You upload a plugin, theme or script and it disappears, the upload fails, or the file is emptied. On MdmHost this usually means Imunify360's real-time scanner detected malicious code and acted at once. It is protecting the account, but you need to know whether the file was really dangerous.
Before you start
- cPanel access to the account.
- The file name and the time of the upload.
Signs of a real-time detection
- FTP upload completes, but the file is missing or 0 bytes a moment later.
- A WordPress plugin or theme upload fails with an unpacking or "could not copy file" error.
- File Manager shows the file briefly, then it is gone.
Confirm in Imunify360
- Go to cPanel → Security → Imunify360.
- Look in the list of malicious files or the history for the file path and time.
- The entry shows the detection name and the action: cleaned, quarantined or deleted.
Reading results is explained in scanning with Imunify360.
Why legitimate-looking uploads get flagged
| Upload | Likely reason |
|---|---|
| Nulled (pirated) premium plugin or theme | Contains a backdoor; very common |
| Old backup of a hacked site | Infected files are still in the archive |
| Web shell, file manager or "admin tool" scripts | Same code attackers use |
| Encoded commercial script | Rarely, a false positive on obfuscated code |
Warning: Never try to bypass the scanner by renaming or zipping files. If the file is a nulled plugin, the right fix is to get the genuine version from the developer.
What to do next
- Nulled or unknown source: download the official version and upload that.
- Old backup: restore from a clean point instead, or clean the files first (see cleaning infected files).
- Genuine software from the vendor: it may be a false positive. Compare it with a fresh download and contact support (see false positives).
Uploading large sites
When migrating a site, scan the archive locally first with a reputable antivirus, and expect Imunify360 to remove anything malicious during extraction. Check the list afterwards so you know which files are missing. For a smooth move, see migrating WordPress to MdmHost.
Frequently asked questions
Can I get the deleted file back?
Quarantined or cleaned files can often be restored from Imunify360, but think twice: the original contains the detected code.
Does this happen with Git deployments too?
Yes. Any file written to your account is scanned, whatever the upload method.
Will my FTP client show an error?
Usually not. The upload succeeds, then the scanner acts within seconds, which is why the file seems to vanish.
How do I know a plugin is genuine?
Download it from WordPress.org or the developer's own site with your licence. Plugins from "free premium" download sites are the most common source of backdoors.
Can resellers see these detections?
Resellers can open the customer's cPanel from WHM and check Imunify360 there.