Imunify360 false positives: add files to the ignore list safely

Malware scanners look for patterns. Sometimes legitimate code, such as licence checks, encoded files or security tools, matches a pattern and gets flagged. Imunify360 lets you add such files to an ignore list so future scans skip them. Use it carefully: ignoring real malware leaves your site open.

Before you start

• cPanel access and the flagged file's path (see scanning results).
• A reliable way to confirm the file is clean, such as the original download from the vendor.

Confirm it is really a false positive

• Compare with the original. Download the same version of the plugin or theme from its official source and compare the file. If they are identical, it is a false positive.
• Check where it lives. PHP files in wp-content/uploads, image folders or the site root with random names are almost never legitimate.
• Look at the code. Long blocks of encoded text with eval, base64_decode, gzinflate or str_rot13 are a red flag, unless it is a known encoder like ionCube.
• Check the date. A file modified recently, when you made no changes, is suspicious.

Add a file to the ignore list

1. Go to cPanel → Security → Imunify360.
2. In the malicious files list, find the file.
3. Choose Add to Ignore List (from the row menu or after selecting the file) and confirm.
4. Open the Ignore List tab to confirm it is there.

Restore a file that was cleaned by mistake

If the file was already cleaned or quarantined, restore the original first (see restoring a cleaned file), then add it to the ignore list so it is not cleaned again.

Remove a file from the ignore list

When you update the plugin or replace the file, remove the old entry: open Ignore List, select the path and click Remove. Ignored paths are skipped even if the file later becomes infected, so keep the list short.

Report the false positive

Reporting helps the vendor fix the signature for everyone. Send the file path, the detection name shown in Imunify360 and the software name and version to MdmHost support, and we will pass it on.

Common false positive sources

• Encoded commercial plugins (ionCube, SourceGuardian).
• Security or backup plugins containing malware signatures for their own scanners.
• Old PHP scripts using functions also popular with malware, such as eval.
• Developer tools such as file managers or database admin scripts uploaded to the site; these are also a real security risk and should be removed when not in use.

Frequently asked questions

Does the ignore list affect other accounts?

No. Your ignore list only applies to your own account.

Can I ignore a whole folder?

Ignoring single files is safer. Whole folders can hide new malware; ask support if you have a strong reason.

Is a WAF block also a false positive?

Possibly, but it is handled differently. See the guide on ModSecurity false positives for blocked requests.