Imunify360 scans every uploaded or changed file automatically, but a manual scan is useful after a security alert, before launching a site, or when Google warns visitors that your site is unsafe. This guide shows how to run a scan in cPanel and read the results.
Before you start
- cPanel access to the account (resellers can open it from WHM, see opening a customer cPanel).
- Time: a scan of a typical account takes a few minutes; large accounts take longer.
Start a scan
- Log in to cPanel and go to cPanel → Security → Imunify360.
- Open the Malware Scanner (or Files) tab.
- Click Start scanning (shown as Scan on some versions).
- Keep the page open or come back later; the status shows progress and the result.
Note: If there is no Scan button, on-demand scanning is disabled for users on that server. Real-time scanning still runs. Ask support to run a full scan for you.
Read the results
Each detected file is listed with its path, the detection reason (a signature name such as SMW-INJ-…) and a status:
| Status | Meaning | Your action |
|---|---|---|
| Infected | Malicious code found, not yet handled | Clean or delete |
| Cleaned | Malicious code removed, file kept | Test the site |
| Quarantined / Deleted | Whole file was malicious and moved away | Usually nothing |
| Cleanup failed | Automatic cleaning was not possible | Replace the file from a clean source |
| Ignored | You marked it as safe | Review occasionally |
Decide what to do
- Infected core or plugin files: clean them (see cleaning infected files), then reinstall the plugin or WordPress core from a clean copy.
- Unknown PHP files in uploads folders: these are almost always backdoors; delete them.
- Your own code flagged: it may be a false positive (see the ignore list).
After a scan finds malware
- Change cPanel, FTP, database and WordPress admin passwords.
- Update WordPress, plugins and themes; remove ones you do not use.
- Look for the entry point: outdated plugins, nulled themes, weak passwords.
- Rescan to confirm the account is clean.
A full WordPress recovery checklist is in cleaning a hacked WordPress site.
Troubleshooting
The same file is infected again after cleaning
A backdoor elsewhere rewrites it. Scan again, check scheduled tasks in cPanel → Advanced → Cron Jobs for unknown entries, and replace the whole plugin or theme.
Google still shows a warning
After cleaning, request a review in Google Search Console under Security issues.
Frequently asked questions
How often does Imunify360 scan automatically?
Files are checked in real time when created or changed, and the server runs periodic background scans. Manual scans are an extra check.
Does it scan databases?
The standard scanner checks files. Malicious JavaScript injected into WordPress posts may need a database scan; ask support if you suspect it.
Should I scan before restoring a backup?
Yes. Restore points made after the infection contain the same malware. Scan the restored files and pick a point from before the first detection.
What does the signature name tell me?
It identifies the malware family or pattern, which helps support and vendors confirm whether a detection is real or a false positive.