Imunify Security inside WordPress: what it shows and how to use it
PrintIn short: Imunify Security is the WordPress plugin of Imunify360, the system that protects TopHost's servers. It does not run a separate scan of your site; it brings into the WordPress dashboard what Imunify360 has already found on the server. You get the security picture without opening cPanel and without a second scanner eating into your account's resources.
How to tell whether you have it
- Sign in to the WordPress admin (wp-admin).
- Open Plugins and look for Imunify in the list.
- If it is not there and you would like to use it, send us the site address in a ticket. We will tell you whether it can be enabled on your server and how.
Even without the plugin, the same results are available in cPanel, under Security, in Imunify360.
What it shows
- The overall security status of the site.
- Files flagged during scans, with their paths.
- Blocked attacks and other security events for the site.
When the plugin reports a problem
- Read the details: which file is affected and since when. The date helps you pick a clean backup.
- Do not rush to delete. A WordPress core or plugin file should be replaced with the original rather than simply removed, or the site may stop working.
- Update everything: WordPress, themes and plugins. We recommend WP Toolkit in cPanel; the WordPress dashboard is the fallback.
- Change passwords: WordPress administrators, cPanel and FTP accounts.
- Carry on with An Imunify notice about infected files. If you are unsure what a file is, open a ticket before you change anything.
Questions we often get
Should I also install Wordfence or another security plugin?
For file scanning, usually not: the server already does it. A security plugin can still be handy for WordPress-side features such as limiting login attempts or two-factor login (see Protecting and analyzing WordPress website security). If you keep one, switch off its heavy scheduled scans so it does not duplicate the server's work.
Will the site get slower?
It should not. Scanning runs on the server, not during visits, and the plugin only displays the results.
Am I covered if I run old plugins?
Only in part. Imunify360 stops many known attacks, but an unpatched flaw remains a risk. What to do about it: Security flaw reported in a WordPress plugin or theme.
