Greylist & Whitelist Management

How the greylist works

When Imunify360 detects suspicious activity from an IP (failed logins, port scans, low-confidence attack signatures), it moves that IP to the gray list rather than immediately blocking it.

A graylisted IP is presented with a CAPTCHA challenge:

• If they solve it → they’re moved to a temporary whitelist and access is restored
• If they fail or don’t respond → they’re moved to the blacklist

This reduces false positives: legitimate users who happen to trigger a low-confidence rule can still access the server, while bots (which can’t solve CAPTCHAs) are blocked.

Viewing the greylist

WHM → Imunify360 → Firewall → Gray List.

The list shows all currently graylisted IPs with:

• IP address
• Reason for graylisting
• Time added
• Number of previous incidents

Moving an IP off the greylist

Whitelist (allow access)

If a client contacts you saying they can’t access their site and you’ve confirmed their IP:

1. Go to Firewall → Gray List
2. Find the IP
3. Click Move to White List

Or add directly to the white list: Firewall → White List → Add.

Blacklist (block permanently)

If an IP on the greylist is clearly malicious:

1. Find the IP in the Gray List
2. Click Move to Black List

Remove from greylist (let them try again)

1. Find the IP
2. Click Delete: removes from greylist, they’ll encounter normal detection rules again

Whitelist management

The white list contains IPs that bypass all Imunify360 checks permanently.

Good candidates for the whitelist:

• Your own office/home IP
• Monitoring service IPs (UptimeRobot, Pingdom, etc.)
• Trusted partner IPs that need unfiltered access

Not suitable for the whitelist:

• Client IPs (unless they have consistent static IPs and a specific need)
• Dynamic IPs (they change, so the whitelist entry becomes useless or dangerous)
• IPs you don’t fully control

Automatic whitelist from CAPTCHA

IPs that solve the CAPTCHA challenge are automatically added to a temporary whitelist for a configurable period (default: 1 hour). After this period, they’re subject to normal detection rules again.

Configure this period: Imunify360 → Settings → General → CAPTCHA Expiration.

Checking if a client is graylisted

If a client reports they can’t access their website or cPanel:

# Check if their IP is in any Imunify360 list
imunify360-agent blacklist ip list | grep CLIENT_IP
imunify360-agent graylist ip list | grep CLIENT_IP

Or search for the IP in Imunify360 → Firewall across all tabs.