Malware scanning and quarantined files

Imunify360 security suite & Antispam is a standard feature of myPandos Shared and WordPress Hosting plans. It runs on the server, alongside Plesk, and its job is to spot malicious code in your website files before it can be used against you or your visitors.

What it does

• Scans your website files for known malware signatures and suspicious patterns.
• Blocks known-bad web requests before they reach your application.
• Works continuously in the background — you do not have to start it.

What “quarantined” means

When the scanner flags a file, it is quarantined: moved out of the way so it can no longer be executed or served. That is deliberately different from deleting it — quarantine is reversible, so a false positive can be put back.

In practice you will notice it as part of your site going missing or breaking — a plugin that stops working, a page that 404s, an upload that vanishes.

What to do when a file is quarantined

1. Work out whether it is yours. Does the path match a plugin, theme or script you installed on purpose? Or is it something you have never seen, in a folder that should only contain uploads?
2. If you believe it is a false positive, open a ticket from the Support section of your dashboard and give us the full file path, what the file is for, and where it came from (which plugin, theme or vendor). We will review the detection with you and tell you what can be done about the file.
3. If you do not recognise it, treat the site as compromised — one flagged file is usually not the only one. Follow What to do if your website is compromised.
4. Do not simply re-upload the same file to get the site working again. If the detection is real you are putting the malware straight back; if it is a false positive it will be flagged again anyway.

Why legitimate files get flagged

False positives are uncommon but they happen, usually with heavily obfuscated or minified code, licence-checking routines in commercial themes, and old plugins that use techniques modern scanners treat as suspicious. That is a good reason to keep everything current.

Reducing detections in the first place

• Keep your CMS, plugins and themes updated — outdated components are the single most common way sites are infected.
• Delete plugins and themes you are not using. Inactive code is still reachable code.
• Use strong, unique passwords for your CMS admin, Plesk, database users and FTP/SSH.
• Never install nulled or pirated themes and plugins. Backdoors in them are exactly what this scanner is built to find.
• Keep backups you can actually restore from — see Hosting and VPS backups and restores.

A note on control panels

myPandos hosting is managed in Plesk. If a guide you find online tells you to look in a different control panel, it does not apply to your service — ask us instead.