Everything in the Imunify360 WHM interface can also be done with the imunify360-agent command. The command line is faster during incidents, works when you are locked out of WHM, and is easy to script.
On MdmHost hosting plans this is handled by our team. This guide is for administrators of their own cPanel server with root SSH access.
Before you start
- Imunify360 installed (see installing Imunify360).
- Root SSH access. Run
imunify360-agent --helporimunify360-agent COMMAND --helpfor the exact options on your version.
Status and version
imunify360-agent version
imunify360-agent rstatusrstatus confirms the licence is valid and the agent can reach Imunify360's servers.
IP lists and blocks
Whitelist an IP with a comment:
imunify360-agent whitelist ip add 203.0.113.10 --comment "office"Remove an IP from the blacklist or grey list:
imunify360-agent blacklist ip delete 203.0.113.10
imunify360-agent graylist ip delete 203.0.113.10List entries:
imunify360-agent whitelist ip list
imunify360-agent graylist ip list --limit 50The meaning of the lists is explained in firewall lists. If an IP is still blocked, also check cPHulk (see cPHulk).
Malware scanning
Scan one user's home directory, or any path:
imunify360-agent malware user scan --user username
imunify360-agent malware on-demand start --path /home/username/public_htmlCheck scan status and results:
imunify360-agent malware on-demand status
imunify360-agent malware malicious list --user usernameClean and restore
imunify360-agent malware user cleanup --user username
imunify360-agent malware malicious restore-original --user username FILE_IDFile IDs come from malware malicious list. The user-side view of cleanup is in cleaning infected files.
Ignore list
imunify360-agent malware ignore add /home/username/public_html/safe-file.php
imunify360-agent malware ignore listWarning: Ignored paths are never flagged again. Confirm a file is safe before ignoring it (see the false positive guide).
Read and change settings
imunify360-agent config show
imunify360-agent config update '{"MALWARE_SCANNING": {"default_action": "cleanup"}}'Use config show to see the exact key names on your version before updating.
Tip: Add --json to most commands for machine-readable output you can feed into scripts or monitoring.
Troubleshooting
"Imunify360 is not running"
Restart the service: systemctl restart imunify360, then check /var/log/imunify360/console.log.
A command is not recognised
Command names change slightly between versions. Use --help on the parent command to see what your version supports.
Frequently asked questions
Is it safe to script cleanup?
Yes, cleanup keeps backups of originals. Still, review results before mass-cleaning hundreds of accounts.
Can users run imunify360-agent?
No. It is a root tool. Users work in cPanel → Security → Imunify360.
How do I unblock an IP that keeps getting blocked?
Remove it from the grey list or blacklist, then find the cause in the incidents list: imunify360-agent incidents list shows recent events, often failed logins from one device.
Can I export the whitelist to another server?
List it with --json on the old server and add each entry on the new one with whitelist ip add, or script both steps.
Which logs help most?
console.log and error.log in /var/log/imunify360/ show agent activity; the incidents list shows security events.