inactive code is still reachable
• Remove any nulled plugin or theme. These are the single most common infection route; the "free premium" version was free because of what was added to it
• Change every password: cPanel, WordPress admin, FTP, database
• Check Users in WordPress for admin accounts you did not create
• Regenerate your salts in wp-config.php to invalidate stolen sessions

5. Rescan and confirm clean.

False positives

They happen, particularly with heavily obfuscated commercial plugins. If a detection is in a file from a legitimate paid plugin and the site behaves normally, it may be a false positive.

Do not just ignore it. Send us the file path on WhatsApp and we will look at the actual content before you decide.

Reducing the noise

• Keep everything updated — most detections trace back to a known vulnerability in an outdated plugin
• Use strong, unique passwords, especially for the WordPress admin
• Enable two-factor authentication on cPanel
• Remove plugins you no longer use
• Never install nulled software

When to ask for help

Message us if malware returns after cleaning, if you cannot tell whether a detection is real, if the site is defaced or redirecting visitors, or if you have been blocked and cannot reach cPanel.

We can see the server-side logs, including how a file got there and when — which is usually what identifies the actual entry point rather than just its symptoms.