When Imunify360 finds malicious code, it can remove just the injected part and keep the rest of the file, so your site keeps working. This guide explains how cleanup works in cPanel, how to undo it if needed, and what to do when a file cannot be cleaned automatically.
Before you start
- cPanel access and the list of infected files (see scanning with Imunify360).
- Know where the latest clean backup is: cPanel → JetBackup 5 keeps daily restore points.
How cleanup works
- Imunify360 makes a backup copy of the file before changing it.
- Injected code (for example an obfuscated
eval(base64_decode(…))line) is removed. - Files that are entirely malicious, such as web shells, are quarantined or removed instead.
- On many servers, cleanup runs automatically right after detection, so you may already see the status Cleaned.
Clean files manually
- Go to cPanel → Security → Imunify360.
- Open the list of malicious files.
- Select the files with status Infected.
- Click Clean up (or the clean icon on each row) and confirm.
- Wait for the status to change to Cleaned.
Note: The tabs you see in Imunify360 depend on the server's settings and your package. If a tab in this guide is missing, that action is handled by MdmHost support.
Test the site
Open the site in a private window, log in to the admin area and test key features. Cleanup is accurate, but occasionally the injected code is woven into legitimate code and the file breaks.
Restore the original file
If a cleaned file breaks the site, Imunify360 can put back the version from before cleanup:
- In the file list, find the cleaned file.
- Choose Restore original (or open the file's history and restore the pre-cleanup copy).
Warning: The restored original still contains the malware. Restore only to get the site working while you replace the file with a clean copy from the software vendor.
When cleanup fails
- Identify what the file belongs to: WordPress core, a plugin, a theme or your own code.
- WordPress core: reinstall in Dashboard → Updates → Re-install version.
- Plugin or theme: delete its folder and install a fresh copy from the official source.
- Your own code: replace from your Git repository or local copy.
- Uploads folder PHP files: delete them; uploads should not contain PHP.
Prevent reinfection
- Change all passwords: cPanel, FTP, email, database users and WordPress admins (see resetting a cPanel password for resellers).
- Remove nulled (pirated) themes and plugins; they often contain backdoors.
- Update everything and remove unused plugins and old test sites.
- Follow WordPress hardening.
Troubleshooting
Malware returns every few hours
A hidden backdoor, cron job or compromised admin user is reinfecting the site. Check WordPress users for unknown administrators and cron jobs for unfamiliar commands, then ask support for a deeper scan.
Frequently asked questions
Can I restore the whole site from a backup instead?
Yes. Restoring from a JetBackup point before the infection is often faster for heavily infected sites. Fix the entry point afterwards or it will happen again.
Does cleaning delete my content?
No. Only malicious code is removed. Posts, images and settings are untouched.