How to install and configure Imunify360 on a cPanel server (root guide)

Imunify360 brings malware scanning and cleanup, a firewall, a WAF and Proactive Defense to a cPanel server. It installs with one script and is managed from WHM.

MdmHost shared, reseller and master reseller plans already include this, fully managed. This guide is for administrators running their own cPanel VPS or dedicated server with root access.

Before you start

• A cPanel server (AlmaLinux, Rocky Linux or CloudLinux) with root SSH access.
• An Imunify360 licence key, or an IP-based licence.
• Remove or disable other firewalls such as CSF; Imunify360 manages the firewall itself and conflicts with them.

Install Imunify360

1. Connect as root and download the installer:
   Copy

   wget https://repo.imunify360.cloudlinux.com/defence360/i360deploy.sh -O i360deploy.sh

2. Run it with your key:
   Copy

   bash i360deploy.sh --key YOUR_KEY

   For an IP licence, run bash i360deploy.sh without a key.
3. When it finishes, open WHM → Plugins → Imunify360.

Configure malware scanning

1. Go to Imunify360 → Settings → Malware.
2. Enable real-time scanning for user files.
3. Set Default action on detect to Cleanup (with quarantine if cleanup fails). Keep cleanup backups.
4. Schedule a background scan, for example weekly, at a quiet time.
5. Decide whether users may start scans and clean files from cPanel (see the user-side scanner).

Proactive Defense

In Settings → General (Proactive Defense section) choose Log only for the first week, review events, then switch to Kill mode. How it works for users is in Proactive Defense explained.

Firewall and WAF

• Add your own admin IPs to Firewall → White List so you are never locked out.
• Keep WebShield enabled so grey-listed visitors get a CAPTCHA (see WebShield).
• Enable the Imunify WAF rule set in Settings → General → WAF, and use the Incidents tab to find rule IDs behind false positives (see ModSecurity false positives).

Check it works

imunify360-agent version; imunify360-agent malware on-demand list

The first command confirms the agent runs; the second lists scans.

Troubleshooting

Installer stops because of CSF

Disable CSF (csf -x) and rerun, or let the installer integrate as it suggests.

You locked yourself out

Use the provider console and run imunify360-agent whitelist ip add YOUR_IP. See also firewall lists.

Frequently asked questions

Does Imunify360 require CloudLinux?

No. It runs on standard AlmaLinux or Rocky Linux cPanel servers, though it integrates well with CloudLinux.

Can I keep cPHulk enabled?

Imunify360 integrates with cPHulk; keep the default integration rather than disabling either.

How do I update Imunify360?

It updates through the system package manager. Keep automatic dnf updates or run dnf update regularly; signatures update on their own.

Where are the logs?

Agent logs are in /var/log/imunify360/. The Incidents and Malicious tabs in WHM are usually the faster place to start.

Should I notify users about cleanups?

Yes. Enable user notifications in the settings so account owners learn about infections and fix the cause.