Signature scanners only catch malware they already know. Proactive Defense works differently: it watches what PHP scripts actually do while they run, and stops them when they behave like malware, for example trying to send spam, write web shells or run system commands. It protects your site even against brand-new attacks.
Before you start
Proactive Defense runs on MdmHost servers automatically. To see events for your account, open cPanel → Security → Imunify360.
How it works
- Imunify360 hooks into PHP and monitors sensitive actions: running shell commands, writing executable files, opening network connections, sending mail in bulk.
- Each action is compared with rules describing malicious behaviour.
- When a rule matches, the script is logged or stopped, depending on the mode.
Modes
| Mode | What happens |
|---|---|
| Log only | The event is recorded but the script continues. |
| Kill | The script is stopped immediately and the event is recorded. |
| Disabled | No monitoring. |
The mode is set server-wide by MdmHost.
Read Proactive Defense events
- Go to cPanel → Security → Imunify360.
- Open the Proactive Defense tab.
- Each event shows the script path, the rule that matched, the time and the action taken.
Note: The tabs you see in Imunify360 depend on the server's settings and your package. If a tab in this guide is missing, that action is handled by MdmHost support.
What an event usually means
- A script in uploads, cache or a random folder: almost certainly malware. Scan and clean the account (see scanning for malware).
- A known plugin file: either the plugin is compromised, or it does something unusual (for example a backup plugin running system commands). Update it first and check whether the event repeats.
- Your own custom code: review what the code does at that line.
If Proactive Defense blocks a legitimate script
- Note the script path, rule and time from the event.
- Update the software; vendors often change behaviour that triggers rules.
- If it still happens, open a ticket with the details. MdmHost can review the rule and add an exception for that script if it is safe.
Warning: Do not try to work around a block by moving code or renaming files. If behaviour looks malicious to Proactive Defense, it is worth understanding why.
Signs it saved you
Events showing blocked attempts to write PHP files or call exec from an upload script mean an attacker found a way in but could not do damage. Treat it as a warning: find and fix the vulnerable plugin, then follow cleaning infected files and WordPress hardening.
Frequently asked questions
Does Proactive Defense slow PHP down?
The overhead is small for normal sites. It only inspects specific sensitive operations, not every line of code.
Can I turn it off for my account?
No. It is a server-wide protection maintained by MdmHost. Exceptions for specific safe scripts can be discussed with support.
Does it replace the malware scanner?
No. They complement each other: the scanner finds malicious files, Proactive Defense stops malicious behaviour at run time.