Websites are constantly threatened by automated bots, malware, compromised scripts, and other attacks. An attack does not necessarily have to be targeted at a specific website. A large portion runs fully automatically: bots scan servers and websites for known vulnerabilities, outdated plugins, insecure access credentials, or opportunities to inject malicious code.
This is precisely where to start ImunifyAV and Imunify360 Both security solutions are from CloudLinux and were developed specifically for Linux web servers and hosting environments. Although the names sound similar, the two solutions differ significantly in their range of functions.
Simply put, ImunifyAV a malware scanner. Imunify360 goes significantly further, forming a multi-layered security platform that detects and cleans malware, blocks attacks, analyzes suspicious behavior, and can protect websites even while an attack is underway.
What is ImunifyAV?
ImunifyAV is a security solution for detecting malware on Linux web servers. The scanner examines files within a hosting environment while attempting to detect malicious or tampered code.
These can include smuggled PHP files, backdoors, webshells, or manipulated components of a website. Especially with content management systems like WordPress, attackers can modify existing files or place additional files in the web space after a successful compromise.
A typical example is a vulnerable WordPress plugin. If an attacker succeeds in injecting malicious code through this vulnerability, the malware scanner can detect the suspicious file.
How does the malware scanner work?
The scanner scans files and analyzes them for known and suspicious structures. It doesn't just search for specific file names. Malware can hide in regular PHP files, manipulate existing code, or be heavily obfuscated.
Imunify therefore uses various detection mechanisms to track down malware, backdoors, webshells, and other manipulations.
This is an important component of server security. However, there is a fundamental difference between the Detecting an infection and the actively preventing an attack.
Right at this point, the significantly broader range of features of Imunify360 begins.
What is Imunify360?
Imunify360 is a comprehensive security platform for Linux web servers. The malware scanner is just one of several layers of protection.
The system combines malware detection and automatic cleanup with a firewall, web application firewall, intrusion detection and prevention, proactive defense, brute-force protection, and mechanisms against malicious bots and automated attacks.
The crucial difference thus lies in the approach: A malware scanner searches for malicious software. Imunify360 additionally attempts to detect and stop many attacks before they result in a successful compromise of the website.
Real-time protection: Files are not just checked during the next scan
A particularly important function of Imunify360 is the Real-Time Malware Scan. This real-time monitoring is activated in CURIAWEB.
This means that protection does not exclusively wait for a scheduled malware scan. Imunify360 can monitor changes to files in a website's DocumentRoot and immediately check newly or newly modified files.
Even files uploaded via a website or HTTP/HTTPS can be scanned in real time. The same applies to uploads via FTP, provided the server is configured accordingly.
This is relevant, for example, when a compromised web application attempts to place a malicious PHP file on the web space or when malware is to be introduced via an upload function. Imunify360 can detect such a file immediately and trigger appropriate protective measures instead of encountering it hours later during the next full scan.
This significantly reduces the time window between the appearance of a malicious file and its detection.
Detect malware and clean it automatically
If Imunify360 finds malware, protection doesn't end with a simple warning. The platform can automatically clean infected files.
This is particularly important in hosting environments. A compromised website can damage more than just the actual operator. Injected code can be misused, for example, for sending spam, phishing, unwanted redirects, spying on login credentials, or launching further attacks.
The faster an infection is detected and eliminated, the smaller the risk of further problems developing from it.
What does the Web Application Firewall do?
A Web Application Firewall, WAF for short, analyzes web requests and attempts to detect malicious requests before the targeted application processes them.
This is particularly relevant for WordPress. A WordPress website often consists not only of WordPress itself, but also of numerous plugins and themes. If a security vulnerability is discovered in a popular extension, automated systems sometimes start scanning the internet for vulnerable installations within a short time.
The WAF can detect and block corresponding attack patterns. Imunify360 also supports so-called Virtual Patching. This makes it possible to protect known vulnerabilities in WordPress, plugins, and themes without having to modify the file in question.
This does not replace a necessary update. However, it can form an important additional layer of protection, especially in the period between a security vulnerability becoming known and the installation of the corresponding update.
We explain in more detail why regular updates remain important anyway in the article Why WordPress updates are necessary.
Proactive Defense protects during execution
Proactive Defense pursues yet another approach.
A classical malware scanner examines files and attempts to determine whether malicious code is present in them. Proactive Defense, on the other hand, analyzes the Behavior of PHP scripts during their execution.
This enables the system to detect suspicious actions, such as obfuscated command executions, the injection of malicious code, certain forms of SQL injection, or an attempt by a manipulated script to send spam.
This is particularly interesting in the case of new or yet unknown attack methods. Instead of exclusively searching for a known malware signature, consideration is also given to what a PHP script is actually trying to execute.
Upon proper detection, Imunify360 can stop the execution of the malicious process.
Intrusion Detection and Protection against Brute-Force Attacks
Not every attack consists of a malicious file. A classic example is automated login attempts.
Bots can try out large numbers of different combinations of usernames and passwords in a short time. Such brute-force attacks can affect various services on a server.
Imunify360 monitors suspicious activity and can automatically block conspicuous IP addresses or subject them to additional verification. This layer of protection thus operates independently of whether malware is already present on a website.
Protection against bots and automated attacks
A significant portion of today's internet traffic is generated by automated systems. Among them are legitimate search engine crawlers, as well as scanners, scrapers, spam bots, and automated attack tools.
Imunify360 can detect suspicious automated traffic and intercept corresponding access requests. In doing so, legitimate visitors should remain as unaffected as possible.
This not only protects against certain attacks, but can also conserve server resources. A malicious bot whose request is already stopped at an upstream security layer cannot trigger resource-intensive processes within a website.
Additional protection directly in WordPress
With WordPress, CURIAWEB goes a step further. The Imunify Security Plugin for WordPress is automatically installed and works together with the server-side Imunify360 protection.
Therefore, the customer does not need to search for, purchase, or manually install the security plugin themselves.
The plugin brings information from the server-side security platform directly into the WordPress administration area. Among other things, the current security status of the website can be viewed there. Detected or cleaned malware as well as the status of important protection functions can thus be made visible directly within WordPress.
At the same time, the plugin complements the server-side protection mechanisms with WordPress-specific functions. This includes, in particular, the Web Application Firewall with virtual patching for known vulnerabilities in WordPress core, plugins, and themes.
Another layer of protection involves automated bots. The protection can detect and limit aggressive crawlers, scrapers, and other automated access before WordPress even needs to be fully loaded.
With this, a WordPress website at CURIAWEB multiple layers intertwined: server-side protection by Imunify360 and additional WordPress-specific protection directly within the CMS.
ImunifyAV or Imunify360 – what is the actual difference?
The most important difference is not that one of the products simply has a slightly better virus scanner.
ImunifyAV focuses primarily on malware detection. It primarily answers the question: Are there suspicious or malicious files on the server?
Imunify360, on the other hand, takes a multi-layered security approach. Malware detection is combined with automatic remediation, real-time monitoring, firewall mechanisms, attack detection, proactive defense, and further layers of protection.
| Function | ImunifyAV | Imunify360 |
|---|---|---|
| Malware scanner | Yes | Yes |
| Malware detection | Yes | Yes |
| Automatic malware removal | Not part of the free basic version | Yes |
| Real-time file monitoring | Limited or product-dependent | Yes |
| Web Application Firewall | Protection function not fully active | Yes |
| Virtual Patching for WordPress | Monitoring | Active protection |
| Proactive Defense | No | Yes |
| Intrusion Detection / Prevention | No | Yes |
| Advanced bot and attack protection | Restricted | Yes |
Why multiple security layers are important
No single security measure can completely protect a website.
A malware scanner can detect malicious software, but it cannot prevent every security vulnerability. A firewall can block many attacks, but it does not replace software updates. Secure passwords protect user accounts, but they do not help against an unpatched vulnerability in a plugin.
Therefore, a multi-layered approach makes sense.
At CURIAWEB, in addition to Imunify360, other security mechanisms are used. For example, hosting accounts run in isolated CloudLinux LVE environments. This separates customer accounts from one another and controls resources.
You can find out more about the technical hosting environment at Swiss web hosting by CURIAWEB.
Imunify360 is fully included at CURIAWEB
At CURIAWEB has Imunify360 with its protection features activated for all hosting customers and included in hosting at no extra charge.
This includes, among other things, malware scanning and automatic cleanup, real-time monitoring, a web application firewall, proactive defense, intrusion detection and prevention, and protection against various automated attacks.
Real-time scanning is also enabled. As a result, new and modified files are not simply ignored until the next regular malware scan. Uploads and file modifications can be checked immediately by the security system.
WordPress installations also automatically receive the Imunify Security Plugin. This adds WordPress-specific security features to the server-side protection and makes the security status visible directly within WordPress.
For the customer, this means: no separate Imunify360 license needs to be purchased and no additional security solution needs to be set up to use these protection mechanisms.
This is particularly relevant for WordPress. Due to its enormous popularity, WordPress is a frequent target of automated attacks. Anyone who does not want to take care of updates and technical maintenance themselves will find Managed WordPress an additional option to outsource the ongoing maintenance of the installation.
Security does not replace backups
Even an extensive security system like Imunify360 does not make backups redundant.
A backup pursues a different goal. Security software tries to prevent attacks, detect suspicious behavior, and eliminate malware. In contrast, a backup enables the restoration of data after a technical error, an accidental modification, a failed update, or corruption.
Therefore, at CURIAWEB, customer data is additionally backed up daily and retained with 30 rolling backup versions.
We explain how these fuses work in the Knowledge Base at Daily backups at CURIAWEB. The restoration of an existing backup can be requested from support if necessary.
Safety and data backup are therefore not alternatives. They fulfill different tasks and complement each other.
Imunify360 still does not replace a secure website
Despite all these protection mechanisms, one thing should not be misunderstood: even Imunify360 is not a free pass to leave WordPress, plugins, or themes unupdated for years.
Security updates should still be installed promptly, unneeded extensions removed, and strong, individual passwords used. An additional server-side security platform significantly reduces risks, but does not eliminate the responsibility for a properly maintained website.
Those who want to know what actually happens after a successful attack and which steps are necessary can find our detailed article on the subject WordPress hacked – what now? Immediate action & recovery.
Conclusion: ImunifyAV detects malware – Imunify360 protects on multiple levels
ImunifyAV and Imunify360 pursue the same fundamental goal, but differ significantly in scope.
ImunifyAV is primarily a malware scanner. It helps to detect malicious or tampered files on a web server.
Imunify360 expands this approach into a comprehensive security platform. Malware scanning and automatic cleanup are combined with real-time monitoring, firewall mechanisms, intrusion detection, Proactive Defense, WordPress-specific protection, and additional security layers.
At CURIAWEB, these security mechanisms are part of web hosting. Imunify360 is enabled for all hosting customers, real-time protection runs on the server side, and WordPress installations are additionally secured automatically with the Imunify Security Plugin – without additional license costs for the customer.
