Proactive Defense

Proactive Defense is Imunify360’s behavioral analysis engine. While signature-based scanning detects known malware by matching file contents against a database, Proactive Defense monitors what PHP code does at runtime: catching zero-day exploits and obfuscated malware that has no known signature.

How it works

When PHP executes a script, Proactive Defense intercepts the execution and analyzes the behavior in real time. It looks for patterns like:

• Writing files outside the normal document root
• Executing system commands (exec, shell_exec, system)
• Opening outbound network connections to unknown hosts
• Reading sensitive system files (/etc/passwd, SSH keys)
• Creating new PHP files programmatically
• Base64-decoding and evaluating code at runtime (eval)

If the behavior matches a malicious pattern, Proactive Defense terminates the process immediately: before any damage is done.

Modes

Mode	Behavior	When to use
Disabled	No behavioral monitoring	Never recommended
Log	Detects and logs suspicious behavior without blocking	Initial tuning period
Kill	Terminates malicious processes immediately	Production (default on RC)

Setting the mode

WHM → Imunify360 → Proactive Defense → Settings → Mode → select mode → Save.

All RemarkableCloud managed servers run Proactive Defense in Kill mode. You don't need to change anything: it's already active.

Handling false positives

Occasionally, Proactive Defense blocks legitimate code: typically security scanners, backup plugins, or development tools that inspect the filesystem.

Step 1: Identify the blocked script

When Proactive Defense kills a process, it logs the event:

grep "proactive" /var/log/imunify360/console.log | tail -50

Or in WHM: Imunify360 → Incidents: look for events with type “Proactive Defense”.

Step 2: Verify it’s legitimate

Before adding an exception, confirm the blocked script is actually legitimate and not malware. Check:

• Is the file part of a known plugin or application?
• Does the file content look like normal PHP code?
• Was it recently added (possible compromise)?

Step 3: Add an exception

For confirmed legitimate scripts that Proactive Defense incorrectly blocks:

1. Go to Imunify360 → Proactive Defense → Ignore List
2. Click Add Rule
3. Enter the file path or use a wildcard pattern
4. Add a comment explaining the exception
5. Save

Keep the exception list minimal and review it periodically.

Proactive Defense and WordPress plugins

Some WordPress plugins trigger Proactive Defense:

Plugin type	Why it triggers	Resolution
Security scanners (Wordfence, etc.)	Reads many system files	Add to ignore list
Backup plugins	Writes large archives	Add to ignore list
File managers	Writes and executes PHP	Evaluate carefully before excluding
Code editors (Adminer, etc.)	Executes dynamic queries	Only exclude in dev environments

Viewing the event log

Imunify360 → Incidents shows all Proactive Defense events with:

• Timestamp
• Which user and file triggered the event
• The specific behavior that was detected
• Action taken (killed or logged)

Use this to understand your server’s attack surface and identify accounts that may be compromised.