Website Malware Protection is an add-on for your hosting account that turns on automatic malware cleanup. It is built on Imunify360, which runs on every one of our servers.
What you get without it
Every hosting account we run is already scanned for malware, and the WordPress firewall is on by default. Without the add-on, that scanning is detection only: if something malicious appears in your files it is recorded and we are alerted, but nothing is removed automatically.
What the add-on changes
- Infected files are cleaned automatically, without waiting for anyone to notice or for you to ask.
- Files are checked as they change, so a file uploaded by an attacker is examined straight away rather than at the next scan.
- A full scan of the account runs every week, in the early hours of Sunday morning.
- Your databases are scanned as well as your files. Injected content in the database is a common way for a cleaned site to reinfect itself.
What cleanup actually does to a file
Cleanup removes the malicious code from the file rather than deleting the file, so a legitimate page that has had something injected into it keeps working. The original version is kept for 14 days, so if a clean-up ever affects something it should not have, it can be put back. Tell us promptly if you think that has happened, because after 14 days the original is gone.
Where to see it
Log in to cPanel and open Imunify360. That shows your account, the scan history and anything that has been cleaned.
Starting a scan yourself is not enabled, because a scan on demand competes with everything else running on the server. If you want one run immediately, open a support ticket and we will start it.
If malware is found
We are alerted whenever something is detected on an account, and we will contact you if there is anything you need to do. With the add-on the file is usually cleaned before anyone looks at it. What matters afterwards is closing the way in, which is almost always an out-of-date plugin or theme rather than the file itself.
It is per hosting account
The protection applies to one hosting account. If you have two websites on two separate hosting accounts with us, you need the add-on on each of them. If you are not sure how many accounts you have, ask us and we will tell you.
What it does not replace
Malware cleanup deals with the symptom. It does not update your software, and it is not a backup. A site that is cleaned every week is a site that is being broken into every week, and the fix for that is keeping plugins, themes and the core software up to date.
- Keeping software updated: why it matters more than anything else
- Updating WordPress, plugins and themes without breaking the site
- Securing a WordPress site: what actually matters
Ordering it
The add-on is ordered from the client area like any other service, and it is billed annually. Once it is paid for we enable it on the hosting account you named on the order.
